0

I have an EC2 instance running an application which provides APIs on port 1000 and 2000. The EC2 instance should be allowed all outgoing traffic as well as any incoming traffic to port 1000.

Connections to port 2000 however shall be protected by authorization - for example via a Cognito user pool. I was thinking about if it was possible to achieve this with an API Gateway. Three questions came to my mind:

  • Would all traffic to port 1000, which should not be protected in any form with access control and should be open to the entire internet, also have to be routed through the API Gateway resulting in higher cost?
  • If it is possible to not route traffic to port 1000 through the API Gateway while doing so for traffic to port 2000, would both endpoints be reachable under the same IP from an outside client?
  • By adding an API Gateway, can I still easily allow all outgoing traffic from the EC2 instance?

I am looking for a cost-efficient method for this scenario. I am open to hear about solutions which involve other AWS services instead of API Gateway in case there is a better way to implement this behaviour.

1 Answer 1

2

Amazon API Gateway as well as the Application Load Balancer support authentication via Amazon Cognito.

Would all traffic to port 1000, which should not be protected in any form with access control and should be open to the entire internet, also have to be routed through the API Gateway resulting in higher cost?

Yes, you need to do that. You cannot set different endpoints for a DNS entry based on ports. You need something like API Gateway or ALB to route the traffic based on ports.

By adding an API Gateway, can I still easily allow all outgoing traffic from the EC2 instance?

Yes, outbound traffic isn't routed through API Gateway or ALB. Outbound traffic goes over NAT Gateway, NAT instance or IGW depending on your VPC setup.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .