A company is developing a microservices application that will provide a search catalog for customers. The company must use REST APIs to present the frontend of the application to users. The REST APIs must access the backend services that the company hosts in containers in private VPC subnets.
Which solution will meet these requirements?
To meet the requirements of using REST APIs and accessing backend services hosted in containers within private VPC subnets, the best solution is to design a REST API using Amazon API Gateway. Hosting the application in Amazon Elastic Container Service (Amazon ECS) in a private subnet ensures secure deployment within the VPC. Creating a private VPC link for API Gateway to access Amazon ECS enables a private network connection, facilitating secure communication without traversing the public internet.
REST API with Amazon API Gateway: REST APIs are the appropriate choice for providing the frontend of the microservices application. Amazon API Gateway allows you to design, deploy, and manage REST APIs at scale. Amazon ECS in a Private Subnet: Hosting the application in Amazon ECS in a private subnet ensures that the containers are securely deployed within the VPC and not directly exposed to the public internet. Private VPC Link: To enable the REST API in API Gateway to access the backend services hosted in Amazon ECS, you can create a private VPC link. This establishes a private network connection between the API Gateway and ECS containers, allowing secure communication without traversing the public internet.
Question itself says: "The company must use REST APIs", hence WebSocket APIs are not applicable and such options are eliminated straight away.
AC are wrong as they are not REST API D, you don't make SG for API Gateway to EC2, you have to make a VPC Link. More details at https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-vpc-links.html
To allow the REST APIs to securely access the backend, a private VPC link should be created from API Gateway to the ECS containers. A private VPC link provides private connectivity between API Gateway and the VPC without using public IP addresses or requiring an internet gateway/NAT
Why Not D
A security group acts as a firewall for associated EC2 instances, controlling both inbound and outbound traffic at the instance level.
b is right, bcs vpc link provided security connection
A VPC link is a resource in Amazon API Gateway that allows for connecting API routes to private resources inside a VPC.
I think the connection should be from the application to the ECS in the private VPC, instead of from the API Gateway to the ECS in the private VPC. API Gateway only needs to connect to the application...
https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-private-integration.html
B is the right choice