# AWS Internal Endpoint

**URL:** <https://forum.serverless.com/t/aws-internal-endpoint/10961>\
**Category:** Serverless Framework\
**Tags:** aws, lambda\
**Created:** [April 1, 2020, 12:59pm UTC](https://forum.serverless.com/t/aws-internal-endpoint/10961 "2020-04-01T12:59:17Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tom](https://avatars.discourse-cdn.com/v4/letter/t/3d9bf3/32.png) [@Tom](https://forum.serverless.com/u/Tom)\
**Post date:** [April 1, 2020, 12:59pm UTC](https://forum.serverless.com/t/aws-internal-endpoint/10961/1 "2020-04-01T12:59:17Z")

</div>

I have a worker service running on an EC2 instance which needs to be triggered from my main application built using serverless and running in lambda’s. Initially I was going to use SQS to do this but the data could - in some cases - potentially be larger than the maximum size of an SQS message.

Therefore I’ve decided it could be better to create an endpoint for the worker service to hit when it received an SQS trigger (any better suggestions appreciated).

The simple way to do this would be to use basic auth but I’d rather not do that.  
Is there a way in the serverless framework to make my endpoint only visible to certain AWS resources?

Many Thanks,

---

<div class="post-metadata">

**Author:** ![franklx2](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/franklx2/32/5023_2.png) [@franklx2](https://forum.serverless.com/u/franklx2)\
**Post date:** [March 8, 2021, 3:04pm UTC](https://forum.serverless.com/t/aws-internal-endpoint/10961/2 "2021-03-08T15:04:41Z")

</div>

You can create private API GWs, reference section “Configuring endpoint types”:

> **[Serverless Framework - AWS Lambda Events - API Gateway](https://www.serverless.com/framework/docs/providers/aws/events/apigateway/#configuring-endpoint-types)**
>
> Setting up AWS API Gateway Events with AWS Lambda via the Serverless Framework

You’ll also need to define VPC Endpoint you are using:

```
resources:
  Resources:
    #private apigw vpc endpoint & sg
    VPCEndpoint:
      Type: AWS::EC2::VPCEndpoint
      Properties: 
        PrivateDnsEnabled: False
        SecurityGroupIds: 
          - !GetAtt VpcEndpointSecurityGroup.GroupId
        ServiceName: 'com.amazonaws.us-east-1.execute-api'
        SubnetIds: ${file(./env/local/${opt:stage, self:provider.stage, 'arch'}/vpc.yml):subnetIds}
        VpcEndpointType: Interface
        VpcId: ${file(./env/local/${opt:stage, self:provider.stage, 'arch'}/vpc.yml):vpcId}
    VpcEndpointSecurityGroup:
      Type: 'AWS::EC2::SecurityGroup'
      Properties:
        VpcId: ${file(./env/local/${opt:stage, self:provider.stage, 'arch'}/vpc.yml):vpcId}
        GroupDescription: 'Security group for VPC Endpoint'
        SecurityGroupIngress:
          - IpProtocol: tcp
            FromPort: 443
            ToPort: 443
            CidrIp: ${self:custom.vpcCidr}
    VpcEndpointLambdaSecurityGroup:
      Type: 'AWS::EC2::SecurityGroup'
      Properties:
        VpcId: ${file(./env/local/${opt:stage, self:provider.stage, 'arch'}/vpc.yml):vpcId}
        GroupDescription: 'Security group for VPC Endpoint Lambda'
```