API Gateway:Use a resource in a VPC as the backend service of an API

Constraints and supported resources

API Gateway can create APIs for resources deployed inside VPCs. Before API Gateway can reach a VPC resource, you must grant it explicit access through a VPC access authorization.

• Only internal CLB instances are supported. Public CLB instances cannot be used as VPC-type backend services.

• Access is port-specific. Authorizing port 80 of a CLB instance does not grant access to any other port on that instance.

• The authorization covers only the resource and port you specify — it does not expose other resources in the VPC.

• If your CLB instance has an access control list configured, or if your ECS instances have security group rules, you must add the API Gateway egress IP addresses to the allowed list.

1. Authorize API Gateway to access resources in a VPC

To create an API backed by a VPC resource, first authorize API Gateway to access that resource by specifying the resource and a port — for example, port 443 of a CLB instance or port 80 of an ECS instance.

After authorization:

• API Gateway can reach the resource over the specified port.

• The authorization applies only to API calls — it does not grant broader network access to the VPC.

• API Gateway can only access the resource over the authorized port. For example, authorizing port 80 of a CLB instance means API Gateway can only reach that CLB instance on port 80.

Supported backend resource types:

• ECS instance: In the Create VPC Access dialog box, enter the ECS instance ID or its private IP address in the Instance ID or IP Address field.

• CLB instance: Only internal CLB instances are supported. Enter the CLB instance ID or its private IP address in the Instance ID or IP Address field.

2. Build an HA architecture

Use an internal CLB instance as the backend service to distribute traffic across multiple ECS instances based on your forwarding policy. This improves both system performance and application availability.

Before you begin, make sure you have:

• A VPC in the region where you want to deploy the backend service

• At least one ECS instance in that VPC with your application (this example uses Nginx)

• An internal CLB instance in the same VPC, configured to listen on port 80 of the ECS instances

2.1 Create instances in a VPC

Purchase and create an internal CLB instance and one or more ECS instances in the same VPC. In this example, the CLB instance forwards traffic on port 80 to ECS instances running Nginx.

2.2 Authorize API Gateway to access the VPC

1. Log on to the API Gateway console.

2. In the left-side navigation pane, choose Manage APIs > VPCs.

3. On the VPC Access Authorizations page, click Create Authorization.

4. In the Create VPC Access dialog box, configure the following parameters: VPC Access Name, VPC Id, Instance ID or IP Address, and Port Number.

5. If you need to specify a virtual host (vhost) domain name to access a site on the CLB or ECS instance, enter it in the Host field.

   Note

   VPC Access Name is the identifier for this authorization entry. You will select it by name when creating an API, so use a unique name within API Gateway to simplify future management.

2.3 Create an API

Creating an API with a VPC-type backend follows the same procedure as creating APIs with other backend types. For details, see Create an API.

For a full walkthrough including application creation and authorization, see Create an API with a service in a VPC as the backend service.

2.4 Test the API

Test the API using any of the following methods:

• Debug the API in the API Gateway console

• Use an SDK to call an API

• Call an API with an AppCode

2.5 Configure security

API Gateway reaches VPC backend services over the internal network. If your internal CLB instance has an access control list configured, or if your ECS instances have security group rules, add the API Gateway egress IP addresses to the allowed list.

• CLB instances: Add the egress IP addresses to the CLB access control configuration. For details, see the Enable access control topic in the CLB documentation.

• ECS instances: Add a security group rule to allow inbound traffic from API Gateway egress IP addresses. For details, see Add a security group rule.

To get the egress IP addresses of API Gateway, see Create an API with a resource in a VPC as the backend service.

FAQ

Does API Gateway support public CLB instances?

No. API Gateway supports only internal CLB instances for VPC-type backend services. To route traffic to a public CLB instance, create an API with an HTTP/HTTPS backend service instead.

Can I authorize API Gateway to access multiple VPCs?

Yes. Create a separate authorization entry for each VPC in the API Gateway console. API Gateway can then use resources from any of the authorized VPCs as backend services.

Why am I unable to authorize API Gateway to access a VPC?

Check the following:

• The VPC ID is correct.

• The instance ID or IP address of the backend resource is correct.

• The port number matches what the backend service listens on.

• The authorization entry is created in the same region as the VPC.

Does a VPC access authorization affect the security of my VPC?

• No. API Gateway can only call resources in your VPC after you explicitly authorize it.

• Only the authorized API Gateway instance can call those resources.

• You can further restrict access by configuring access control policies on the ECS or CLB instances used as backend services.

Does API Gateway support VPCs in different regions?

Yes. Use Cloud Enterprise Network (CEN) to connect API Gateway to VPCs in other regions. For configuration details, see What is CEN.