How to Secure AWS API Gateway Calls to Private On-Prem APIs

Modern applications are increasingly hybrid.

Many developers host:

• frontend applications in AWS,
• but keep APIs or AI workloads inside home labs, office servers, or private data centers.

The challenge is:

How do you securely expose a private API to AWS API Gateway without opening firewall ports?

A clean solution is to combine:

• AWS API Gateway
• Cloudflare Tunnel
• Nginx reverse proxy
• Zero-trust security principles

Let’s walk through a practical setup.

Target Architecture

Client App
    │
    ▼
AWS API Gateway
    │
    ▼
Cloudflare Tunnel
    │
    ▼
Nginx Reverse Proxy
    │
    ▼
Private API (Node.js / Flask / Spring Boot)

Key idea:

• your server creates an outbound-only tunnel to Cloudflare,
• AWS API Gateway calls the Cloudflare URL,
• traffic securely reaches your private API.

No inbound ports required.

Step 1 — Create a Simple Local API

Example Node.js Express API:

const express = require("express");
const app = express();
app.get("/api/hello", (req, res) => {
    res.json({
        message: "Hello from private on-prem API"
    });
});
app.listen(8080, () => {
    console.log("API running on port 8080");
});

node app.js

Your API is now available locally:

http://localhost:8080/api/hello

Step 2 — Configure Nginx Reverse Proxy

Install Nginx:

sudo apt install nginx

Example Nginx configuration:

server {
    listen 80;

    server_name localhost;

    location / {
        proxy_pass http://localhost:8080;

        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Restart Nginx:

sudo systemctl restart nginx

Now Nginx forwards requests securely to your internal API.

Step 3 — Create Cloudflare Tunnel

Install cloudflared:

brew install cloudflared

or Linux:

wget https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb
sudo dpkg -i cloudflared-linux-amd64.deb

Authenticate:

cloudflared tunnel login

Create tunnel:

cloudflared tunnel create private-api

Create config file:

tunnel: private-api
credentials-file: /home/user/.cloudflared/<tunnel-id>.json

ingress:
  - hostname: api.example.com
    service: http://localhost:80
  - service: http_status:404

Run tunnel:

cloudflared tunnel run private-api

Now your local API is securely reachable through:

https://api.example.com/api/hello

without exposing your home network publicly.

Step 4 — Configure AWS API Gateway

In AWS API Gateway:

1. Create HTTP API
2. Add integration
3. Use:

https://api.example.com

Create route:

/api/{proxy+}

Deploy API.

Now AWS API Gateway becomes your public API layer.

Step 5 — Add Security

Add API Key Validation

Example Express middleware:

app.use((req, res, next) => {
    const apiKey = req.headers["x-api-key"];

    if (apiKey !== process.env.API_KEY) {
        return res.status(401).json({
            error: "Unauthorized"
        });
    }

    next();
});

Add JWT Validation

Example:

const jwt = require("jsonwebtoken");

app.use((req, res, next) => {
    const token = req.headers.authorization;

    try {
        jwt.verify(token, process.env.JWT_SECRET);
        next();
    } catch {
        return res.status(403).json({
            error: "Invalid token"
        });
    }
});

Important Security Considerations

Never expose raw internal services

Always place:

• reverse proxy,
• authentication,
• and rate limiting

in front of backend systems.

Restrict Cloudflare Access

Use:

• Cloudflare Zero Trust,
• IP filtering,
• JWT validation,
• or mTLS

for stronger protection.