When working with an API Gateway on Amazon Web Services (AWS), you typically don't want services hosted on other AWS subservices to be publicly available on the Internet. Elastic Beanstalk generates a public service by default, which will require additional protection services, such as client certificates or service keys, DoS protection, and more, but if you keep this service private, you can protect it through the unique access of an API Gateway.
Probably the best approach is to use AWS Lambda, which are private by default, but this service will not be as configurable as Elastic Beanstalk to be able to run your own backend configuration, so we will keep the services within a private cloud (a “VPC” in Amazon terminology) and provide access to this service only through the API Gateway.
This guide aims to explain the basics of setting up a private backend/service using an Elastic Beanstalk (EBS) residing within a VPC. EBS methods will be available through API Gateway using a VPC Link.
1. Set up Virtual Private Cloud (VPC) and a Subnet
First you will need to set up a virtual private cloud (VPC). This setup is complex and requires networking knowledge. I share with you the following video which explains in great detail the creation of your own investor leads public and private network, default security group configuration, and the configuration of a router and NAT to provide access to your new VPC.
Please accept cookie consent
The second step is to set up an Elastic Beanstalk (EBS) application. One of the advantages of using EBS over pure EC2 instances is that EBS comes with many preconfigured features, such as auto-scaling and rolling updates.
We'll start by creating an EBS application by creating a new environment. The environment is actually where all the configuration takes place. Check out the Elastic Beanstalk (EBS) documentation for more information on how EBS actually works.
2.1. Setting up the environment
Let's see step by step how to configure a new environment:
Choose the “Web server environment”.
Name your environment and assign a domain name
Choose the platform that suits your needs, Go, Java, Node.js, etc.
Choose which application you want to deploy. You can use the “Sample application” or you can also upload your application “Upload your code”.
Configure the deployment type, in this case you will have to choose the “High availability” option. This will give us the option later to configure a network load balancer, it is very important that it is a network load balancer, since what we want is for the API Gateway to access our APP deployed in EBS via the network.
2.2. Configuring access to the service
Configuring service access will allow you to access the configuration of the permissions and users that will generate the infrastructure, that is, the servers with EC2 and the network load balancer as we mentioned above.