Examkin

Question

Difficulty: MediumModernizing Workloads with Serverless Architectures (Lambda and API Gateway)

A financial technology company is modernizing its legacy ledger auditing API by migrating it to a serverless architecture on AWS. The new API must be hosted privately and accessed securely by internal microservices running in different VPCs across multiple AWS accounts within the same AWS Organization. The architecture must ensure that API traffic does not traverse the public internet and must minimize both network latency and administrative overhead by avoiding the management of inter-VPC transit routing or peering connections. The company also requires identity-based access control at the API Gateway layer. Which architecture meets these requirements with the least administrative complexity?

  1. A
    Deploy the API as an Amazon API Gateway private API. Configure a Route 53 Private Hosted Zone (PHZ) in the provider account for the API Gateway default endpoint and associate it only with the provider VPC. Establish VPC Peering between the provider VPC and the consumer VPCs, and update all route tables. Encrypt the payload using a shared AWS KMS customer managed key to enforce access control.
  2. Deploy the API as an Amazon API Gateway private API. Configure the API to use AWS_IAM authorization. Instruct the consumer accounts to create Interface VPC Endpoints for the API Gateway service (com.amazonaws.region.execute-api) in their respective VPCs. Attach an API Gateway resource policy to the private API that allows execute-api:Invoke permissions to the organization's accounts, conditional on the request originating from the consumer VPC Endpoints.Answer
  3. C
    Deploy the API as an Amazon API Gateway regional API. Set up an AWS Transit Gateway and connect all consumer VPCs to a central transit VPC in the provider account. Deploy an Application Load Balancer (ALB) inside the transit VPC to route traffic to the regional API Gateway endpoint. Restrict access at the API Gateway layer using a Service Control Policy (SCP) attached to the Organization root.
  4. D
    Deploy the API as an Amazon API Gateway private API. Use AWS Resource Access Manager (RAM) to share the private API Gateway resource with the consumer AWS accounts. Create an Interface VPC Endpoint for the shared API Gateway in a central shared VPC. Share the VPC endpoint with the consumer accounts, and use AWS-managed KMS keys for request signing and decryption.

Answer

The correct architecture is to deploy the API as an Amazon API Gateway private API using AWS_IAM authorization, create Interface VPC Endpoints in the consumer accounts, and attach an API Gateway resource policy that allows access from those VPC Endpoints.
The correct solution involves deploying a private API Gateway and utilizing Interface VPC Endpoints in the consumer accounts. API Gateway private APIs use AWS PrivateLink to allow secure, private access from VPCs. By creating Interface VPC Endpoints for the execute-api service in each consumer VPC, the microservices can access the provider's private API Gateway directly over the AWS network without needing VPC Peering or Transit Gateway routing. Configuring AWS_IAM authorization and applying an API Gateway resource policy that allows invoke permissions from the consumer VPC Endpoints secures the API at the Gateway layer with minimal administrative overhead.

Step-by-Step Solution

1
Deploy the API as an API Gateway private API.
This keeps the API completely private and restricts access to traffic originating from VPC endpoints over the AWS PrivateLink network, preventing public internet exposure.
To satisfy the requirement that traffic must not traverse the public internet and remain entirely private.
2
Configure AWS_IAM authorization on the private API.
This ensures that only requests signed with valid AWS credentials (using SigV4) are authenticated, fulfilling the identity-based access control requirement.
To enforce identity-based access control at the API Gateway layer.
3
Instruct consumer accounts to create Interface VPC Endpoints (com.amazonaws.region.execute-api) in their VPCs.
This allows the microservices to route API requests privately through AWS PrivateLink without establishing VPC Peering or Transit Gateway connections.
To minimize both network latency and administrative overhead by avoiding inter-VPC transit routing or peering.
4
Attach a resource policy to the private API that allows the execute-api:Invoke action for the consumer VPC Endpoints.
This grants access to the cross-account requests at the API Gateway boundary.
To authorize the consumer VPC endpoints and accounts to call the private API Gateway.

Key Concept

Cross-account private API access using API Gateway private APIs, Interface VPC Endpoints, and API Gateway resource policies.
Rate this question

Topics

Modernizing Workloads with Serverless Architectures (Lambda and API Gateway)

More questions from this topic