
## 🔍 Overview

In Part 1, we deployed a private Employee Directory API using Lambda, API Gateway and Interface Endpoints. Now, we’ll:

- Enable **secure cross-VPC access** using **VPC Peering** and **PrivateLink**
- Add **IAM-based SigV4 authentication** to protect the API

## 🌐 Cross-VPC Access with PrivateLink

If you want consumers in a **different VPC/account** to call your API:

### 1. **Enable Private DNS** (already done)

Ensure `private_dns_enabled = true` on your `aws_vpc_endpoint`.

### 2. **VPC Peering or Transit Gateway**

For same-account cross-VPC:

```go
resource "aws_vpc_peering_connection" "peer" {
  vpc_id        = aws_vpc.main.id
  peer_vpc_id   = aws_vpc.other.id
  auto_accept   = true
}

resource "aws_route" "to_peer" {
  route_table_id         = aws_route_table.main.id
  destination_cidr_block = aws_vpc.other.cidr_block
  vpc_peering_connection_id = aws_vpc_peering_connection.peer.id
}
```

For different-account, use **PrivateLink with NLB** + Endpoint Service (optional advanced setup).

## 🔐 Add IAM-Based Authentication

We now want **IAM-authenticated** access to our API.

### 1. Update API Gateway Method

```go
resource "aws_api_gateway_method" "get" {
  rest_api_id   = aws_api_gateway_rest_api.private_api.id
  resource_id   = aws_api_gateway_resource.employee.id
  http_method   = "GET"
  authorization = "AWS_IAM"
}
```

### 2. Create IAM Role for Client

```go
resource "aws_iam_user" "api_client" {
  name = "internal-api-client"
}

resource "aws_iam_policy" "invoke_api" {
  name   = "InvokePrivateAPI"
  policy = jsonencode({
    Version: "2012-10-17",
    Statement: [{
      Effect: "Allow",
      Action: "execute-api:Invoke",
      Resource: "arn:aws:execute-api:${var.region}:${data.aws_caller_identity.current.account_id}:${aws_api_gateway_rest_api.private_api.id}/*"
    }]
  })
}

resource "aws_iam_user_policy_attachment" "attach" {
  user       = aws_iam_user.api_client.name
  policy_arn = aws_iam_policy.invoke_api.arn
}
```

### 3. Test with SigV4

Install AWS CLI or use [awscurl](https://github.com/okigan/awscurl):

```bash
awscurl --service execute-api \
  --region us-east-1 \
  --access_key <AKIA...> \
  --secret_key <SECRET> \
  https://<rest-api-id>.execute-api.us-east-1.amazonaws.com/prod/employee/1002
```

You can now control access by IAM policies and optionally federate via Cognito/SAML if needed.

---

## ✅ Summary

We’ve now:

- Enabled secure cross-VPC access using PrivateLink/VPC peering
- Enforced IAM-based authentication using `AWS_IAM`
- Set up a realistic, secure, internal API stack

Next article: Add observability (CloudWatch Logs + X-Ray), throttling and versioned deployments with stages.

---


Extend your private API Gateway with secure access from other VPCs using PrivateLink and enforce IAM-based authentication.

Private API Gateway - Part 2: Secure Cross-VPC Access with PrivateLink and IAM Authentication


## 🔍 Overview

AWS PrivateLink enables secure, private connectivity between VPCs and services hosted on AWS without exposing traffic to the public internet. It's essential for secure service-to-service communication across accounts or VPCs.

In this post, we'll implement a working PrivateLink setup with Terraform: one VPC exposing a service (via NLB), and another VPC accessing it (via interface endpoint). We'll use two Terraform providers to simulate cross-account setup.

---

## 🛠️ Architecture

```
[ Service Provider VPC ]                  [ Service Consumer VPC ]
[ EC2 (httpd) ] -> [ NLB ] -> [ Endpoint Service ] <- [ VPC Endpoint ] <- [ EC2 ]
```

The service is hosted on a private EC2 behind a Network Load Balancer. An Endpoint Service is created from the NLB. The consumer VPC accesses it through an Interface VPC Endpoint.

---

## 🧱 Prerequisites

- Terraform ≥ 1.0
- Two AWS profiles or roles simulating service provider and consumer
- Basic networking knowledge (subnets, NLB, SGs)

---

## 🧩 Step 1: Service Provider VPC with NLB and Endpoint Service

```go
provider "aws" {
  alias  = "provider"
  region = "us-east-1"
}

resource "aws_vpc" "provider" {
  provider   = aws.provider
  cidr_block = "10.0.0.0/16"
}

resource "aws_subnet" "provider_subnet" {
  provider          = aws.provider
  vpc_id            = aws_vpc.provider.id
  cidr_block        = "10.0.1.0/24"
  availability_zone = "us-east-1a"
}

resource "aws_security_group" "provider_sg" {
  provider = aws.provider
  vpc_id   = aws_vpc.provider.id

  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/16"]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

resource "aws_instance" "provider_instance" {
  provider        = aws.provider
  ami             = "ami-0c94855ba95c71c99"
  instance_type   = "t2.micro"
  subnet_id       = aws_subnet.provider_subnet.id
  security_groups = [aws_security_group.provider_sg.id]
  user_data       = <<-EOF
                #!/bin/bash
                echo "Hello from PrivateLink Service Provider" > index.html
                nohup python -m SimpleHTTPServer 80 &
                EOF
}

resource "aws_lb" "nlb" {
  provider           = aws.provider
  name               = "privatelink-nlb"
  internal           = true
  load_balancer_type = "network"
  subnets            = [aws_subnet.provider_subnet.id]
}

resource "aws_lb_target_group" "tg" {
  provider    = aws.provider
  name        = "privatelink-tg"
  port        = 80
  protocol    = "TCP"
  vpc_id      = aws_vpc.provider.id
  target_type = "instance"
}

resource "aws_lb_target_group_attachment" "tg_attachment" {
  provider         = aws.provider
  target_group_arn = aws_lb_target_group.tg.arn
  target_id        = aws_instance.provider_instance.id
  port             = 80
}

resource "aws_lb_listener" "listener" {
  provider          = aws.provider
  load_balancer_arn = aws_lb.nlb.arn
  port              = 80
  protocol          = "TCP"

  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.tg.arn
  }
}

resource "aws_vpc_endpoint_service" "service" {
  provider                    = aws.provider
  acceptance_required        = true
  network_load_balancer_arns = [aws_lb.nlb.arn]
}
```

---

## 🧩 Step 2: Service Consumer VPC with VPC Endpoint

```go
provider "aws" {
  alias  = "consumer"
  region = "us-east-1"
}

resource "aws_vpc" "consumer" {
  provider   = aws.consumer
  cidr_block = "10.1.0.0/16"
}

resource "aws_subnet" "consumer_subnet" {
  provider          = aws.consumer
  vpc_id            = aws_vpc.consumer.id
  cidr_block        = "10.1.1.0/24"
  availability_zone = "us-east-1a"
}

resource "aws_security_group" "consumer_sg" {
  provider = aws.consumer
  vpc_id   = aws_vpc.consumer.id

  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["10.1.0.0/16"]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

resource "aws_vpc_endpoint" "consumer_endpoint" {
  provider           = aws.consumer
  vpc_id             = aws_vpc.consumer.id
  service_name       = aws_vpc_endpoint_service.service.service_name
  vpc_endpoint_type  = "Interface"
  subnet_ids         = [aws_subnet.consumer_subnet.id]
  security_group_ids = [aws_security_group.consumer_sg.id]
}
```

---

## 🧪 Testing

- Accept the VPC Endpoint connection from the Provider side.
- SSH into an EC2 in the Consumer VPC and use:

```bash
curl http://<interface-endpoint-dns-name>
```

You should see:

```
Hello from PrivateLink Service Provider
```

---

## 🔐 Security Notes

- Ensure correct SGs between NLB and Endpoint
- Use IAM condition keys or resource policies if needed
- Enable VPC Flow Logs for visibility

---

## 📌 Summary

- We implemented AWS PrivateLink with real infra using Terraform
- Service is exposed internally via NLB and Interface Endpoint
- Setup is secure, scalable, and avoids internet exposure

Next steps? Add DNS, IAM auth, or cross-region routing!

---

A hands-on technical guide to implementing AWS PrivateLink between VPCs using Terraform.

Posts tagged with: privatelink