I have an EC2 instance running an application which provides APIs on port 1000 and 2000. The EC2 instance should be allowed all outgoing traffic as well as any incoming traffic to port 1000.
Connections to port 2000 however shall be protected by authorization - for example via a Cognito user pool. I was thinking about if it was possible to achieve this with an API Gateway. Three questions came to my mind:
- Would all traffic to port 1000, which should not be protected in any form with access control and should be open to the entire internet, also have to be routed through the API Gateway resulting in higher cost?
- If it is possible to not route traffic to port 1000 through the API Gateway while doing so for traffic to port 2000, would both endpoints be reachable under the same IP from an outside client?
- By adding an API Gateway, can I still easily allow all outgoing traffic from the EC2 instance?
I am looking for a cost-efficient method for this scenario. I am open to hear about solutions which involve other AWS services instead of API Gateway in case there is a better way to implement this behaviour.