Restrict API Gateway Access to a VPC Using Resource Policies and VPC Endpoints
A developer is building a serverless application using API Gateway and Lambda. The API must be accessible only from a specific VPC. How can the developer achieve this?
⚠ Common exam trap
The trap is assuming API Gateway can be placed inside a VPC or protected by security groups like EC2 — candidates miss that PrivateLink VPC endpoints plus resource policies are the only supported mechanism for VPC-scoped API access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a VPC endpoint for API Gateway and attach a resource policy to the API that allows access only from the VPC endpoint.
To restrict an API Gateway REST API to a specific VPC, the correct pattern is a VPC endpoint (interface endpoint) for API Gateway combined with a resource policy on the API that allows only that endpoint. The resource policy uses aws:sourceVpce to whitelist the endpoint, and clients inside the VPC reach the API via the private DNS name of the endpoint. This is the documented AWS approach for private API access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use security groups to restrict access to the API Gateway.
Why it's wrong here
Security groups are stateful firewall rules applied to network interfaces associated with resources *inside* a VPC, such as EC2 instances or ENIs for Lambda functions. API Gateway, by default, exposes a public endpoint that exists outside of a customer's VPC. Therefore, security groups cannot directly control or restrict access to the public API Gateway service itself, making them ineffective for this purpose.
- ✗
Create the API Gateway inside the VPC.
Why it's wrong here
API Gateway is a fully managed, multi-tenant AWS service that operates at the edge of the AWS network, not within a customer's isolated virtual private cloud. While API Gateway can invoke resources residing within a VPC (like Lambda functions or EC2 instances via VPC links), the API Gateway service plane itself cannot be provisioned or deployed directly inside a user's VPC. Attempting to 'create' it inside a VPC is fundamentally misunderstanding its architectural model.
- ✗
Use CloudFront with an origin access identity to restrict access.
Why it's wrong here
CloudFront's Origin Access Identity (OAI) is specifically designed to restrict direct access to Amazon S3 buckets, ensuring that content can only be retrieved via the CloudFront distribution. While CloudFront can indeed front an API Gateway, an OAI does not provide a mechanism to enforce network-level restrictions based on the source VPC of the client request. It secures the origin from public access, but not to a specific private network.
- ✓
Create a VPC endpoint for API Gateway and attach a resource policy to the API that allows access only from the VPC endpoint.
Why this is correct
Creating an interface VPC endpoint for API Gateway establishes a private connection from your VPC to the API Gateway service, allowing clients within the VPC to access the API without traversing the public internet. Concurrently, an API Gateway resource policy can be configured to explicitly deny all requests that do not originate from this specific VPC endpoint. This combination ensures that the API is exclusively accessible from within the designated VPC, providing robust network-level isolation.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
One of 1,135 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.