Backend Service with API Gateway frontend

[andrea-avogadro-archiva]

Hi,
does a Backend Service that is exposed to the public internet via an API Gateway make sense? I'd like to use API GW built-in authentication mechanism. Is there any example? On the API GW side which is the right integration type? Thanks

[KollaAdithya]

Hello @andrea-avogadro-archiva 👋

Here is a workaround from an old GH issue on configuring an API Gateway with a backend service using Addons.

[andrea-avogadro-archiva]

Hi,
following the issue I'm creating a Backend Service. Then, via workload addons: an API GW, a Network LB (that will be connected to the internal ALB) and a VPC link that will connect the API GW to the NLB.

The problem with the addons is that they depends on resources (ALB) that will be created during the service deploy: I have the following error: ValidationError: Template format error: Unresolved resource dependencies [InternalLoadBalancer]

Is there a way to solve this?
Thanks
Andrea

[KollaAdithya]

Hello @andrea-avogadro-archiva !

Can you paste the addon template that you are using for creating API Gateway.

[andrea-avogadro-archiva]

Here it is (please note that some resources are still missing).

These are for the API GW:

  ApiGatewayRestApi:
      Type: AWS::ApiGateway::RestApi
      Properties:
        Name: !Sub '${App}-${Env}-api-gw'
        Description: 'SAP WS API Gateway'
        EndpointConfiguration:
          Types:
            - REGIONAL

  ApiGatewayResource:
    Type: AWS::ApiGateway::Resource
    Properties:
      ParentId: !GetAtt ApiGatewayRestApi.RootResourceId
      PathPart: '{proxy+}'
      RestApiId: !Ref ApiGatewayRestApi

And these are for the NLB:

  NlbSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: NLB SG, allow access from API GW
      VpcId:
        Fn::ImportValue: !Sub '${App}-${Env}-VpcId' # Taken from the outputs of the "env" stack
#  TODO    SecurityGroupIngress:
#        - IpProtocol: tcp
#          FromPort: 80
#          ToPort: 80
#          CidrIp:
#            Fn::GetAtt:
#              - Fn::ImportValue: !Sub '${App}-${Env}-VpcId'
#              - 'CidrBlock'
     #  Amazon EC2 creates a default egress rule that allows egress traffic on all ports and IP protocols to any location

  PrivateNetworkLoadBalancer:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Name: !Sub '${App}-${Env}-private-nlb'
      IpAddressType: ipv4
      Type: network
      Scheme: internal
      Subnets: !Split [",", Fn::ImportValue: !Sub '${App}-${Env}-PrivateSubnets'] # Taken from the outputs of the "env" stack
      SecurityGroups:
        - !Ref NlbSecurityGroup

  AlbTargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    DependsOn: InternalLoadBalancer
    Properties:
      Name: !Sub '${App}-${Env}-alb-tg'
      TargetType: alb
      Protocol: TCP
      Port: 80
      HealthCheckPath: /actuator/health
      VpcId:
        Fn::ImportValue: !Sub '${App}-${Env}-VpcId'
      Targets:
        - Id: !Sub ${InternalAlbArn}

  HTTPListener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      LoadBalancerArn: !Ref PrivateNetworkLoadBalancer
      Port: 80
      Protocol: "TCP"
      DefaultActions:
        - Type: "forward"
          ForwardConfig:
            TargetGroups:
              - TargetGroupArn: !Ref AlbTargetGroup

The problem is on the Target Group that needs a reference to the internal ALB (InternalAlbArn).
I've defined an input parameter (in the addons.parameters.yml file) like this:

Parameters:
  InternalAlbArn: !Ref InternalLoadBalancer # Taken from the resources of the "env" stack

If this addon is created after the main stack everything works fine.

Many thanks
Andrea

[KollaAdithya]

@andrea-avogadro-archiva

can you update the following

1. In your addons.parameters.yml to have

Parameters:
  InternalLoadBalancerFullName: !GetAtt EnvControllerAction.InternalLoadBalancerFullName

2. And in addons template

Constructing the ARN of Internal load balancer from its full name

Parameters:
    App:
        Type: String
    Env:
        Type: String
    Name:
        Type: String
    InternalLoadBalancerFullName:
        Type: String

Resources: 
  AlbTargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      Name: !Sub '${App}-${Env}-alb-tg'
      TargetType: alb
      Protocol: TCP
      Port: 80
      HealthCheckPath: /actuator/health
      VpcId:
        Fn::ImportValue: !Sub '${App}-${Env}-VpcId'
      Targets:
        - Id: !Sub 'arn:aws:elasticloadbalancing:${AWS::Region}:${AWS::AccountId}:loadbalancer/${InternalLoadBalancerFullName}'
                
 # Include all other resources in this addon

[andrea-avogadro-archiva]

Hi, it worked perfectly! :-)
Could you explain why ? The only answer I've found is that the EnvControllerAction resource is created before the addon.
Am I right?
Thanks,
Andrea

[KollaAdithya]

Exactly you are right 👍

EnvControllerAction is a custom lambda resource created by Copilot. It is useful to update the environment stack from the workload CloudFormation stack.

InternalLoadBalancerFullName: !GetAtt EnvControllerAction.InternalLoadBalancerFullName

When you reference a resource attribute using !GetAtt, CloudFormation will ensure that the resource providing that attribute has been created before it can retrieve the value. (more info)

So, by ensuring that the EnvControllerAction resource is created before the addon template where you reference InternalLoadBalancerFullName, you ensure that the value is available when CloudFormation attempts to resolve it during the stack creation process.

[andrea-avogadro-archiva]

Hi, thanks.
Sorry to insist, but I've not (yet) found any documentation about that GetAtt is able to wait for resources while Ref can't.
Is this the trick or is something related to the creation order of the main template and the addons?
Thanks

[KollaAdithya]

Both !GetAtt and !Ref are indeed useful for having implicit dependency of resources with in same stack.

So the Catch here is when you are using InternalAlbArn: !Ref InternalLoadBalancer in the workload addon, InternalLoadBalancer is not a resource created with in the workload stack, so it errors out
Template format error: Unresolved resource dependencies [InternalLoadBalancer]

EnvControllerFunction is a custom lambda resource will take care of updating the environment stack and creation of InternalLoadBalancer and returning the output of InternalLoadBalancerFullName. The return value of a custom resource can be accessed using !GetAtt

Docs:

About return values of custom Cloudformation resource: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudformation-customresource.html#aws-resource-cloudformation-customresource-return-values

!Ref - https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/intrinsic-function-reference-ref.html
!GetAtt - https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/intrinsic-function-reference-getatt.html

[andrea-avogadro-archiva]

Thanks a lot! Andrea