How to workaround custom domain for private API gateway?

Question

I know that custom domain names are not supported for private APIs.

Also, similar question was answered here.

Unlike the problem of ugly url as in question above, my problem is with format of private dns, which is as follows:

https://{restapi-id}.execute-api.{region}.amazonaws.com/{stage}

The problem is that hostname is dynamic - RestapiId can change whenever CloudFormation stack is recreated. This recreation is done when CF stack is in rollback_complete state and can not be updated. Then I need to delete stack, create it again and all clients using my API need to update RestapiId part of hostname, which would not be acceptable. Also the answer mentioned above (using proxy server) is not acceptable. Maybe a solution could be a possibility to set id for ApiGateway resource manually in CF template, but as I know it is not possible.

Any ideas how to solve this? Thanks in advance.

Answer 1

The solution linked by tmn4jq (and the similar one by add9 in a comment) worked for me in our environment.

As I understand it, an internal ALB or NLB with an SSL certificate for your domain name attached is able to act like a proxy, which associates the certificate and matching domain name to the incoming request.

You use API Gateway's "Custom Domain Name" tool make the connection between that domain name, certificate, and the API Gateway. Then your API Gateway will accept traffic passing from the ALB with the expected domain name.

This is an updated link for the article formerly at cloudbanshee that I followed: https://www.sentiatechblog.com/connecting-to-a-private-api-gateway-over-vpn-or-vpc-peering