Can I create a private endpoint in API Gateway while using HTTP API V2?

[diogo-landos]

Currently I have a logging validation with tokens and wanted to introduce JWT Authorizers in API Gateway. However, this seems to require HTTP API V2. I was consider to migrate from REST V1 to it, but it seems V2 does not directly support a private endpoint and would require some workaround. Is this true? If so, is there any plan to have this?

[Sagargupta16]

HTTP API (V2) does support private integrations via VPC Links, but it works differently from REST API private endpoints.

REST API (V1): You can create a truly private API using a VPC endpoint (PRIVATE endpoint type). The API itself is only accessible from within your VPC.

HTTP API (V2): There is no PRIVATE endpoint type. Instead, HTTP API uses VPC Links V2 to reach private resources (ALB, NLB, or Cloud Map services) inside your VPC. The API itself remains publicly accessible, but the backend integration is private.

So if your goal is:

• Private backend (API is public, but routes to private ALB/NLB): HTTP API V2 supports this via VPC Links.
• Private API (API itself only accessible from within VPC): This is only supported by REST API (V1). HTTP API V2 does not support VPC endpoint policies or the PRIVATE endpoint type.

In CDK, a VPC Link for HTTP API V2 looks like:

import { HttpApi, VpcLink } from "aws-cdk-lib/aws-apigatewayv2";
import { HttpAlbIntegration } from "aws-cdk-lib/aws-apigatewayv2-integrations";

const vpcLink = new VpcLink(this, "VpcLink", {
  vpc,
  subnets: { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS },
});

const httpApi = new HttpApi(this, "HttpApi");

httpApi.addRoutes({
  path: "/api",
  integration: new HttpAlbIntegration("AlbIntegration", listener, {
    vpcLink,
  }),
});

For JWT authorizers (your original use case), HTTP API V2 is the right choice since REST API doesn't natively support JWT authorizers. You can combine the JWT authorizer with the VPC Link integration above.

References:

• HTTP API private integrations
• VPC Links V2

[DYNOSuprovo]

Yes, it is true: API Gateway HTTP APIs (v2) do not support Private Endpoints (ingress from inside a VPC via AWS PrivateLink).

Here is the breakdown of why this happens, the distinction between private ingress vs. egress, and the recommended architectures to achieve your requirement (Private API + JWT validation).

---

Ingress vs. Egress: The VPC Link Distinction

A common point of confusion is the term VPC Link:

1. Private Ingress (Caller -> API Gateway):
   • REST API (v1): Supports EndpointType.PRIVATE. The API gets an execution hostname that only resolves and is reachable through an execute-api VPC Interface Endpoint (com.amazonaws.<region>.execute-api) inside your VPC, enforced by an API Gateway Resource Policy (aws:sourceVpce).
   • HTTP API (v2): Only supports REGIONAL public endpoints. There is no PRIVATE endpoint type, and HTTP APIs do not support API Gateway Resource Policies.
2. Private Egress (API Gateway -> Backend in VPC):
   • Both REST and HTTP APIs support VPC Links to route requests to backend resources (ALB, NLB, Cloud Map) located in private subnets. However, this is egress from the API to your backend, not private ingress to call the API itself.

---

Recommended Solutions

If your core goal is to have a Private API Gateway within your VPC that validates JWT tokens, you have two main architecture patterns:

Option 1: REST API (v1) with Private Endpoint + Lambda Token/Request Authorizer (Recommended for strict private networking)

REST APIs support native PRIVATE endpoints, but do not have the built-in OIDC/JWT authorizer construct that HTTP API has. You can achieve identical JWT validation behavior by using a Lambda Request Authorizer with @aws-jwt-verify (maintained by AWS) or jose:

import * as cdk from 'aws-cdk-lib';
import * as apigateway from 'aws-cdk-lib/aws-apigateway';
import * as ec2 from 'aws-cdk-lib/aws-ec2';
import * as lambda from 'aws-cdk-lib/aws-lambda';
import * as iam from 'aws-cdk-lib/aws-iam';
import { Construct } from 'constructs';

export class PrivateRestApiWithJwtStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    const vpc = ec2.Vpc.fromLookup(this, 'Vpc', { isDefault: false });

    // 1. Interface VPC Endpoint for execute-api
    const apiVpce = new ec2.InterfaceVpcEndpoint(this, 'ApiGatewayVpce', {
      vpc,
      service: ec2.InterfaceVpcEndpointAwsService.APIGATEWAY,
      subnets: { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS },
    });

    // 2. Lambda Authorizer validating JWT against IdP (Auth0, Cognito, Okta)
    const jwtAuthorizerFn = new lambda.Function(this, 'JwtAuthorizerFunction', {
      runtime: lambda.Runtime.NODEJS_20_X,
      handler: 'index.handler',
      code: lambda.Code.fromInline(`
        const { CognitoJwtVerifier } = require("aws-jwt-verify");
        const verifier = CognitoJwtVerifier.create({
          userPoolId: process.env.USER_POOL_ID,
          tokenUse: "access",
          clientId: process.env.CLIENT_ID,
        });

        exports.handler = async (event) => {
          try {
            const token = event.headers.Authorization?.replace('Bearer ', '');
            const payload = await verifier.verify(token);
            return {
              principalId: payload.sub,
              policyDocument: {
                Version: '2012-10-17',
                Statement: [{
                  Action: 'execute-api:Invoke',
                  Effect: 'Allow',
                  Resource: event.methodArn,
                }],
              },
            };
          } catch (err) {
            throw new Error('Unauthorized');
          }
        };
      `),
      environment: {
        USER_POOL_ID: 'us-east-1_example',
        CLIENT_ID: 'exampleclientid',
      },
    });

    const authorizer = new apigateway.RequestAuthorizer(this, 'JwtAuthorizer', {
      handler: jwtAuthorizerFn,
      identitySources: [apigateway.IdentitySource.header('Authorization')],
      resultsCacheTtl: cdk.Duration.minutes(5),
    });

    // 3. Private REST API restricted to the VPCE
    const api = new apigateway.RestApi(this, 'PrivateRestApi', {
      endpointConfiguration: {
        types: [apigateway.EndpointType.PRIVATE],
        vpcEndpoints: [apiVpce],
      },
      policy: new iam.PolicyDocument({
        statements: [
          new iam.PolicyStatement({
            principals: [new iam.AnyPrincipal()],
            actions: ['execute-api:Invoke'],
            resources: ['execute-api:/*'],
            effect: iam.Effect.DENY,
            conditions: {
              StringNotEquals: {
                'aws:sourceVpce': apiVpce.vpcEndpointId,
              },
            },
          }),
          new iam.PolicyStatement({
            principals: [new iam.AnyPrincipal()],
            actions: ['execute-api:Invoke'],
            resources: ['execute-api:/*'],
            effect: iam.Effect.ALLOW,
          }),
        ],
      }),
    });

    const items = api.root.addResource('items');
    items.addMethod('GET', new apigateway.MockIntegration(), {
      authorizer,
      authorizationType: apigateway.AuthorizationType.CUSTOM,
    });
  }
}

Benefits:

• True PrivateLink network isolation inside your VPC.
• Custom caching TTL for authorizer verification so verification latency overhead is minimal.

---

Option 2: HTTP API (v2) with Built-in JWT Authorizer + Perimeter Restrictions (AWS WAF / mTLS)

If you specifically want the zero-code, low-cost native JWT Authorizer feature of HTTP API v2 (HttpJwtAuthorizer) and lower execution cost, remember that the endpoint itself must remain REGIONAL (public DNS). However, you can restrict access so only your internal workloads or corporate network can invoke it:

1. AWS WAF v2 Association:
   Associate an AWS WAF WebACL with the HTTP API stage and configure an IP set rule allowing only your egress NAT Gateway / corporate public IPs, blocking all other public ingress.
2. Mutual TLS (mTLS):
   Configure a custom domain name on HTTP API with mutual TLS enabled, requiring callers to present a client certificate signed by your private ACM PCA / internal CA.