MTLS Cloudfront/ApiGateway AWS

Question

Didnt find any material of how to implement Cloudfront + MTLS or Api Gateway + MTLS. Is it possible? If not, is there any alternative to achieve MTLS with CloudFront + ApiGateway?

Answer 1

The mTLS support for API Gateway was released yesterday. Here is a detailed blog post how to set it up:

https://aws.amazon.com/blogs/compute/introducing-mutual-tls-authentication-for-amazon-api-gateway/

Answer 2

In order to use mTLS you can't use CloudFront. This is because CF does the TLS Termination and doesn't support pass-through to APIGW or other downstream services.

If you wish to use mTLS, you should point your R53 domain name directly to API GW, disable the default endpoint, and add WAF to the API instead.