Support VPC - Link

[pharindoko]

For feature proposals:
This feature makes it possible to restrict access to api-gateway and make the solution only internally available.

https://aws.amazon.com/about-aws/whats-new/2017/11/amazon-api-gateway-supports-endpoint-integrations-with-private-vpcs/?nc1=h_ls

Advantage: Security Enhancement

-> no public access
-> internal microservices not accessible
-> internal enterprise solutions possible - no webapplication firewall needed -> lower costs and less senseless work

[horike37]

This is a duplication of #5052, closing.

[jamesleech]

A vpc-link is not the same thing as a Private API Gateway.

A Private API gateway is in a VPC and is not publicly accessible, it is only accessible from within its VPC.
Private endpoints

"This allows me to run an API gateway that only I can hit."

vs

A Public API Gateway using a VPC-link to access resources within a private VPC. Amazon API Gateway Supports Endpoint Integrations with Private VPCs

"This allows me to run an EC2 instances within a VPC that only my public API Gateway can hit"

[jamesleech]

correct me if I'm wrong but #5080 implements a Private API Gateway only. not a public API Gateway that access private resources within a VPC via a VPC-Link?

[markl-vesper]

@jamesleech I tend to agree with you. I would like to be able to define API endpoints that use VPC-Link via serverless

[brendanfmartin]

@horike37, as stated above, this is a different request from #5080. Has there been any update on a feature request for this?

[guice]

A lot of stuff to do for a PR ... It's EOD for me -- I'm lazy. So, in the meantime, here's the solution:

Within this block:

serverless/lib/plugins/aws/package/compile/events/apiGateway/lib/method/integration.js

Line 79 in 381aa72

} else if (type === 'HTTP' || type === 'HTTP_PROXY') {

Add this if block:

     if (http.connectionType && http.connectionType == 'vpc-link') {
          _.assign(integration, {
            ConnectionType: 'VPC_LINK',
            ConnectionId: http.connectionId
          });
      }

Your new block should look like:

    } else if (type === 'HTTP' || type === 'HTTP_PROXY') {
      _.assign(integration, {
        Uri: http.request && http.request.uri,
        IntegrationHttpMethod: _.toUpper((http.request && http.request.method) || http.method),
      });

      if (http.connectionType && http.connectionType == 'vpc-link') {
          _.assign(integration, {
            ConnectionType: 'VPC_LINK',
            ConnectionId: http.connectionId
          });
      }

---

You can find the file locally on your computer at:
/usr/local/lib/node_modules/serverless/lib/plugins/aws/package/compile/events/apiGateway/lib/method/integration.js (this is macos with serverless installed globally)

I seriously just edited my local file and got it functional.

Here's the new YAML configuration for it. Within your function events:

      - http:
          path: v1/gpcentre
          method: get
          integration: http-proxy
          connectionType: vpc-link
          connectionId: "{your-vpc-id}"
          cors: true
          request:
            uri: http://www.gpcentre.net/
            method: get

Add the two new keys: connectionType and connectionId.

I noticed Serverless does a conversion of http-proxy to HTTP_PROXY somewhere before it does the comparison. I'm not sure where that is exactly, so I lazily checked for vpc-link directly instead of converting it and using that value: notice how I said "if vpc-link" set the value to "VPC_LINK".

I hope this gets some people unstuck on an almost 1 year old request. It'll probably take a few hours or more to build all the added requirements around making a PRs. 😂

[imsatyam]

@guice Wondering if you can publish it as a plugin. :)
I am trying to create an edge-optimized Api Gateway which can call internal micro services using VPC Link proxy integration.

I wonder if there is a plan to support it as part of framework itself?

[brendanfmartin]

@imsatyam That would be a question for @horike37. I don't believe it would make sense to pull this into a plugin since its a baseline feature of API Gateway.

@guice; amazing work. If I have time this week I might submit a PR. I'll ping you if I can get it together for a review.

My team ended up writing raw Cloud Formation to get this implementation working.

[imsatyam]

@guice , @brendanfmartin - I spent some time today to create the PR. Please review.
Also, please feel free to share your suggestions on any improvement that can be made.

[pratikjain5]

Do we have plan to merge @imsatyam PR? Does it solve the feature of adding support for VPC-Link?

[StevePorter92]

Thank @imsatyam, you're functionality works perfectly in your PR!

We have a use case where we're migrating away from Lambdas to Fargate, but still want to use the serverless framework for managing CloudFormation. We also still want to use the authorization logic inside API gateway.

We're using the same serverless.yaml to spin up a new API gateway, however, it doesn't look like serverless supports doing this without uploading Lambdas.

Do you think there's a use case for using the serverless framework to manage the deployment API gateway's with VPC linked methods without uploading any Lambdas?

Is it worth putting this in a new issue when merged for discussion?