On this page

How to connect a custom domain to AWS API gateway

awscloud

When creating lambda functions with HTTP API gateways, it’s very common to not want to use the default function URL provided out the box by AWS. To achieve this, we are going to go over how to connect your domain in cloudflare to an endpoint exposed via AWS API gateway.

Steps:

  • Generate an origin server certificate on cloudflare
  • Import the cloudflare certificate in AWS certificate manager
  • Create the custom domain name in AWS API gateway
  • Create a record in cloudflare to point the record to the API gateway

Generate a certificate on cloudflare

Navigate to the cloudflare dashboard, select the site of interest, navigate to the SSL/TLS menu and click ‘Overview’. Ensure the SSL/TLS encryption mode is set to full otherwise we will get 521 errors from cloudflare.

Cloudflare SSL/TLS settings with the encryption mode set to Full, showing browser-to-Cloudflare and Cloudflare-to-origin traffic both encrypted

Navigate to origin server, click ‘create certificate’ and enter the domain you want. This must match what you enter in ‘custom domain name’ in AWS API gateway.

Cloudflare Origin Certificate Installation form generating an RSA (2048) key and CSR for the hostname api.lhowsam.com with two years validity

Click create and save the origin certificate and private key somewhere safe. Ideally you should also provide AWS API gateway with the certificate chain. You can find cloudflare’s certificate chain here

Import the cloudflare certificate into AWS certificate manager

AWS Certificate Manager import screen with empty fields for the certificate body, private key and optional certificate chain

Fill out the required info and click Next. Enter any tags you want and click ‘review and import’. Now that we’ve got our certificate imported we can move on to adding the domain to the API gateway.

Create the domain name in AWS API gateway

Go to AWS API gateway and navigate to the custom domain names section and click ‘create’

The AWS API Gateway console sidebar with Custom domain names selected

Fill in the domain name with the domain you entered when creating the certificate in cloudflare and then for the ACM certificate choose the certificate you just imported.

The AWS API Gateway Create domain name form showing the domain name field, TLS 1.2 minimum version, a Regional endpoint type and the ACM certificate selector

At this point select the created domain and go to API mappings and click the Configure API mappings.

Add a new mapping selecting the API Gateway route and relevant stage.

Point the cloudflare DNS to the API gateway

Now that everything is imported in AWS, we can go back to the cloudflare dashboard and enter our new DNS records for the gateway. Navigate to DNS and records. Click ‘Add record’, choose CNAME, ensure cloudflare is proxying the traffic and then enter your values. You can get the gateway domain name by navigating to API gateway > custom domain names > configurations > ‘API Gateway domain name’

Cloudflare DNS record editor adding a proxied CNAME named api that targets the API Gateway domain name

Resources

View https://github.com/luke-h1/lho-lambda for an example on how to automate this infrastructure with Terraform

It’s worth nothing that Cloudflare origin certificates only support one level of sub domains. So you can’t have a domain such as myapi.staging.mysite.com