Amazon API Gateway now helps dual-stack (IPv4 and IPv6) endpoints

At present, we’re launching IPv6 assist for Amazon API Gateway throughout all endpoint varieties, customized domains, and administration APIs, in all industrial and AWS GovCloud (US) Areas. Now you can configure REST, HTTP, and WebSocket APIs, and customized domains, to just accept calls from IPv6 shoppers alongside the present IPv4 assist. You can too name API Gateway administration APIs from dual-stack (IPv6 and IPv4) shoppers. As organizations globally confront rising IPv4 deal with shortage and growing prices, implementing IPv6 turns into crucial for future-proofing community infrastructure. This dual-stack strategy helps organizations preserve future community compatibility and increase world attain. To study extra about dualstack within the Amazon Internet Providers (AWS) atmosphere, see the IPv6 on AWS Documentation.

Creating new dual-stack sources

This publish focuses on two methods to create an API or a website title with a dualstack IP deal with kind: AWS Administration Console and AWS Cloud Growth Equipment (CDK).

AWS Console

When creating a brand new API or area title within the console, choose IPv4 solely or dualstack (IPv4 and IPv6) for the IP deal with kind.

As proven within the following picture, you may choose the dualstack choice when creating a brand new REST API.
For customized domains, you may equally configure dualstack as proven within the subsequent picture.

If you might want to revert to IPv4-only for any purpose, you may modify the IP deal with kind setting, without having to redeploy your API for the replace to take impact.

REST APIs of all endpoint varieties (EDGE, REGIONAL and PRIVATE) assist dualstack. Personal REST APIs solely assist dualstack configuration.

AWS CDK

With AWS CDK, begin by configuring a dual-stack REST API and area title.

const api = new apigateway.RestApi(this, "Api", {
  restApiName: "MyDualStackAPI",
  endpointConfiguration: {ipAddressType: "dualstack"}
});

const domain_name = new apigateway.DomainName(this, "DomainName", {
  regionalCertificateArn: 'arn:aws:acm:us-east-1:111122223333:certificates/a1b2c3d4-5678-90ab',
  domainName: 'dualstack.instance.com',
  endpointConfiguration: {
    varieties: ['Regional'],
    ipAddressType: 'dualstack'
  },
  securityPolicy: 'TLS_1_2'
});

const basepathmapping = new apigateway.BasePathMapping(this, "BasePathMapping", {
  domainName: domain_name,
  restApi: api
});

IPv6 Supply IP and authorization

When your API begins receiving IPv6 visitors, shopper supply IPs will likely be in IPv6 format. For those who use useful resource insurance policies, Lambda authorizers, or AWS Identification and Entry Administration (IAM) insurance policies that reference supply IP addresses, make certain they’re up to date to accommodate IPv6 deal with codecs.

For instance, to allow visitors from a particular IPv6 vary in a useful resource coverage.

{
  "Model": "2012-10-17",
  "Assertion": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "execute-api:Invoke",
      "Resource": "execute-api:stage-name/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": [
            "192.0.2.0/24",
            "2001:db8:1234::/48"
          ]
        }
      }
    }
  ]
}

Abstract

API Gateway dual-stack assist helps handle IPv4 deal with shortage and prices, adjust to authorities and trade mandates, and put together for the way forward for networking. The dualstack implementation supplies a clean transition path by supporting each IPv4 and IPv6 shoppers concurrently.

To get began with API Gateway dual-stack assist, go to the Amazon API Gateway documentation. You possibly can configure dualstack for brand spanking new APIs or replace present APIs with minimal configuration adjustments.

–Betty

Particular due to Ellie Frank (elliesf), Anjali Gola (anjaligl), and Pranika Kakkar (pranika) for offering sources, answering questions, and providing useful suggestions throughout the writing course of. This weblog publish was made doable by means of the collaborative assist of the service and product administration groups.

How is the Information Weblog doing? Take this 1 minute survey!

(This survey is hosted by an exterior firm. AWS handles your data as described within the AWS Privateness Discover. AWS will personal the information gathered by way of this survey and won’t share the data collected with survey respondents.)