Creating a Gateway

Billing

• If you enable public inbound or outbound access, there may be bandwidth costs. For details, see EIP Billing.
• To create an NLB gateway, you need to purchase a load balancer. For details, see ELB Billing.

Constraints

• Permissions
  • You must be assigned both the APIG Administrator and VPC Administrator roles so that you can create gateways.
  • Alternatively, you must be attached the APIG FullAccess policy.
  • You can also be granted permissions using custom policies. For details, see Using IAM to Grant Access to APIG.
  • You must be assigned the identity policy-based permissions to create NLB gateways. For details, see Identity Policy-based Permissions Management.
• Gateway
  • By default, one account can create up to five gateways in a project. To create more dedicated gateways, submit a service ticket to increase the quota.
  • NLB gateways are restricted. To use them, submit a service ticket.
• Network
  • Subnet planning: If you use 192.x.x.x or 10.x.x.x, APIG uses 172.31.32.0/19 as the internal subnet. If you use 172.x.x.x, APIG uses 192.168.32.0/19 as the internal subnet.
  • Private IP addresses in a subnet: The basic, professional, enterprise, and platinum editions of APIG require 3, 5, 6, and 7 private IP addresses, respectively. A platinum X requires 4 more private IP addresses than the previous edition. For example, platinum 2 requires 11 private addresses, and platinum 4 requires 19 private addresses. Check whether the subnet you choose has sufficient private IP addresses on the VPC console.
  • VPC: After a gateway is created, the VPC cannot be changed.
  • Security group: Only the security groups in LA-Mexico City1 and CN North-Beijing1 regions take effect. To disable some IP addresses, use access control policies.

Preparing the Network Environment

• You are advised to deploy your gateways in the same VPC as your other services to facilitate network configuration and secure network access. Resources (such as ECSs) in the same VPC can use the private IP addresses of the gateways to call APIs.
• Similar to a firewall, a security group controls access to a gateway through a specific port and transmission of communication data from the gateway to a specific destination address. For security purposes, create inbound rules for the security group to allow access only on specific ports.

  The security group bound to a gateway must meet the following requirements:

  • Inbound access: Enable the 1026 (TCP) port of the VPC CIDR block associated with the gateway.
  • Inbound access: To allow the APIs in the gateway to be accessed over public networks or from other security groups, configure inbound rules for the security group to allow access on ports 80 (HTTP), 443 (HTTPS), and 1026.
  • Outbound access: If the backend service of an API is deployed on a public network or in another security group, add outbound rules for the security group to allow access to the backend service address through the API calling port.
  • If the frontend and backend services of an API are bound with the same security group and VPC as the gateway, no inbound or outbound rules are needed to allow access through the preceding ports.

Creating a Gateway

1. Go to the Buy Gateway page.
2. In the navigation pane, choose Gateways.

3. Set the gateway parameters by referring to the following table.

   Table 1 API gateway parameters

   Parameter	Description
   Billing Mode	Billing mode of the gateway, which can be pay-per-use. For details, see Billing Modes.
   Region	A geographic area where the gateway will be deployed. Deploy the gateway in the same region as your other services to allow all services to communicate with each other through subnets within a workload. This reduces public bandwidth costs and network latency.
   AZ	Select the availability zone (AZ) where the gateway resides. Different AZs are physically isolated but can communicate with each other via a private network. To enhance gateway availability, deploy the gateway in multiple AZs. APIG does not support gateway migration across AZs. To create a single-AZ gateway, create two gateways in at least two AZs to improve service reliability. Otherwise, services will be unavailable if one AZ is faulty.
   Gateway Name	Gateway name. Enter 3 to 64 characters, starting with a letter. Only letters, digits, hyphens (-), and underscores (_) are allowed.
   Edition	The basic, professional, enterprise, and platinum editions are available for standard and NLB gateways. The number of concurrent requests allowed varies depending on the gateway edition. For more information, see Specifications. NOTE: Currently, platinum edition 2 and later are available only in CN North-Beijing4, CN East2, ME-Riyadh, and CN-Hong Kong.
   Scheduled Maintenance	Time period when technical support engineers can maintain the gateway. The technical support personnel will contact you before maintenance. Select a time period with low service demands.
   Enterprise Project	Select an enterprise project to which the gateway belongs. This parameter is available only if your account is an enterprise account. For details about resource usage, migration, and user permissions of enterprise projects, see Enterprise Management User Guide. When creating an NLB gateway, ensure that the enterprise project to which the gateway belongs is the same as that of the load balancer.
   Allow Listener Configuration Overwriting	This parameter is available only when NLB gateways are used. If enabled, the listener configurations of ports 80, 443, and custom ports can be overwritten. If disabled, load balancers with port conflicts cannot be added.
   Load Balancer	This parameter is available only when NLB gateways are used. API Gateway uses the load balancer as the traffic ingress. If no load balancer is available, create one first. The load balancer must be a dedicated one and the type must be Network or Network + Application. After adding a load balancer, you can bind, modify, unbind, or remove its IP address or bandwidth on the ELB console. After the modification is complete, return to the API Gateway page and click Refresh in the Operation column. To enable or disable public inbound access, bind or unbind a public IPv4 address, add or remove the IPv6 shared bandwidth, or bind or unbind a global EIP on the ELB console. When you create a gateway, you can associate it with only one load balancer. To associate multiple load balancers, go to the gateway information page after the gateway is created. After an NLB gateway is created, deletion protection will be enabled for the load balancer, and the APIG tag will be added to the load balancer. If deletion protection is enabled, the load balancer cannot be deleted. This prevents accidental deletion and ensures service continuity. The APIG tag added to the load balancer enables easy management.
   IPv6	This parameter is available only when NLB gateways are used. If the backend service is deployed on an external network, it can be accessed through an IPv6 address. IPv6 addresses are restricted. To use them, submit a service ticket.
   Public Inbound Access	This parameter is available only when common gateways are used. Determine whether to allow the APIs created in the gateway to be called by external services using an EIP. If the feature is enabled, an EIP is bound by default. You will need to pay for the EIP usage. And you can set a bandwidth that meets your service requirements. For gateways with Public Inbound Access enabled in regions except LA-Mexico City1 and CN North-Beijing1, EIPs are randomly assigned and existing EIPs cannot be selected. Set a bandwidth that meets your service requirements for public inbound access. For public inbound access, billing by bandwidth is implemented. For details, see the pricing of the EIP service. APIs in the gateway can be called using independent or debugging domain names. There is a limit on the number of times that APIs in an API group can be called per day using the debugging domain name. To overcome the limitation, bind independent domain names to the API group and ensure that the domain names have already been CNAMEd to the EIP of the gateway to which the API group belongs. For example, you have an HTTPS API (path: /apidemo) with public access enabled. The API can be called using "https://{domain}/apidemo", where {domain} indicates an independent domain name bound to the group of the API. The default port is 443.
   Public Outbound Access	This parameter is available only when common gateways are used. Determine whether to allow backend services of the APIs created in the gateway to be deployed on public networks. Set a bandwidth that meets your service requirements for public outbound access. For public outbound access, billing by bandwidth is implemented. For details, see the pricing of the EIP service.
   VPC	Select a VPC and subnet for the dedicated gateway. Select the created VPC and subnet from the drop-down list. Select the shared VPC and subnet from the drop-down list. VPC owners can share the subnets in a VPC with one or multiple accounts through Resource Access Manager (RAM). Through VPC sharing, you can easily configure and manage multiple accounts' resources at low costs. For more information about VPC subnet sharing, see VPC Sharing. Create a VPC and subnet by clicking Create VPC. For details, see Creating a VPC.
   Security Group	Select a security group to control inbound and outbound access. If the backend service of an API is deployed on an external network, configure security group rules to allow access to the backend service address through the API calling port. If public inbound access is enabled, add inbound rules for the security group to allow access on ports 80 (HTTP) and 443 (HTTPS). NOTE: Only the security groups configured in the LA-Mexico City1 and CN North-Beijing1 regions take effect. For other regions, ELB load balancing is enabled by default after gateway purchase. To disable access from specific IP addresses, use access control policies. Load Balancing with ELB: If you enable this option, cross-VPC inbound access is supported with an EIP automatically assigned by the gateway. You cannot specify a custom EIP.
   VPC Endpoint Service	VPC endpoint service name. After you purchase a gateway, a VPC endpoint service is automatically created and the gateway can be accessed using a VPC endpoint. If a name is specified, the VPC endpoint service name displayed on the VPC Endpoints tab will be in the format "{region}.{Specified VPC endpoint service name}.{VPC endpoint service ID}". If no name is specified, the displayed name will be in the format "{region}.apig.{VPC endpoint service ID}".
   Tags	Tags classify your gateways to facilitate search, analysis, and management. If no tag is available, click View predefined tags or enter a tag key and value to create one. Alternatively, set tags on the Tag Management Service (TMS) console by referring to Configuring Gateway Tags. If your organization has configured tag policies for APIG, add tags to gateways based on the policies. If a tag does not comply with the policies, gateway creation may fail. Contact your organization administrator to learn more about tag policies.
   Description	Description about the gateway. Enter 1 to 255 characters.

4. Click Next.
5. Confirm the gateway configurations, read and confirm your acceptance of the service agreement, and click Pay Now. The gateway is created with the status displayed on the screen.
   • Return to the gateway list and check the status of the created gateway. If the status is Running, the gateway has been created.
   • For details about how to view or edit a gateway, see Viewing or Modifying Gateway Information.
   • Before deleting a gateway, ensure that the deletion will not impact your services.

Related Documents

• After the gateway is created, you can create and manage APIs in this gateway. For details, see Process Flow.
• To create a gateway by calling an API, see Creating a Dedicated Gateway (Pay-per-Use).