API Gateway:VPC authorization connectivity test

VPC access authorization

A VPC access authorization is a record that allows API Gateway to access backend services deployed in your VPC. To create one, provide your VPC ID, the instance ID of the CLB or ECS instance that hosts the service, and the service port number. Together, these values uniquely identify a backend service and authorize API Gateway to access it. For more information, see Use a resource in a VPC as an API backend.

Connectivity test

1. Log on to the API Gateway console. In the left-side navigation pane, choose Manage APIs > VPC Authorization, and create a vpc access authorization.

2. Click Test Connectivity and select the target API Gateway instance.

   Important

   Ensure that the selected instance does not have an access control policy configured. Otherwise, the connectivity test might fail.

3. Click Test. A network probe is sent from the selected API Gateway instance to the backend service specified in the vpc access authorization. After the test is complete, you can view the result on the current page.

   • Test passed

     A green check mark to the left of the instance drop-down list indicates that the network connection is established and the connectivity test passed.

     This feature is available only for gateway instance versions 3.5.3.791 and later. If the feature is not available, check your instance version or contact us to request an upgrade.

   • Test failed

     A failed connectivity test typically displays a message indicating that the network connection between the API Gateway instance and the service in your vpc access authorization could not be established. If the test fails, click the Troubleshooting Guide link and follow the instructions to troubleshoot.

     A red error icon (×) appears to the left of the Instance field in the connectivity test dialog box, indicating a network failure.

Troubleshooting

If the connectivity test fails, click Troubleshooting Guide to open a dialog box that walks you through the resolution steps. The dialog box content varies based on the instance type (CLB or ECS) specified in your VPC access authorization.

The troubleshooting process consists of three main steps:

1. Verify the vpc access authorization information.

   When you create a vpc access authorization, you must specify the VPC ID, instance ID, and service port number. In this step, go to the console of the corresponding cloud service to verify that the information you entered is correct.

   Verify the VPC ID: Log on to the VPC console. In the left-side navigation pane, click VPC. Find the ID of the target VPC in the instance list. Verify the instance ID: Log on to the ECS console. In the left-side navigation pane, click Instances. Find the ID of the target ECS instance in the instance list. Verify the service port number: Confirm that the listening port of the backend service matches the port number specified in the vpc access authorization.

2. Check the security group of the ECS instance or the blacklists and whitelists of the CLB instance.

   • If your Vpc access authorization points to an ECS instance with a configured security group, add the egress IP address of the API Gateway instance to the inbound rules of the security group.

   • If your Vpc access authorization points to a CLB instance that uses a whitelist-based access control policy, add the egress IP address of the API Gateway instance to the address entries of the corresponding access control policy group.

3. Check the running status of the backend service.

   In this step, check the running status and health of the backend service. If the instance specified in the vpc access authorization is an ECS instance, check its health status. If the instance is a CLB instance, check the running status of its configured listener and verify that it has passed health checks. To verify that the port is valid, you can log on to any server in your VPC and run the curl command to check if the specified port on the ECS or CLB instance is listening.