AWS Compute Blog

This post is written by Vijay Menon, Principal Solutions Architect, and Christian Silva, Senior Solutions Architect.

Today, we announced Amazon API Gateway REST API’s support for private integration with Application Load Balancers (ALBs). You can use this new capability to securely expose your VPC-based applications through your REST APIs without exposing your ALBs to the public internet.

Prior to this launch, if you wanted to connect API Gateway to private ALBs, you would have had to use a Network Load Balancer (NLB) as an intermediary, increasing cost and complexity. Now, you can directly integrate API Gateway with private ALBs without requiring an NLB, reducing operational overhead and optimizing cost.

Previous architecture: Connecting API Gateway to private ALBs

Before this launch, API Gateway REST APIs connect to private ALB resources through an NLB positioned in front of the ALB. Many customers have successfully built and operated production workloads using this architecture, demonstrating its reliability for business-critical applications. The following architecture demonstrates this setup.

Figure 1. Previous architecture: API Gateway to private ALB via intermediary NLB

In response to customer feedback for a simplified architecture and reduced costs, we’ve extended VPC link v2 support to REST APIs. This feature now enables direct private ALB integration for REST APIs, eliminating the need for an intermediary NLB.

New architecture: Connecting API Gateway to private ALBs

With direct private ALB integration, this architecture becomes simpler and more efficient. The integration removes the need for an intermediate NLB, reducing the number of hops between client and your services. This streamlined setup simplifies the architecture for applications, allowing more efficient use of ALB’s layer-7 load-balancing capabilities, authentication, and authorization features. While these ALB features were technically accessible before, the new architecture removes the overhead and complexity of managing an additional NLB. Here’s how the simplified architecture looks now:

Figure 2. Direct integration between API Gateway and private ALB

Benefits of a direct integration between your API Gateway endpoint and your private ALB

• **Architectural simplification and operational excellence: **Now that your API Gateway can directly connect to your private ALB, you no longer need an NLB to act as a bridge between your API Gateway and your private ALB. This eliminates the need to provision, configure, manage, or monitor an intermediate load balancer. The reduction in infrastructure components translates to reduced operational overhead and fewer potential failure points. Traffic flows directly from API Gateway to your ALB within the Amazon Web Services (AWS) network, reducing network hops and latency.
• **Improved scalability: **VPC link v2 supports a one-to-many relationship with load balancers. A single VPC link v2 allows API Gateway to integrate with multiple ALBs or NLBs within your VPC. This architectural advantage is particularly valuable for organizations managing complex applications with multiple microservices, each potentially behind its own ALB, or those running numerous APIs. The ability to consolidate multiple load balancer connections through a single VPC link not only reduces administrative overhead but also provides greater flexibility in scaling your architecture. As your application grows and you add more services or load balancers, you won’t need to provision additional VPC links, making it easier to expand your infrastructure while maintaining operational efficiency.
• **Cost optimization: **You can remove the NLB from your architecture and thereby eliminate both the hourly charges for running the NLB and the associated Network Load Balancer Capacity Units (NLCU) used per hour. For organizations running multiple environments or numerous APIs, these savings can accumulate to thousands of dollars annually. Moreover, your data transfer patterns become more efficient. Traffic flows directly from API Gateway to your ALB within the AWS network, which avoids any unnecessary hops that could incur more data transfer charges. This streamlined path not only reduces costs but also improves performance by minimizing network latency.

Getting started

This tutorial demonstrates the setup using both the AWS Management Console and AWS Command Line Interface (AWS CLI). Before you begin, make sure that you have an internal ALB configured in your VPC. For resources that need naming, use appropriate names for your environment.

Step 1: Create a VPC link v2 The first step in our process is to create a VPC link v2, which will enable API Gateway to route traffic to your internal ALB. Here’s how to set it up:

1. Navigate to the API Gateway console.
2. In the left navigation pane, choose VPC links.
3. Choose Create VPC link.
4. Choose VPC link v2 as the VPC link type.
5. Provide a descriptive name for your VPC link.
6. Choose your VPC and subnets where your ALB resides. For high availability, choose subnets in multiple AWS Availability Zones (AZs) that match your ALB configuration.
7. Assign one or more security groups to your VPC link. These security groups will control the traffic flow between API Gateway and your VPC.
8. Choose Create and wait for the VPC link status to become Available. This process can take a few minutes.

Alternatively, you can create a VPC link v2 using the AWS CLI:

# Create VPC link v2
aws apigatewayv2 create-vpc-link \
--name "test-vpc-link-v2" \
--subnet-ids "<your-subnet1-id>" "<your-subnet2-id>" \
--security-group-ids "<your-security-group-id>" \
--region <your-AWS-region>

# Check VPC link v2 status
aws apigatewayv2 get-vpc-link \
--vpc-link-id "<your-vpc-link-v2-id>" \
--region <your-AWS-region>

Step 2: Create a REST API and configure integration With your VPC link v2 now available, the next step is to create a REST API and configure it to use the VPC Link. This process involves creating the API, setting up resources and methods, and configuring the integration with your internal ALB.

1. In the API Gateway console, choose Create API.

2. Choose REST API.

3. Enter an API name and choose Create API.

4. Create a new resource by choosing Actions, then choose Create resource. This resource will represent the endpoint for your API.

5. Create a method by choosing Actions, then choose Create method. The method defines the type of request your API will accept (GET, POST, etc.).

6. Now, configure the integration. This is where you’ll connect your API to your internal ALB via the VPC link v2:

7. Choose VPC link as the integration type.

8. Choose the HTTP method for your backend integration.

9. Choose your newly created VPC link v2.

10. Specify your ALB as the Integration target.

11. Enter the endpoint URL for your integration. The port specified in the URL is used to route requests to the backend.

12. Set the Integration timeout.

Using the AWS CLI:

# Create REST API
aws apigateway create-rest-api \
--name "test-rest-api" \
--description "REST API integration with internal ALB via VPC link v2" \
--region <your-AWS-region>

# Get REST API’s root resource ID
aws apigateway get-resources \
--rest-api-id "<your-rest-api-id>" \
--region <your-AWS-region>

# Create a new resource
aws apigateway create-resource \
--rest-api-id "<your-rest-api-id>" \
--parent-id "<your-parent-id>" \
--path-part "internal-alb" \
--region <your-AWS-region>

# Create a new method
aws apigateway put-method \
--rest-api-id "<your-rest-api-id>" \
--resource-id "<your-resource-id>" \
--http-method ANY \
--authorization-type NONE \
--region <your-AWS-region>

# Create the integration
aws apigateway put-integration \
--rest-api-id "<your-rest-api-id>" \
--resource-id "<your-resource-id>" \
--http-method ANY \
--type HTTP_PROXY \
--integration-http-method ANY \
--uri "http://test-internal-alb.com/test" \
--connection-type VPC_LINK \
--connection-id "<your-vpc-link-v2-id>" \
--integration-target "<your-ALB-arn>" \
--region <your-AWS-region>

Step 3: Deploy and test With your API configured, it’s time to deploy it and verify that it’s working correctly.

1. Choose Deploy API to create a new deployment of your API.
2. Create a new stage (for example “test”). Stages allow you to manage multiple versions of your API.
3. After deployment, you’ll receive an API endpoint URL. Copy this URL as you’ll need it for testing.

Test your API using your preferred API client or a simple curl command.

Using the AWS CLI:

# Create a new deployment to a test stage
aws apigateway create-deployment \
--rest-api-id "<your-rest-api-id>" \
--stage-name "test" \
--region <your-AWS-region>

Test your API integration using a curl command:

curl https://<rest-api-id>.execute-api.<your-aws-region>.amazonaws.com/internal-alb {"message": "Hello from internal ALB"}

Step 4: Scale your VPC link v2 A single VPC link can now connect to multiple ALBs or NLBs within your VPC, simplifying infrastructure management. This AWS CLI snippet demonstrates API Gateway integrating with multiple internal services, for example orders and payments services, each behind its own ALB, using a single VPC link v2. Note how the same VPC link ID is used across both integrations.

# Orders service integration (ALB-1)
aws apigateway put-integration \
--rest-api-id "<your-rest-api-id>" \
--resource-id "<orders-resource-id>" \
--http-method ANY \
--type HTTP_PROXY \
--integration-http-method ANY \
--uri "<your-orders-alb-endpoint>" \
--connection-type VPC_LINK \
--connection-id "<your-vpc-link-v2-id>" \
--integration-target "<your-orders-alb-arn>" \
--region "<your-aws-region>"

# Payments service integration (ALB-2)
aws apigateway put-integration \
--rest-api-id "<your-rest-api-id>" \
--resource-id "<payments-resource-id>" \
--http-method ANY \
--type HTTP_PROXY \
--integration-http-method ANY \
--uri "<your-payments-alb-endpoint>" \
--connection-type VPC_LINK \
--connection-id "<your-vpc-link-v2-id>" \
--integration-target "<your-payments-alb-arn>" \
--region "<your-aws-region>"

For a detailed, step-by-step guide, please see our official documentation in the API Gateway Developer Guide.

Use cases

Private ALB integration with API Gateway enables architectural patterns that solve enterprise challenges. These are three key scenarios where organizations can use this new capability:

• Microservices on Amazon ECS and Amazon EKS: Exposing microservices running on Amazon ECS or Amazon EKS becomes simpler with this integration. It allows secure, path-based routing to different services without exposing your ALB to the public internet or using complex NLB proxy patterns.
• Hybrid cloud architectures: Seamless and secure connectivity between cloud-native APIs and on-premises resources is achieved via AWS Direct Connect or AWS Site-to-Site VPN. This setup allows flexible routing based on HTTP methods and headers to various internal systems.
• Enterprise modernization: Gradual application modernization is facilitated by enabling phased migration from monolithic architectures to microservices. Organizations can route traffic between legacy and new components while maintaining operational continuity and minimizing risk.

Conclusion

Direct private integration between API Gateway REST APIs and ALBs enhances API architecture on AWS. By simplifying infrastructure and reducing operational overhead, this capability improves performance and efficiency for API-driven applications.

This feature is available today in all AWS Regions where VPC link v2 and ALBs are present. We can’t wait to see what you build with it and how it transforms your API architectures. Get started now by visiting the API Gateway console and creating your first VPC link v2 for direct ALB integration.

For more information, visit the API Gateway product page, review our pricing details, and explore the comprehensive developer documentation to learn about all the powerful features available to help you build world-class APIs on AWS.