16

Ideally, I'd like to lock down my ALB so that it can only be accessed by API Gateway.

I've looked into whether I can associate API gateway with an Inbound Rule - however, I have found that API Gateway cannot be associated with an IP address, or a security group. I've also looked into an Internal facing ALB, but I've been unable to get these working as VPC link only supports NLB.

Any help will be greatly appreciated - I've been looking in the Gateway Settings but cannot find this option.

What is the best way to approach this so that the ALB is as restricted as possible?

fuzzi
  • 1,967
  • 9
  • 46
  • 90

3 Answers3

9

Use WAF to verify the custom HTTP Header value set at API GW

Inject a custom HTTP header at the Integration Request of a API GW HTTP Integration method. Use the static value as explained in Amazon API Gateway API request and response data mapping reference.

'STATIC_VALUE'. The STATIC_VALUE is a string literal and must be enclosed within a pair of single quotes.

enter image description here

As in the case with AWS documentations, it is confusing if we should use the "integration.request.header." format. If setting up in the AWS console, no need to type "integration.request.header." Just type the header name only. Make sure the header value is single quoted

However, when using a tool like CDK or CFN, then we need to use the "integration.request.header." part.

cdk_api_method: aws_apigateway.Method = cdk_api_resource.add_method(
    http_method="post",
    integration=aws_apigateway.HttpIntegration(
        url=url,
        http_method="post",
        proxy=True,
        options=aws_apigateway.IntegrationOptions(
            request_parameters={
                "integration.request.header.{}".format(HTTP_HEADER_X_VALIDATION_CLIENT_NAME): "'{}'".format(HTTP_HEADER_X_VALIDATION_CLIENT_VALUE)
            }
        )
    )
)

Setup up WAF to verify the HTTP header value and associate the ALB to WAF ACL.

enter image description here

# https://github.com/aws-samples/wafv2-json-yaml-samples/blob/master/JSON/rule-001.json
aws_wafv2.CfnWebACL.RuleProperty(
    name='header-x-validation-client',
    action=aws_wafv2.CfnWebACL.RuleActionProperty(
        allow={}
    ),
    statement=aws_wafv2.CfnWebACL.StatementOneProperty(
        byte_match_statement=aws_wafv2.CfnWebACL.ByteMatchStatementProperty(
            field_to_match=aws_wafv2.CfnWebACL.FieldToMatchProperty(
                single_header={
                  "Name": HTTP_HEADER_X_VALIDATION_CLIENT_NAME
                }
            ),
            positional_constraint="EXACTLY",
            search_string=HTTP_HEADER_X_VALIDATION_CLIENT_VALUE,
            text_transformations=[
                aws_wafv2.CfnWebACL.TextTransformationProperty(
                    priority=0,
                    type="NONE"
                )
            ]
        )
    ),
    visibility_config=aws_wafv2.CfnWebACL.VisibilityConfigProperty(
        sampled_requests_enabled=True,
        cloud_watch_metrics_enabled=True,
        metric_name='waf-rule-header-x-validation-client'
    ),
    priority=0
)
banavalikar
  • 272
  • 1
  • 7
mon
  • 18,789
  • 22
  • 112
  • 205
  • For security, a RegEx match would be better. So the caller will send x-validation-client with a random string that will conform to a RegEx. If there is a match then allow traffic, block otherwise. But this is the best answer that I have found so far. Well done :). – banavalikar Feb 05 '21 at 09:02
4

The API Gateway doesn't have a static IP and ALBs don't offer any authentication other than Cognito User Pools at this moment. Because of that I would say your best option is to use a VPC link with Network Load Balancer as you propose and tunnel the request via the NLB to your ALB.

Alternatively you could have a Lambda inside your VPC invoke the ALB but that would be a lot slower, but cheaper for low volumes because you skip the NLB.

Bram
  • 4,232
  • 20
  • 23
  • Is there a purpose for the NLB approach? As wouldn't the ALB still be open to the public? – fuzzi Jan 23 '19 at 19:12
  • would creating a WAF rule for Cross-Site Scripting help in anyway? (Assuming that the domain of the gateway and ALB were the same top level domain) – fuzzi Jan 23 '19 at 19:28
  • No, if you use a NLB with VPC link to your ALB your ALB can be internal. Creating some rules to prevent XSS does not make your API less public. – Bram Jan 23 '19 at 21:53
1

Depending on the use case, one possibility is secure your backend instead of the ALB using client SSL certificates. Generate and Configure an SSL Certificate for Backend Authentication

Suraj Bhatia
  • 1,233
  • 3
  • 13
  • 29
  • Please consider the fact that the OP needs to restrict access to the ALB, not replace it with an alternative solution. Thanks. – banavalikar Feb 03 '21 at 14:34