This topic describes how to use API Gateway to access a backend service in a VPC. It also explains how to use AppCode authentication from Alibaba Cloud App for secure API calls.
Prerequisites
You have a VPC. For more information, see Create a VPC with an IPv4 CIDR block and Create a VPC with an IPv6 CIDR block.
You have an ECS instance. For more information, see Create an ECS instance.
Purchase a Server Load Balancer (SLB) instance and an ECS instance in the VPC, and deploy your service.
In this example, the backend service for API Gateway is an ECS instance in a VPC. An Nginx web service is deployed on the ECS instance at port 80.
Procedure
To use API Gateway to access a backend service in a VPC, follow these steps:
Create a VPC access authorization
Create a VPC access authorization to allow API Gateway to access your VPC.
Log on to the API Gateway console. Select a region and, in the left-side navigation pane, choose API Management > VPC Authorization.
On the Authorization List page, click Create Authorization in the upper-right corner.
On the Create VPC Authorization page, enter the VPC Authorization Name, VPC Id, Instance ID or IP Address, and Port.
NoteTo access a site (vhost) on an SLB or ECS instance using a specific domain name, configure the domain name in the Host field.
You can find the VPC ID, instance ID, or private IP address on the details page of your backend service, such as an ECS or Classic Load Balancer (CLB) instance.
Changing the network type to public is not supported and will cause request failures.
Create an API group
An API group is a management unit for APIs. You must create an API group before you can create an API.
Log on to the API Gateway console. Select a region and, in the left-side navigation pane, choose API Management > Group Management. Then, click Create Group in the upper-right corner.
In the Create Group dialog box, select an Instance, enter
nginx-demofor Group Name and/for Base Path, and then click OK.
On the Group List page, you can view the created group. Click the group name to go to the Group Details page, where you can bind a domain name, modify basic information, or change the group instance.
API Gateway automatically assigns a public second-level domain name to the API group. This domain name is for debugging only and is limited to 1,000 calls per day. In regions outside the Chinese mainland, such as China (Hong Kong), the limit is 100 calls per day. For production use, bind a custom domain name to the group.
Create an API
Log on to the API Gateway console. Select a region and, in the left-side navigation pane, choose API Management > Group Management.
On the Group List page, find the
nginx-demogroup and click API Management in the Actions column.On the API List page, click Create API in the upper-right corner.
On the Create API page, in the Basic Information section, configure the following parameters and click Next.
Parameter
Example
Group
nginx-demo
API Name
nginx-test
Security Authentication
Alibaba Cloud App
AppCode Authentication
Allow AppCode (Header & Query) Authentication
Signature Algorithm
HMAC_SHA256
In the Define API Request section, configure the following parameters and click Next.
Parameter
Example
Protocol
HTTP, HTTPS
Request Path
/nginx
HTTP Method
GET
Request Mode
Pass-through
NoteThis step defines how a client, such as a browser, a mobile app, or another business system, can send requests to your API. You need to define the request protocol, request path, HTTP method, and request mode. In this example, Request Mode is set to Pass-through, meaning API Gateway forwards client requests with their original parameters directly to the backend service in the VPC.
In the Define Backend Service section, configure the following parameters and click Next.
Parameter
Example
Backend Configuration
Select Custom Backend Service
Backend Service Type
Select VPC
VPC Authorization Name
***-microservice
Backend Request Path
/
HTTP Method
GET
Backend Timeout
10000
NoteThis step defines how API Gateway maps parameters and connects to the backend service after receiving a client request. In this example, the backend service type is VPC. Select the VPC access authorization that you created or enter its name, and then specify the backend request path.
In the Define Response section, click Create.
NoteThis step generates API documentation to help callers understand the API. You can set the response Content-Type, response example, and error response example. This example does not involve these settings. Click Create.
In the message that appears, click Publish.
In the Publish API dialog box, set Environment to Release, enter a description in the Remarks field, and then click Publish.
NoteAfter you modify an API, you must publish it to an environment for the changes to take effect. API Gateway provides three built-in environments: Release, Pre, and Test.
Create an application and authorize the API
An application is the identity used to call an API. In this example, the authentication method is set to "Alibaba Cloud App" when you create the API. After you publish the API, you must create an application and authorize it to call the API.
Create an application
Log on to the API Gateway console. Select a region and, in the left-side navigation pane, choose API Calling > Application Management.
On the Applications and Authorizations page, click Create APP in the upper-right corner.
In the Create Application dialog box, enter an Application Name and click OK.
The application name can contain Chinese characters, letters, digits, and underscores (_). It must start with a letter or Chinese character and be 4 to 26 characters in length. You can also expand Tag Settings, Custom AK, or Extended Fields, and enter a Description of up to 180 characters.
On the Applications and Authorizations page, click the name of the application that you created to go to the Application Details page. You can see two authentication methods for Alibaba Cloud App: AppKey and AppCode. In this example, we use AppCode for simple authentication. For more information, see Call an API by using simple authentication (AppCode).
Authorize the API
Log on to the API Gateway console. Select a region and, in the left-side navigation pane, choose API Management > API List.
On the API List page, find the
nginx-testAPI. In the Actions column, click
and choose Authorize.In the Authorize panel that appears, set Select an environment to authorize to Release. Search for the application that you created, click Add, and then click OK. A success message is displayed.
Allow API Gateway egress IP in security group
If your ECS instance's security group has inbound rules that restrict traffic, you must add the API Gateway egress IP address to the security group's allowlist. This action prevents the security group from blocking requests from API Gateway. The required egress IP address belongs to the instance that hosts your API group.
Log on to the API Gateway console. In the left-side navigation pane, choose API Management > Group Management, and then click the name of your target API group.
On the Group Details page, view the Instance Type of the group.
In the left-side navigation pane, choose Instances and Clusters. Click the instance type, find the corresponding instance, and then view the Egress IP Address information.
The egress IP addresses include a public egress IP address and an internal VPC address.
Log on to the ECS console. In the left-side navigation pane, choose Instances & Images > Instances. Click the ID of your ECS instance. Go to the Security Groups tab, and click the security group name. On the Security Group Details page, choose Inbound > Quickly Add Rules, and configure the egress IP address of the gateway.
In the Quickly Add Rules dialog box, set Authorization Policy to Allow. Enter the gateway's egress IP address in the Authorization Object field. Select All (1/65535) for Port Range, and then click OK.
Debug the API
After configuring an API, use this feature to verify that it works as expected before calling it from a client.
The Debug page supports request messages of up to 512 KB in size. For larger requests, use an SDK for debugging.
Your configured instance blacklists, whitelists, and IP address-based access control plug-ins must allow traffic from 47.245.113.207.
This page does not support debugging for the JWT plug-in.
Only public domain names are supported for debugging.
Log on to the API Gateway console. In the left-side navigation pane, choose API Calling > Debug.
On the Debug page, select the
nginx-testAPI that you created. For Authentication Method, select Use AppCode. Then, click Send Request.If the call is successful, the response status code is 200, and the response body returns the default Nginx welcome page in HTML, which includes text such as
Welcome to nginx!.If debugging fails, see the following topics:
Call the API
For more information, see Call an API from a client.
If you do not specify an environment for a domain name, API calls default to the Release environment. For more information about API environments, see Manage environments.
This topic is a quick-start guide and does not cover backend high availability. For high availability, see Use a resource in a VPC as the backend service of an API.