Access API Gateway from Function Compute over a VPC-API Gateway(API Gateway)-阿里云帮助中心

This topic describes how to access API Gateway from Function Compute over a virtual private cloud (VPC) in two scenarios: same-region access and cross-region access.

Overview

You can integrate API Gateway with Function Compute to build a serverless architecture. In some scenarios, you may need to call APIs published on API Gateway from a function. For security, you can access API Gateway over an internal network. This topic describes how to implement internal network access in two scenarios:

Accessing API Gateway from Function Compute over an internal network within the same region.
Accessing API Gateway from Function Compute over an internal network across different regions.

The main configuration principles are the same for both scenarios:

You can use a VPC to enable internal network access.
To enable internal network access to API Gateway, you must authorize a VPC to connect to API Gateway. For more information, see Access API Gateway over a VPC.
Internal network access for Function Compute also requires a VPC. For more information, see Configure network settings.

Scenario 1: Same-region access

Preparations
You can build an architecture as shown in the following figure:
Note
- Create two VPCs, vpc-api-access and vpc-backend-1, in the China (Shanghai) region.
- You have created a dedicated API Gateway instance in the Shanghai Region.
- In vpc-backend-1, create an Elastic Compute Service (ECS) instance to use as the backend service for API Gateway. This ECS instance provides an HTTP service endpoint that is accessible at http://localhost:8080/web/cloudapi. Also, configure a security group for this ECS instance to allow access from API Gateway.
Configure an API with the backend service type set to VPC.
For more information, see Use a resource in a VPC as the backend service of an API. Note the following configuration details:
- Create a VPC authorization. The result is shown in the following figure:
- Create an API whose backend service is in a VPC. For testing purposes, set the authentication method to No Authentication, as shown in the following figures:
- After you save the API, publish it. For this example, publish the API to the Production environment.
Configure internal network access permissions from the VPC to API Gateway.
On the dedicated instance page, click Bind to User VPC next to Client VPC. Select the Vpc Id of vpc-api-access to enable internal network access to API Gateway from this VPC.
Enable an internal domain name for the API group.
On the group details page, enable the internal second-level domain name. After you enable it, API Gateway assigns an internal VPC second-level domain name to the group. You can use this domain name to directly call the APIs in this group.

Important
By default, API groups are accessible over the Internet. You can prevent Internet access by disabling the public second-level domain name. Note that if you disable Internet access, you cannot perform online debugging in the API Gateway console.
Create a function.
In Function Compute, create an application and a function that uses the Python runtime. The function code is shown in the following figure:
The function uses curl to access the API at the VPC second-level domain name. If you run the function now, the access fails.
First, create a vSwitch in vpc-api-access for Function Compute to connect to, as shown in the following figure.
Then, in the Function Compute console, configure the service settings for the application you created in the previous step. For more information, see Configure network settings.
In the VPC configuration, select vpc-api-access as the VPC and select the vSwitch that you created in this step.
In the permission configuration, create a new role. For the system policy template, select AliyunECSNetworkInterfaceManagementAccess. Follow the console wizard to complete the authorization, as shown in the following figure.
Run the function to test it.
After you run the function, you can see that Function Compute can access the API using the VPC second-level domain name.

Scenario 2: Cross-region access

Preparations
You can build an architecture as shown in the following figure:
Note
- In the China (Zhangjiakou) region, create a Function Compute application to send API call requests. Create a VPC (vpc-fc-access) to enable Function Compute to connect to Cloud Enterprise Network (CEN).
- In the China (Shanghai) region, create a dedicated API Gateway instance. Also, create a VPC (vpc-api-access) to enable API Gateway to connect to CEN.
- In the China (Shanghai) region, create another VPC (vpc-backend-1). In this VPC, create an ECS instance to use as the backend service for API Gateway. This ECS instance provides an HTTP service endpoint that is accessible at http://localhost:8080/web/cloudapi. Also, configure a security group for this ECS instance to allow access from API Gateway.
Create a CEN instance.
First, create a Cloud Enterprise Network (CEN) instance to connect the VPC in Shanghai (vpc-api-access) and the VPC in Zhangjiakou (vpc-fc-access). This enables service interconnection. For more information about how to configure CEN, see the CEN documentation. Go to the CEN console to create a CEN instance. Attach vpc-api-access and vpc-fc-access to the CEN instance. The result is shown in the following figure.
Configure bandwidth.
Purchase a bandwidth plan for communication within the CEN instance. This example uses a 2 Mbit/s bandwidth plan. Purchase a plan based on your requirements.
Configure the cross-region bandwidth settings. Specify a bandwidth value for the connected regions. You can also allocate one bandwidth plan to multiple region connections.
Configure cross-VPC routing.
For this step, submit a ticket to the CEN team. Provide the configuration information based on the parameter descriptions in the ResolveAndRouteServiceInCen operation. This connects API Gateway with the VPC in Zhangjiakou.
```
AccessRegionIds.1=cn-zhangjiakou
AccessRegionIds.2=cn-shanghai
CenId=cen-uggzcthgz7cwsl7prr      #The ID of the CEN instance.
Host=100.104.255.128/26                #The egress IP address of the dedicated API Gateway instance in the VPC.
HostRegionId=cn-shanghai
HostVpcId=vpc-uf65amr4k3aepd0u4gnxa     #API Gateway is in the China (Shanghai) region. This is the ID of vpc-api-access.                        
```
You can find the egress IP address for the dedicated API Gateway instance's VPC connection on the instance management page, as shown in the following figure:
After the ticket is resolved and the configuration is complete, view the configured routes in the CEN console. You can see that routing policies have been added to both the Shanghai and Zhangjiakou regions. A custom route has also been added based on the information you provided.
Configure an API with the backend service type set to VPC.
As described in Step 2 of Scenario 1, configure an API with a VPC backend service.
Configure internal network access permissions from the VPC to API Gateway.
Follow the instructions in Step 3 of Scenario 1 to configure private network access permissions for the VPC to access API Gateway.
Enable an internal domain name for the API group.
Follow Step 4 in Scenario 1 to enable the internal same-region endpoint for the API group.
Create a function.
In Function Compute in the China (Zhangjiakou) region, create an application and a function that uses the Python runtime. The function code is shown in the following figure:
Configure VPC access for Function Compute.
Similar to Step 6 in Scenario 1, create a vSwitch in vpc-fc-access. Then, configure the service settings in the Function Compute console.
Execute the function.
After you run the function, you can see that Function Compute can access the API using the VPC second-level domain name.

Limits

Only dedicated API Gateway instances are supported.