0

We have a microservice architecture and trying to deploy on AWS while leveraging its API Gateway.

Our API Gateway is using a public TSL certificate for client requests, but we wonder how we should be encrypting the communication from the API Gateway to the Load Balancer and then to the services. The API Gateway can also issue "Client Certificates" but it's not clear how we should utilize that.

We are hoping not to have a private CA on AWS as it is quite costly and we don't have any burning use for it.

Amir
  • 2,259
  • 1
  • 19
  • 29

1 Answers1

0

I think the traffic between API Gateway and internal AWS services is always going through HTTPS. This is based on the comments from BobK@AWS:

HTTPS is used for traffic between CloudFront and API Gateway. Communication from API Gateway to other services, such as Lambda, is also over HTTPS.

The only time API Gateway would not use SSL is if you configured an HTTP integration and chose not to enable HTTPS on that integration.

Marcin
  • 215,873
  • 14
  • 235
  • 294