Accessing an API Gateway private REST API in another AWS account using an interface VPC endpoint
Tags: aws, apigateway, vpcendpoint, privateapigateway
Published: 2022-09-22 00:40:25


This repository [kyhau/access-private-apigw-in-another-account](https://github.com/kyhau/access-private-apigw-in-another-account/blob/main/README.md) provides a working example for calling a private API Gateway REST API from another AWS account, including CloudFormation templates, API test code and GitHub Actions workflows.

## Concept

To use an interface VPC endpoint to access an API Gateway private REST API that's in another AWS account, do the following:

1. Create an interface endpoint in a VPC in one account (account A).
2. Create an API Gateway private REST API in a second account (account B).
3. Configure a resource policy for the private REST API that allows the interface endpoint to invoke the API.
4. Test the setup by calling the private REST API from account A. There are 4 ways to call the API and are covered in the Lambda function ApiTesterFunction (ApiTester.py).

![Cross Account Private API Gateway](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/x486bqw3ppuy5rvjtn84.png)

For details see [How can I access an API Gateway private REST API in another AWS account using an interface VPC endpoint?](https://aws.amazon.com/premiumsupport/knowledge-center/api-gateway-private-cross-account-vpce/)


## Deployment Example

1. The workflow [deploy-apigw-vpce.yaml](https://github.com/kyhau/access-private-apigw-in-another-account/blob/main/.github/workflows/deploy-apigw-vpce.yaml) deploys the interface VPC endpoint for API Gateway execute-api associated to VPC subnet(s) in Account-A.
2. The workflow [deploy-apigw.yaml](https://github.com/kyhau/access-private-apigw-in-another-account/blob/main/.github/workflows/deploy-apigw.yaml) deploys a simple API Gateway private REST API to Account-B. The stack deploys deploy a resource policy for the private REST API that allows the interface endpoint to invoke the API.
3. The workflow [deploy-lambda-api-tester.yaml](https://github.com/kyhau/access-private-apigw-in-another-account/blob/main/.github/workflows/deploy-lambda-api-tester.yaml) deploys a Lambda function to VPC subnet(s) in Account-A, for testing the


## Testing the API endpoints with the Lambda function ApiTesterFunction

The Lambda function ApiTesterFunction ([ApiTester.py](https://github.com/kyhau/access-private-apigw-in-another-account/blob/main/function/ApiTester.py)) tests the 4 endpoints/approaches accessing the API in another AWS account:

1. Default APIGW endpoint; work only if private DNS enabled for your interface endpoint
    ```
    https://dummyapiid.execute-api.ap-southeast-2.amazonaws.com/v0/mock
    ```
2. API Gateway Route 53 Alias for VPC endpoint associated
    ```
    https://dummyapiid-vpce-12345678901234567.execute-api.ap-southeast-2.amazonaws.com/v0/mock
    ```
3. Public DNS name with a Host header
    ```
    https://vpce-12345678901234567-abcd1234.execute-api.ap-southeast-2.vpce.amazonaws.com/v0/mock with headers Host=dummyapiid.execute-api.ap-southeast-2.amazonaws.com
    ```
4. Public DNS name with the x-apigw-api-id header
    ```
    https://vpce-12345678901234567-abcd1234.execute-api.ap-southeast-2.vpce.amazonaws.com/v0/mock with headers x-apigw-api-id=dummyapiid
    ```

Example of the Lambda function (ApiTesterFunction) execution log

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/vkhnc2hzzk337e3nohfo.png)