Search code examples
aws-api-gatewayamazon-cloudfrontapi-gateway

Restrict direct API Gateway calls unless it's from CloudFront

We created a CloudFront in front of our APIs. Is it possible to restrict API calls other than coming from CloudFront?

Current setup:

Caller --> API Gateway Endpoint --> Lambda

Caller --> CloudFront Endpoint --> API Gateway Endpoint --> Lambda

We expect to have it like this only:

Caller --> CloudFront Endpoint --> API Gateway Endpoint --> Lambda

Solution

  • Yes, WAF available for API gateway. 1. In CloudFront add a custom origin header 2. use WAF on API gateway and allow if request (CloudFront IP addresses + if header+value present). CloudFront IP addresses. http://d7uri8nf7uskq.cloudfront.net/tools/list-cloudfront-ips