<p>We have our frontend application deployed on cloudfront &amp; backend API's are hosted on kubernetes (EKS).</p>
<p>We have use cases where we are using backend APIs from cloudfont (front-end). We don't want to expose Backend API publicly which is obvious.</p>
<p>So now the question is how should we implement above use case? Can someone please help us?
Thansk in advance</p>

<p>You have multiple options to follow however more depends on you.</p>
<p><strong>Option : 1</strong></p>
<p>Change origin of frontend service instead of <strong>S3</strong> use <strong>EKS</strong> as the origin with <strong>CloudFront</strong>.</p>
<p>This might require extra things to set up and manage so not a good idea.</p>
<p><strong>Option : 2</strong></p>
<p>Set the <strong>WAF</strong> with <strong>Nginx ingress controller</strong> or in <strong>ingress</strong> that will be running inside the <strong>EKS</strong>.</p>
<p>with <strong>WAF</strong> you can specify the <strong>domain (origin)</strong> from a specific domain only request should accepted.</p>
<p>Example : <a href="https://medium.com/cloutive/exposing-applications-at-aws-eks-and-integrating-with-other-aws-services-c9eaff0a3c0c" rel="nofollow noreferrer">https://medium.com/cloutive/exposing-applications-at-aws-eks-and-integrating-with-other-aws-services-c9eaff0a3c0c</a></p>
<p><strong>Option : 3</strong></p>
<p>You can keep your <strong>EKS</strong> behind the <strong>API gateway</strong> and set auth like basic auth, API key etc, and protect the <strong>API</strong> that way running in EKS.</p>
<p><a href="https://waswani.medium.com/expose-services-in-eks-via-aws-api-gateway-8f249db372bd" rel="nofollow noreferrer">https://waswani.medium.com/expose-services-in-eks-via-aws-api-gateway-8f249db372bd</a></p>
<p><a href="https://aws.amazon.com/blogs/containers/integrate-amazon-api-gateway-with-amazon-eks/" rel="nofollow noreferrer">https://aws.amazon.com/blogs/containers/integrate-amazon-api-gateway-with-amazon-eks/</a></p>
