Accessing private Amazon API Gateway endpoints through custom Amazon CloudFront distribution using VPC Origins

This article details a solution for accessing private Amazon API Gateway endpoints through a custom Amazon CloudFront distribution using VPC Origins, providing enhanced security and controlled access to private APIs.

• Enables secure access to private API Gateway endpoints via CloudFront
• Keeps API traffic entirely within the AWS private network
• Adds security layers like AWS WAF, geoblocking, and custom SSL certificates
• Uses AWS SAM template to create a secure, private networking architecture
• Implements custom Lambda resources to manage network interfaces and security configurations

Key components include a CloudFront distribution with VPC Origins, an internal Application Load Balancer, and a VPC endpoint for execute-api, creating a robust method to protect backend services while maintaining high availability.