AWS Serverless Hero. Independent Consultant. Developer Advocate at Lumigo.
If you haven’t been paying close attention you might have missed the API Gateway announcement for resource policies. It later played a key role in supporting API Gateway private endpoints — a way to put your API inside a private VPC.
To configure resource policies with the Serverless framework, you need to upgrade to v1.28.0 or later. If you want to restrict access to the
GET /index.html endpoint to the IP 18.104.22.168, you need the following.
- Effect: Allow
Nice and easy!
There are a couple of things to note:
sls deploywould deploy the API for you as part of the CloudFormation update.
privateAPI, which is not publicly accessible and is required for VPC private endpoints.
After you set up IP whitelisting on the endpoint, you will get an error like this if you attempt to access it from an IP that has not been whitelisted.
"Message": "User: anonymous is not authorized to perform: execute-api:Invoke on resource: arn:aws:execute-api:eu-central-1:********3770:io75qg1rvf/test/GET/index.html"
Like what you’re reading but want more help? I’m happy to offer my services as an independent consultant and help you with your serverless project — architecture reviews, code reviews, building proof-of-concepts, or offer advice on leading practices and tools.
I’m based in London, UK and currently the only UK-based AWS Serverless Hero. I have nearly 10 years of experience with running production workloads in AWS at scale. I operate predominantly in the UK but I’m open to travelling for engagements that are longer than a week. To see how we might be able to work together, tell me more about the problems you are trying to solve here.
I can also run an in-house workshops to help you get production-ready with your serverless architecture. You can find out more about the two-day workshop here, which takes you from the basics of AWS Lambda all the way through to common operational patterns for log aggregation, distribution tracing and security best practices.
If you prefer to study at your own pace, then you can also find all the same content of the workshop as a video course I have produced for Manning. We will cover topics including:
You can also get 40% off the face price with the code ytcui. Hurry though, this discount is only available while we’re in Manning’s Early Access Program (MEAP).
Create your free account to unlock your custom reading experience.