Dears,

I’m trying to figure out how to make our apis accessible only from my company network.

So basically I’m creating a private REST API and I attach a VPCE with a security group that allows inbound traffic from my private and public ip address but it still does not work.

The security group looks like working fine because I tested with a database and I managed to allow the traffic only from my private IP address, but apparently the same security group doesn’t work if attached to the api gateway, so I tried to add also my public one but no results.

Can somebody help me understanding what I am missing here? I’m not an expert here so I might have misunderstood the role of the security groups too.