APIGateway 私有API的VPC endpoint是否开启DNS有什么区别

最新推荐文章于 2026-07-06 16:20:50 发布

原创最新推荐文章于 2026-07-06 16:20:50 发布 · 1.4k 阅读

7 ·

本内容遵循CC 4.0 BY-SA版权协议

GEO检测

收录于

aws

APIGateway 私有API的VPC endpoint是否开启DNS有什么区别

未启用私有DNS

从vpc内访问APIGateway regional api（非私有API）不受影响，会将APIGateway的解析为公有IP

$ curl https://region-app-id.execute-api.cn-north-1.amazonaws.com.cn/dev
[
  {
    "id": 1,
    "type": "fish",
    "price": 249.99
  },
  {
    "id": 2,
    "type": "fish",
    "price": 124.99
  },
  {
    "id": 3,
    "type": "fish",
    "price": 0.99
  }
]

从vpc内访问私有API
无法使用私有DNS名称调用私有API，私有DNS名称没有解析结果

$ curl https://private-app-id.execute-api.cn-north-1.amazonaws.com.cn/dev
curl: (6) Could not resolve host: hc31cifr6a.execute-api.cn-north-1.amazonaws.com.cn

使用特定于终端节点的公有DNS主机名调用私有API成功

$ curl https://vpce-xxxxx-8xxxxxgm.execute-api.cn-north-1.vpce.amazonaws.com.cn/dev -H'x-apigw-api-id:app-id'
[
  {
    "id": 1,
    "type": "dog",
    "price": 249.99
  },
  {
    "id": 2,
    "type": "cat",
    "price": 124.99
  },
  {
    "id": 3,
    "type": "fish",
    "price": 0.99
  }
]

启用了私有DNS

从vpc内访问Regional api受影响，解析为私有IP

$ curl -v https://app-id.execute-api.cn-north-1.amazonaws.com.cn/dev
* Host app-d.execute-api.cn-north-1.amazonaws.com.cn:443 was resolved.
* IPv6: (none)
* IPv4: 10.0.10.240, 10.0.150.229
*   Trying 10.0.10.240:443...
* Connected to cpvnfwf97a.execute-api.cn-north-1.amazonaws.com.cn (10.0.10.240) port 443
* ALPN: curl offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
*  CAfile: /etc/pki/tls/certs/ca-bundle.crt
*  CApath: none
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES128-GCM-SHA256 / prime256v1 / rsaEncryption
* ALPN: server accepted http/1.1
* Server certificate:
*  subject: CN=*.execute-api.cn-north-1.amazonaws.com.cn
*  start date: Dec 17 00:00:00 2023 GMT
*  expire date: Nov 29 23:59:59 2024 GMT
*  subjectAltName: host "app-id.execute-api.cn-north-1.amazonaws.com.cn" matched cert's "*.execute-api.cn-north-1.amazonaws.com.cn"
*  issuer: C=US; O=Amazon; CN=Amazon RSA 2048 M01
*  SSL certificate verify ok.
*   Certificate level 0: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
*   Certificate level 1: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
*   Certificate level 2: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
* using HTTP/1.x
> GET /dev HTTP/1.1
> Host: app-id.execute-api.cn-north-1.amazonaws.com.cn
> User-Agent: curl/8.5.0
> Accept: */*
>
< HTTP/1.1 403 Forbidden
< Server: Server
< Date: Mon, 10 Jun 2024 02:26:05 GMT
< Content-Type: application/json
< Content-Length: 23
< Connection: keep-alive
< x-amzn-RequestId: 202d0b5f-744a-4b06-b129-9936e066e3be
< x-amzn-ErrorType: ForbiddenException
< x-amz-apigw-id: apigw-id
<
* Connection #0 to host cpvnfwf97a.execute-api.cn-north-1.amazonaws.com.cn left intact
{"message":"Forbidden"}

从vpc内访问Private api
使用私有DNS名称调用私有API成功

$ curl https://app-id.execute-api.cn-north-1.amazonaws.com.cn/dev
[
  {
    "id": 1,
    "type": "dog",
    "price": 249.99
  },
  {
    "id": 2,
    "type": "cat",
    "price": 124.99
  },
  {
    "id": 3,
    "type": "fish",
    "price": 0.99
  }
]

使用特定于终端节点的公有DNS主机名调用私有API成功

	$ curl https://vpce-xxxxx-84szh5gm.execute-api.cn-north-1.vpce.amazonaws.com.cn/dev -H'x-apigw-api-id:app-id'
[
  {
    "id": 1,
    "type": "dog",
    "price": 249.99
  },
  {
    "id": 2,
    "type": "cat",
    "price": 124.99
  },
  {
    "id": 3,
    "type": "fish",
    "price": 0.99
  }
]

标签

#aws