SAP-C02 · Question #631
A company is using Amazon API Gateway to deploy a private REST API that will provide access to sensitive data. The API must be accessible only from an application that is deployed in a VPC. The…
The correct answer is B. Create an interface VPC endpoint for API Gateway. Attach an endpoint policy that allows the. To allow an EC2 instance in a VPC to securely access a private Amazon API Gateway REST API, an interface VPC endpoint for API Gateway must be created in the VPC with an endpoint policy permitting the EC2 instance to invoke the API.
Question
A company is using Amazon API Gateway to deploy a private REST API that will provide access to sensitive data. The API must be accessible only from an application that is deployed in a VPC. The company deploys the API successfully. However, the API is not accessible from an Amazon EC2 instance that is deployed in the VPC. Which solution will provide connectivity between the EC2 instance and the API?
Options
- ACreate an interface VPC endpoint for API Gateway. Attach an endpoint policy that allows
- BCreate an interface VPC endpoint for API Gateway. Attach an endpoint policy that allows the
- CCreate a Network Load Balancer (NLB) and a VPC link. Configure private integration between
- DCreate an Application Load Balancer (ALB) and a VPC Link. Configure private integration
How the community answered
(27 responses)- A15% (4)
- B74% (20)
- C4% (1)
- D7% (2)
Why each option
To allow an EC2 instance in a VPC to securely access a private Amazon API Gateway REST API, an interface VPC endpoint for API Gateway must be created in the VPC with an endpoint policy permitting the EC2 instance to invoke the API.
While creating an interface VPC endpoint is correct, an endpoint policy that simply "allows" is too vague; the policy must specifically grant invoke permissions to the relevant principal (e.g., an EC2 instance's IAM role).
To enable an Amazon EC2 instance within a VPC to access a private Amazon API Gateway REST API, an interface VPC endpoint for API Gateway must be created in that VPC. An associated endpoint policy then needs to be attached to this VPC endpoint to explicitly grant permission for the EC2 instance (or its IAM role) to invoke the API, ensuring secure and private connectivity within the AWS network.
A VPC Link with a Network Load Balancer (NLB) is used for API Gateway to integrate privately with backend resources *inside* a VPC (e.g., EC2 instances), not for clients within a VPC to access a private API Gateway itself.
Similar to option C, a VPC Link with an Application Load Balancer (ALB) is for API Gateway to integrate with private backend services in a VPC, not for clients within the VPC to reach the private API Gateway.
Concept tested: API Gateway private endpoints and access policies
Source: https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-private-api-endpoints.html
Community Discussion
No community discussion yet for this question.