API Gateway private REST API - Support VPC Endpoint

[DrFaust92]

Community Note

• Please vote on this pull request by adding a 👍 reaction to the original pull request comment to help the community and maintainers prioritize this request
• Please do not leave "+1" comments, they generate extra noise for pull request followers and do not help prioritize the request

Closes #10154

Release note for CHANGELOG:

resource/aws_api_gateway_rest_api: Add vpc_endpoint_ids argument

Output from acceptance testing:

$ make testacc TESTARGS='-run=TestAccAWSAPIGatewayRestApi_'

--- PASS: TestAccAWSAPIGatewayRestApi_basic (138.81s)
--- PASS: TestAccAWSAPIGatewayRestApi_EndpointConfiguration (121.38s)
--- PASS: TestAccAWSAPIGatewayRestApi_EndpointConfiguration_Private (151.55s)
--- PASS: TestAccAWSAPIGatewayRestApi_EndpointConfiguration_VPCEndpoint (506.39s)
--- PASS: TestAccAWSAPIGatewayRestApi_api_key_source (431.64s)
--- PASS: TestAccAWSAPIGatewayRestApi_policy (107.07s)
--- PASS: TestAccAWSAPIGatewayRestApi_openapi (75.58s)
...

[DrFaust92]

fixed according to @folbricht comments:

$ make testacc TESTARGS='-run=TestAccAWSAPIGatewayRestApi_'

=== RUN   TestAccAWSAPIGatewayRestApi_basic
=== PAUSE TestAccAWSAPIGatewayRestApi_basic
=== CONT  TestAccAWSAPIGatewayRestApi_basic
--- PASS: TestAccAWSAPIGatewayRestApi_basic (118.65s)
=== RUN   TestAccAWSAPIGatewayRestApi_EndpointConfiguration
=== PAUSE TestAccAWSAPIGatewayRestApi_EndpointConfiguration
=== CONT  TestAccAWSAPIGatewayRestApi_EndpointConfiguration
--- PASS: TestAccAWSAPIGatewayRestApi_EndpointConfiguration (127.70s)
=== RUN   TestAccAWSAPIGatewayRestApi_EndpointConfiguration_Private
=== PAUSE TestAccAWSAPIGatewayRestApi_EndpointConfiguration_Private
=== CONT  TestAccAWSAPIGatewayRestApi_EndpointConfiguration_Private
--- PASS: TestAccAWSAPIGatewayRestApi_EndpointConfiguration_Private (121.22s)
=== RUN   TestAccAWSAPIGatewayRestApi_EndpointConfiguration_VPCEndpoint
=== PAUSE TestAccAWSAPIGatewayRestApi_EndpointConfiguration_VPCEndpoint
=== CONT  TestAccAWSAPIGatewayRestApi_EndpointConfiguration_VPCEndpoint
--- PASS: TestAccAWSAPIGatewayRestApi_EndpointConfiguration_VPCEndpoint (574.07s)
=== RUN   TestAccAWSAPIGatewayRestApi_api_key_source
=== PAUSE TestAccAWSAPIGatewayRestApi_api_key_source
=== CONT  TestAccAWSAPIGatewayRestApi_api_key_source
--- PASS: TestAccAWSAPIGatewayRestApi_api_key_source (335.67s)
=== RUN   TestAccAWSAPIGatewayRestApi_policy
=== PAUSE TestAccAWSAPIGatewayRestApi_policy
=== CONT  TestAccAWSAPIGatewayRestApi_policy
--- PASS: TestAccAWSAPIGatewayRestApi_policy (149.33s)
=== RUN   TestAccAWSAPIGatewayRestApi_openapi
=== PAUSE TestAccAWSAPIGatewayRestApi_openapi
=== CONT  TestAccAWSAPIGatewayRestApi_openapi
--- PASS: TestAccAWSAPIGatewayRestApi_openapi (88.30s)
PASS
ok  	github.com/terraform-providers/terraform-provider-aws/aws	670.232s

[davidmco65]

Any idea when this will be merged? I've literally got this exact problem holding my deployment up right now. Thanks!

[cleverton-heusner]

Hi, guys.

Any news about this merge request? We really need it in our project. Thanks a lot!

[DrFaust92]

@bflad, can you help out with this?

For some reason I can't restore the review request on the PR

[dininski]

Any news on merging this PR? We would also benefit massively from this feature in our project.

Thanks in advance and all the best!

[UsmanMohammad]

Hi,

We are also looking for this feature as well.

Many thanks

[gncj]

Hello,

any update on this request?

[tokiwong]

Hello,

I am also looking for this feature

[skyguy94]

I'm looking for this feature as well.

[cleblanc87]

Any feedback from the core team on this PR?

[gracebrownecodes]

In case it's useful to anyone here, this is my workaround for the moment, a null resource provisioner to run the aws cli command that associates a vpc endpoint with the api gateway. This obviously assumes you have a the referenced resources elsewhere in your config.

# Associate the API Gateway with the VPC endpoint so that we can access it without using a custom header,
#   which is not possible in browser pre-flight CORS requests.
# See: https://forums.aws.amazon.com/thread.jspa?messageID=916693
# And: https://docs.aws.amazon.com/apigateway/latest/developerguide/associate-private-api-with-vpc-endpoint.html
# Terraform PR to add this ability here: https://github.com/terraform-providers/terraform-provider-aws/pull/10627
resource null_resource api_vpc_endpoint {
  provisioner local-exec {
    command = join("", [
      "aws apigateway update-rest-api ",
      "--rest-api-id ${aws_api_gateway_rest_api.default.id} ",
      "--patch-operations \"op='add',path='/endpointConfiguration/vpcEndpointIds',value='${data.aws_vpc_endpoint.api_gateway.id}'\" ",
      "--region ${var.region}",
    ])
  }
}

[DrFaust92]

I'd like to add terraform-providers/aws-provider as a reviewer but am not able to for some reason.
Can anyone from the core team assist? @bflad @aeschright

[bflad]

LGTM, thanks @DrFaust92 🚀

Output from acceptance testing:

--- PASS: TestAccAWSAPIGatewayRestApi_EndpointConfiguration_Private (64.02s)
--- PASS: TestAccAWSAPIGatewayRestApi_EndpointConfiguration (125.87s)
--- PASS: TestAccAWSAPIGatewayRestApi_policy (160.06s)
--- PASS: TestAccAWSAPIGatewayRestApi_EndpointConfiguration_VPCEndpoint (189.90s)
--- PASS: TestAccAWSAPIGatewayRestApi_tags (249.67s)
--- PASS: TestAccAWSAPIGatewayRestApi_basic (271.25s)
--- PASS: TestAccAWSAPIGatewayRestApi_api_key_source (364.21s)
--- PASS: TestAccAWSAPIGatewayRestApi_disappears (401.90s)
--- PASS: TestAccAWSAPIGatewayRestApi_openapi (620.15s)

[ghost]

This has been released in version 2.46.0 of the Terraform AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template for triage. Thanks!

[gracebrownecodes]

Is anyone else experience unreliability with this configuration? I am seeing a successful apply, no errors or failures, but the api gateway is still NOT associated with the VPCE.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!