What should a solutions architect do to meet these requirements?
Create an AWS Site-to-Site VPN connection between the VPC and the API Gateway. Use API Gateway to generate a unique API key for each microservice. Configure the API methods to require the key.
Create an interface VPC endpoint for API Gateway, and set an endpoint policy to only allow access to the specific API. Add a resource policy to API Gateway to only allow access from the VPC endpoint. Change the API Gateway endpoint type to private.
Modify the API Gateway to use IAM authentication Update the IAM policy for the IAM role that is assigned to the EC2 instances to allow access to the API Gateway Move the API Gateway into a new VPC. Deploy a transit gateway and connect the VPCs.
Create an accelerator in AWS Global Accelerator, and connect the accelerator to the API Gateway. Update the route table for all VPC subnets with a route to the created Global Accelerator endpoint IP address. Add an API key for each service to use for authentication.
Explanations:
A Site-to-Site VPN connection would allow secure connectivity, but it is not necessary for API Gateway, which can be accessed using private endpoints. Additionally, API keys are not a secure method of restricting access to sensitive data since they can be exposed.
Creating an interface VPC endpoint for API Gateway allows private access to the API without traversing the public internet. An endpoint policy can restrict access to specific APIs, and a resource policy can enforce access from the VPC endpoint only, ensuring data stays within the AWS network.
Moving the API Gateway to a new VPC and using IAM authentication is overly complex and does not address the requirement for private access directly. This option also introduces additional management overhead without providing a straightforward private access solution.
AWS Global Accelerator is used to optimize the path to applications but does not directly provide private connectivity for API Gateway. Moreover, using API keys alone does not secure the API as required. This option does not meet the requirement for preventing public internet access.
I strategize that the answer is:
Create an interface VPC endpoint for API Gateway, and set an endpoint policy to only allow access to the specific API. Add a resource policy to API Gateway to only allow access from the VPC endpoint. Change the API Gateway endpoint type to private.