Only allow AWS API Gateway to access EC2 instance

Question

We have our api running on an AWS EC2 instance. We are interested in AWS API Gateway to authenticate API calls using Cognito and version control.

Can anyone tell me how can I allow access to the API hosted on the EC2 instance without making it public? I only want API Gateway to access that API.

I was not able to find any solution in the documentation.

Answer 1

Previous Answer:

Your server has to be public in order for API Gateway to access it. The best solution at this point is to use Client Side SSL Certificates, so that your server can easily reject any traffic not originating from API Gateway.

http://docs.aws.amazon.com/apigateway/latest/developerguide/getting-started-client-side-ssl-authentication.html

Updated Answer:

You can now place a private Network Load Balancer inside your VPC that is not publicly accessible, and enable VPCLink in API Gateway to allow API Gateway to send requests to the private NLB.