I have a lambda in Account A region us-west-2. Lambda already lives in a VPC with strict SG and private subnets.
I want to make it possible so another accounts B, C, D can hit it via API Gateway (or any other option). Calls to API GW may (or may not, for simplicity) occur from distinct regions.
Hosts should be able to use a Private Zone resolved URL to call hosts. In defect it would be great if they could just call API GW directly and safely.
Going for VPC and endpoints solution, I’d love to make it so these calls happen through Private Links for security and velocity.
When it comes to peering, all my subnets are 10.0.0.0/16 in both accounts. We don’t need account B, C, etc calling hosts in account A (where API GW on top of lambda lives), the only need is accounts B, C, etc hosts being able to call a single API GW URL in account A.
This is my assumption and design in mind.
+-------------------+ +-------------------+ +-------------------+
| Account B | | Account C | | Account D |
| (Region varies) | | (Region varies) | | (Region varies) |
| | | | | |
| +---------------+ | | +---------------+ | | +---------------+ |
| | EC2/ECS/ | | | | EC2/ECS/ | | | | EC2/ECS/ | |
| | Fargate | | | | Fargate | | | | Fargate | |
| | 10.0.0.0/16 | | | | 10.0.0.0/16 | | | | 10.0.0.0/16 | |
| +-------+-------+ | | +-------+-------+ | | +-------+-------+ |
| | | | | | | | |
| +-----v-----+ | | +-----v-----+ | | +-----v-----+ |
| | PrivateLink| | | | PrivateLink| | | | PrivateLink| |
| | Endpoint | | | | Endpoint | | | | Endpoint | |
| +-----------+ | | +-----------+ | | +-----------+ |
+--------|-----------+ +--------|-----------+ +--------|-----------+
| | |
| | |
| AWS PrivateLink | |
+-----------------------------+-----------------------------+
|
|
+------------v-------------+
| Account A |
| (Region: us-west-2) |
| |
| +----------------------+ |
| | VPC (10.0.0.0/16) | |
| | | |
| | +------------------+ | |
| | | Private Subnet | | |
| | | | | |
| | | +-----------+ | | |
| | | | API | | | |
| | | | Gateway | | | |
| | | +-----+-----+ | | |
| | | | | | |
| | | +---v---+ | | |
| | | |Lambda | | | |
| | | +-------+ | | |
| | | | | |
| | +------------------+ | |
| | | |
| +----------------------+ |
| |
+--------------------------+
Some upfront questions:
- This sounds like VPC Endpoint Service, but it also seems like the option is a Network Load Balancer, not an ALB. NLB won’t accept Lambda as target. Then, what’s the right approach here?
- Despite hosts in different regions, could I just enable API GW IAM/Role authorization letting consumers assume the role?
4
By default, AWS Lambda functions can be invoked via API calls on the Internet. Code running anywhere can invoke a Lambda function by calling the Invoke API using any AWS SDK.
Also, Lambda functions can be invoked via a Lambda function URL, which is similar to API Gateway but talks to the AWS Lambda service directly.
Both of these options can be secured with IAM credentials.
Thus, it would be a lot simpler to have your various services invoking the AWS Lambda function directly by calling endpoints on the Internet. It does not require any networking, private endpoints or hosted zones.
Also, please note that AWS Lambda functions should only be connected to a VPC if the code in the function needs to access resources within that VPC. If it does not need to access resources in the VPC, then do not connect the Lambda function to the VPC.
7