How to restrict Google Cloud API to AWS Lambda Endpoint?

Question

We're setting up an API Key for using Google Maps API from an endpoint at AWS Lambda function. And we are thinking about restrict it for the services used from AWS backend.

By IP or HTTP? Since AWS uses load balancers and stuff, we're considering a proxy or something like that. Any ideas? Thanks! :D

Answer 1

I'm not sure what you mean when you ask "by IP or HTTP?" The Google Maps API supports IP whitelisting so that you can limit the IP addresses that can use your API key to send requests.

The problem that you'll run into when trying to whitelist the IP address associated with your Lambda function is that you can't predict the IP. It'll be somewhere in the IP space of AWS Lambda.

One option to consider is to setup a VPC with a NAT gateway, assign an Elastic IP to the NAT gateway, and route traffic from private subnets through the NAT device. Then you can configure the Lambda function to run inside a private subnet of the VPC. All outbound traffic from the Lambda function to the internet (and Google Maps) will route via the NAT gatewayand hence come from a static IP (the Elastic IP you assigned to the NAT). Configure that in your Google Maps IP whitelisting.

Answer 2

you can register your API gateway URL to the google console.

the url is something like this: https://.execute-api.ap-southeast-1.amazonaws.com/

that way you can restrict usage of your google cloud API key, only for your web