PA firewall traffic to AWS API gateway

[charles07]

Planning to secure AWS infra using a VM firewall Palo Alto. Main AWS components are API Gateway & Lambda.
Traffic from external network (public) comes to API gateway and to lambda. Is it possible to route incoming traffic via PA firewall to API gateway.

[jmeurer]

is that screen shot through the firewall, or direct from a test client?

[charles07]

It's through the firewall.

[jmeurer]

Test it direct to the endpoint from an instance in the same subnet as the trust side of the firewall.  

[charles07]

Hi @jmeurer 

Bastion host is not able to resolve the APIgw private URL. I gave 172.31.0.2 as DNS server for bastion host, still not resolving.

FW trust side IP is 172.16.99.x, VPC endpoint too 172.16.99.x and bastion host 172.16.99.

I read in various other forums "each endpoint also requires a valid API key supplied on a x-api-key HTTP header. If not present or valid, the APIs will return a 403 (Forbidden)"

https://codeburst.io/aws-api-gateway-by-example-3733d7792635

[jmeurer]

DNS server is the generally second IP of the VPC cidr. Ie, if your vpc is 172.16.0.0/16, dns is 172.16.0.2.  Looks like your vpc is 172.16 but you set your dns server to 172.31.  

[charles07]

Thank you @jmeurer 

sorry for the late replies. am bugging around AWS networks & firewall.

I tried from Windows system in the same subnet as of VPC endpoint. 

Tried with API URL and endpoint IP, 

Both showing forbidden error.

Screenshots below.

With IP

With URL

Let me try on API GW settings.

[jmeurer]

Sounds like your endpoint is missing the resource policy to allow the instances to connect.

https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-private-apis.html#apigateway...

[charles07]

Thank you,

I have given full access in the VPC endpoint policy.

{
"Statement": [
{
"Action": "*",
"Effect": "Allow",
"Resource": "*",
"Principal": "*"
}
]
}