Help Center/ Elastic Load Balance/ Best Practices/ Advanced Functions/ Deploying API Gateway APIs on an Internal Website Using a VPC Endpoint and an Application Load Balancer
Updated on 2026-10-20 GMT+08:00
View PDF
Share

Deploying API Gateway APIs on an Internal Website Using a VPC Endpoint and an Application Load Balancer

Overview

To meet the compliance requirements that private APIs are not accessible from the Internet and custom domain names are used, you can use VPC Endpoint (VPCEP), a dedicated application load balancer, API Gateway (Dedicated), and DNS to deploy APIs on an internal website accessible from an on-premises network. This architecture uses a VPC endpoint, an application load balancer, and the DNS service to route internal web traffic to the website backend server group or API Gateway backend server group based on the forwarding policies of the load balancer listener.

This architecture prevents network unreachability caused by deploying VPC endpoints in non-routable subnets and also avoids the side effects that may arise when using custom domain names and proxy servers for domain name routing. For example, transmitting API gateway traffic to an on-premises data center through Direct Connect may interrupt other internal sites.

Solution Architecture

The following architecture diagram shows how a dedicated application load balancer deployed in a VPC forwards web traffic to the website backend server group or API Gateway backend server group based on the listener forwarding policies.

The API gateway is configured for private network access. The backend server group uses the VPC endpoint IP address as the backend server address, and access control policies allow only calls from specific VPC endpoints. The custom domain name of the API gateway is updated to api.domain.com, and the ELB forwarding policy routes traffic based on the Host Header.

  1. DNS resolution and SSL offloading

    A user in an on-premises data center accesses the internal website by sending requests to ui.domain.com and api.domain.com. After the requests reach the Huawei Cloud VPC through Direct Connect or VPN, DNS resolves the domain names to the private IP address of the load balancer. The load balancer terminates SSL connections and uses SNI certificates hosted on SCM to provide HTTPS services for ui.domain.com and api.domain.com.

  2. The ELB listener uses a forwarding policy to forward traffic based on the domain name.
    • If the Host Header is api.domain.com, the request is forwarded to the API Gateway backend server group. ELB establishes a new connection to the API gateway over port 443.
    • If the Host Header is ui.domain.com, the request is forwarded to the website backend server group.

      After the request reaches the API gateway, the custom domain name mapping configured in the API gateway determines the host name and the target API.

Constraints

  • IP as Backend cannot be disabled once enabled. Each backend server can handle a maximum of 100,000 concurrent connections.
  • Each interface VPC endpoint corresponds to a VPC endpoint service. A VPC endpoint service can be accessed by other accounts only after a whitelist is configured.
  • The private domain name of a dedicated API gateway does not need filing. You can add an A record set to point the domain name to the inbound access address of the gateway or add a CNAME record set to point the domain name to the group debugging domain name.

Preparations

  • There is an SNI certificate for both the website and the API (covering both ui.domain.com and api.domain.com)
  • There is a Direct Connect or VPN connection between the on-premises data center and the Huawei Cloud VPC.
  • There is a private zone on the DNS console and the local DNS requests can be forwarded to the Huawei Cloud DNS through the inbound endpoint of DNS Resolver.
  • There is a routable private subnet. Ensure that the on-premises data center can access the private subnet.

Tool Description

Service

Description

API Gateway

API Gateway helps you create, release, maintain, monitor, and protect REST APIs, and supports API calls of any scale. Dedicated API gateways run in your VPCs and support private network access and custom domain names.

Domain Name Service (DNS)

Domain Name Service (DNS) provides high-availability, scalable DNS services. DNS supports private domain name resolution, allowing you to map private domain names to private IP addresses in VPCs for Huawei Cloud resources.

Cloud Certificate & Manager (CCM)

CCM provides SSL Certificate Manager (SCM) and Private Certificate Authority (PCA) modules. SCM works with globally renowned Certificate Authorities (CAs) to provide full lifecycle management of SSL certificates and supports one-click deployment to ELB and Web Application Firewall (WAF).

VPC Endpoint (VPCEP)

VPC Endpoint establishes private channels between VPCs and VPC endpoint services, allowing you to access cloud services or private services without using the Internet. Interface and gateway VPC endpoint services are supported.

Procedure

This solution involves five tasks: creating an SNI certificate, deploying a VPC endpoint in a non-routable private subnet, configuring a load balancer, configuring DNS, and deploying an API gateway.

Step 1: Create an SNI Certificate

Task

Description

Required Personnel

Creating an SNI certificate and importing it to CCM
  1. Create an SNI certificate that covers both ui.domain.com and api.domain.com.

    You can use the Private Certificate Authority (PCA) service of CCM to issue the certificate or purchase the certificate from a third-party CA and import it.

  2. Import the certificate to CCM.

    For details, see Uploading an External Certificate to SCM.

  3. Ensure that the certificate is in the issued status and can be deployed to ELB.

Network administrator

Step 2: Deploy a VPC Endpoint in a Non-Routable Private Subnet

Task

Description

Required Personnel

Creating an interface VPC endpoint for an API gateway
  1. Create an interface VPC endpoint on the VPC Endpoint console and select the VPC endpoint service of API gateway (com.myhuaweicloud.RegionId.apig).
    NOTE:

    In the interface VPC endpoint service of Huawei Cloud VPC Endpoint, com.myhuaweicloud.RegionId.apig is a preconfigured VPC endpoint service of API Gateway. You can directly use it without creating one.

  2. Select a non-routable private subnet as the subnet where the VPC endpoint is located.
  3. Configure a security group to allow inbound traffic over port 443.
  4. Take a note of the private IP address of the VPC endpoint, which will be used to configure the ELB backend server group.

For details, see Buying a VPC Endpoint.

Cloud administrator

Step 3: Create a Load Balancer

Task

Description

Required Personnel

Creating a backend server group for an application

Create a backend server group for website resources and add the ECS in the VPC as the backend server.

For details, see Creating a Backend Server Group.

Cloud administrator

Creating a backend server group for an API Gateway VPC endpoint
  1. Create a backend server group with IP as a Backend enabled. (You need to enable the function on the load balancer summary page first.)
  2. Add the VPC endpoint IP address obtained in Step 2: Deploy a VPC Endpoint in a Non-Routable Private Subnet as a backend server.
  3. Set the health check protocol to HTTPS, port to 443, and expected health check status code to 403. This is because the VPC endpoint of API Gateway returns status code 403 when it is called by the health check without any request header.

For details, see Using IP as a Backend to Route Traffic Across Backend Servers.

Cloud administrator

Creating a dedicated application load balancer
  1. Create a dedicated application load balancer, set its network type to Private IPv4 network (no EIP bound), and deploy the load balancer in a routable private subnet.
  2. Add an HTTPS listener (port 443), select the SNI certificate imported to CCM, enable SNI, and configure the corresponding certificate for ui.domain.com and api.domain.com.

For details, see Creating a Dedicated Load Balancer.

Cloud administrator

Creating forwarding policies for the listener

Create forwarding policies for the HTTPS listener.

  • Forwarding policy 1: Select Domain name for Request Forwarding Rule, set the value to api.domain.com, select Forward to backend server group for Forwarding Action, and select the API Gateway backend server group.
  • Forwarding policy 2: Select Domain name for Request Forwarding Rule, set the value to ui.domain.com, select Forward to backend server group for Forwarding Action, and select the website backend server group.

For details, see Adding a Forwarding Policy.

NOTE:

After advanced forwarding is enabled for a dedicated load balancer, more forwarding rules based on HTTP header, query string, and CIDR block are supported.

Cloud administrator

Step 4: Configure DNS

Task

Description

Required Personnel

Creating a private zone

Create the private zone domain.com in DNS and associate it with the VPC.

For details, see Creating a Private Zone.

Cloud administrator

Creating record sets for the private zone

Add two CNAME record sets for the private zone:

  • Set the name to api.domain.com and the value to the private domain name of the load balancer.
  • Set the name to ui.domain.com and the value to the private domain name of the load balancer.

For details, see Adding Record Sets for a Private Zone.

NOTE:

You can also add an A record set with the value set to the private IP address of the load balancer.

Cloud administrator

Step 5: Create a Private API Endpoint on an API Gateway

Task

Description

Required Personnel

Creating and configuring a dedicated API gateway
  1. Buy a dedicated API gateway and select the same VPC and routable subnet as those of the load balancer.
  2. Do not enable Public Outbound Access (ensure that the API is accessible only over the private network).
  3. Configure a security group to allow inbound traffic over ports 80 and 443.

For details, see Creating a Gateway.

Application developer and cloud administrator

Creating an API and configuring access control
  1. Create an API group and an API in the API gateway.
  2. Configure an access control policy. Set Type to IP address, Effect to Allow, and IP address to the IP address of the VPC endpoint (only calls from the VPC endpoint are allowed).
  3. Bind the access control policy to the API.

For details, see Configuring API Access Control.

Application developer and cloud administrator

Binding a custom domain name
  1. Bind the independent domain name api.domain.com to the API group.
  2. No filing is required because a private domain name is used. Add an A record set to resolve to the VPC access address of the API gateway, or add a CNAME record set to resolve to the debugging domain name of the API group.
  3. Configure an SSL certificate for the domain name (the same as the certificate imported to CCM).
  4. Complete the API mapping configuration to map api.domain.com to the specified API and release environment.

For details, see Configuring the Domain Name for Calling APIs and Binding a Domain Name.

Cloud administrator
Parent Topic: Advanced Functions