Failing to set up SSH tunnel to private AWS API gateway API

Question

I have a private AWS API Gateway REST API, meaning it's only accessible within my VPC. I have a bastion SSH instance running in the VPC, meaning I can do stuff like this:

ssh -J ec2-user@<bastion> ec2-user@<ip of EC2 instance within my VPC>

From that instance I can then curl my API using the https://<api-id>.execute-api.eu-west-1.amazonaws.com/dev/<my endpoint> URL.

Now, for local testing, I'd like to tunnel this instance to a local port, so I try

ssh -J ec2-user@<bastion> -L 8888:<api-id>.execute-api.eu-west-1.amazonaws.com:443 ec2-user@<ip of EC2 instance within my VPC>

This command returns fine, but when I try to do curl localhost:8888/dev/<my endpoint>, I first get a certificate error, which is natural, but when I try using curl -k localhost:8888/dev/<my endpoint> to ignore the certificate, I simply get a 403 Forbidden response from AWS. There's nothing in my access logs for the REST API at all for these requests.

Is the 403 related to the fact that I'm ignoring the TLS certificate, or something else? Is it possible at all to set up a tunnel like this? Unfortunately it doesn't seem possible to use plain HTTP for the API gateway REST API:s, otherwise I'd have preferred that for this type of thing.

Answer 1

API Gateway requires the host header to match the API endpoint URL. Either add the hostname to your /etc/hosts

<api-id>.execute-api.eu-west-1.amazonaws.com 127.0.0.1

and call it normally curl https://<api-id>.execute-api.eu-west-1.amazonaws.com:8888/dev/<my endpoint>

or use curl's --resolve flag

curl \
  --resolve <api-id>.execute-api.eu-west-1.amazonaws.com:443:localhost:8888 \
  localhost:8888/dev/<my endpoint>

Alternatively, if your bastion is configured to allow it, you can use ssh as a SOCKS5 proxy and proxy your request through the bastion.

In one shell session start the proxy

ssh -D 8888 ec2-user@<bastion>

and then in another shell, use it

export HTTPS_PROXY=socks5://localhost:8888
curl https://<api-id>.execute-api.eu-west-1.amazonaws.com/dev/<my endpoint>