API Gateway integrate privately with ECS microservice
Published: 2023-11-05 15:18:14

This post noted some steps for configuring AWS API Gateway work with ECS to work with microservices. Some AWS services are used like API Gateway, ELB, ECS, VPC.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/hyk4ihaaynuut89bqtaw.png)
In summary, the steps contain of:
- Create VPC.
- Create ECS service target group and attach it with ALB. 
- Create ECS cluster and run services.
- Create ALB target group and attach to NLB.
- Create API gateway for REST API, and point the gateway to NLB using VPC Link.

**1. Create VPC**

Create a VPC with 2 public and 2 private subnets, 1 internet gateway and 1 NAT gateway
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/jchir782giob409vr8s4.png)
Check the route table of both private subnets to make sure an instance of the private subnet can go to the internet through the NAT gateway. Correctly, route table will have a route for destination is 0.0.0.0/0.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/gd4qtc05zu9ismj3f2em.png)
**2. Create ECS service target group and attach it with ALB**
Create a Target Group with IP addresses target type, place the group to created VPC. Other options are leave by default. One target group correspond with one microservice, you need to create many target group and configure each target group with a rule on listener of ALB.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/fhzdrbcz0b1gypwur2ow.png)
Next, create an ALB with internal scheme, point the listener on port 80 to the created target group. Make sure the ALB nodes are placed at 2 private subnets, and using the default security group.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/15yqw3buduv5ccdkyz46.png)
**3. Create ECS cluster and run services**
Create an ECS cluster with Fargate launch type. Next, create a task definition which has one container for demo purpose, using the Nginx docker image. In real world, this docker image will be replicated by a microservice docker image.
The task definition has Fargate launch type, Linux/X86_64 OS, 0.5 CPU and 1 GB RAM. Task also has some specific configurations, follow the below images. Others are to leave by default.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/vnvmzfyk7ghnjitwqiby.png)
After creating task definition, we create a service for cluster. At environment, choose Launch type for Compute option. At deployment configuration, choose Service for Application type. Then open the net work configuration, choose created VPC and exclude 2 public subnets, only use 2 private subnets. Security group is default.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/l5my3rb6m55stj038jwq.png)
Next, open the Load Balancing and attach this service with created target group and ALB.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ajq3opj617nfs7zujdmi.png)
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/amxwmgyirwiyh1xdoc8n.png)
After creating service, it takes some time for status will be changed to Active. Then, checking the target group associate with ALB, we will see one healthy target.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ltygzvad4839q7p7vqr4.png)
**4. Create ALB target group and attach to NLB**
We create another target group with target type is ALB, place it to created VPC. Then we register the created ALB to target group. Next, we create NLB and associate NLB to the created ALB target group.
For network configuration, we also use created VPC and 2 private subnets.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/7m19jreiafjsbx5xjplp.png)
Checking the ALB target group, we have one healthy target.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ci4w6lpj7vo6a5lxn4ym.png)
**5. Create API gateway for REST API, and point the gateway to NLB using VPC Link**
Move to the API Gateway and create a Rest API, choose new API and REST protocol. Then go to the VPC and create a new one, point it to created NLB.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/04uvxafx5g3k77a0eh6z.png)
We need to wait for the status change to Available. At this time, we go to the API and create a proxy resource with GET method and setup request integration. In the real world, you need to add the {proxy+} to your endpoint URL to match with context path of API endpoint. Proxy resource help ALB distribute request to correct microservice host on ECS cluster.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ivzotpow9w7a7bpcmlcp.png)
Then we deploy gateway to a stage, on this stage we configure some variable.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/6hkzmma3ghw8j5ktswar.png)
If the VPC Link status changed to Available, we go back to the NLB and update the security group to allow request from API gateway to NLB.
Creating a new security group and add one inbound rule
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/w452s7ulx9gkp21c3z1h.png)
At NLB security configuration, attach the created security group to it and uncheck the Enforce inbound rule on PrivateLinks traffic.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/yffnakqo3r41tr76b8jh.png)
Finally, go to the API Gateway and take the link of the stage. Open this link on a new browser tab and add /nginx path to the link, we will see the ECS service response.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/apji0bxzvaeyx4bb2131.png)