To encrypt the traffic between the clients and API Gateway, we can use the HTTPS protocol for any connection made to the service. We will need to install a Server Name Indication (SNI) capable certificate on the API Gateway endpoint but that does give us the capability of offloading the SSL connection at API Gateway. When end-to-end encryption is required, we will need to configure each and every device in the path to have a separate certificate installed and managed.
The following diagram demonstrates an example of an end-to-end encryption using API Gateway that forwards the request to a group of EC2 instances behind an ELB:
The preceding diagram can be explained as follows:
- The user connects to API Gateway through the HTTPS protocol. The API Gateway SSL certificate is used to encrypt the request. The request is decrypted and evaluated by API Gateway.
- API Gateway...
