Entering a VPC with an EventBridge Connection — Making Requests from Step Functions to an ALB inside a VPC Without Lambda
This page has been translated by machine translation. View original
Introduction
This article was inspired by the slides "Can you get inside a VPC with EventBridge Connection?" by Shimokawa of AWSJ, presented at JAWS-UG Ibaraki #14 held on June 13, 2026. After seeing them, I decided to actually try reaching an ALB inside a VPC from Step Functions.
When you want to call an Internal ALB inside a VPC from Step Functions, using a VPC Lambda has traditionally been the common approach.
In December 2024, the Private connectivity feature for EventBridge Connection became GA (generally available), making it possible to reach private APIs inside a VPC via VPC Lattice without Lambda.
Also, in November 2025, API Gateway REST API private integrations gained the ability to specify an ALB directly, so you can now call an ALB inside a VPC without Lambda via VPC Link v2 as well.
Despite being GA since December 2024, there are still few practical articles in Japanese, and I couldn't find any comparison article with API Gateway, so I actually built and compared the following two patterns.
- Pattern A: EventBridge Connection (Private) + via VPC Lattice
- Pattern B: API Gateway REST API + via VPC Link v2
In this article, I confirm that Step Functions can call an Internal ALB inside a VPC without a Lambda relay, and organize the differences in connectivity path, IAM authentication, and constraints.
Test Environment
- Region: ap-northeast-1
- VPC: No public subnets (3 Isolated subnets)
- Common backend: Internal ALB (returns
{"status":"ok","source":"internal-alb"}via Fixed Response) - IaC: CloudFormation (2-stack configuration)
Calling with EventBridge Connection (Private)
Architecture Diagram
Step Functions → HTTP Task → EventBridge Connection (Private)
→ VPC Lattice (Resource Configuration → Resource Gateway) → Internal ALB
How It Works
EventBridge Connection (Private) uses VPC Lattice's Resource Configuration / Resource Gateway. This allows it to reach private resources inside the VPC.
- Resource Gateway: An entry point placed in subnets within the VPC that accepts traffic from VPC Lattice
- Resource Configuration: A setting that defines "which port on which domain to reach." It is associated with a Resource Gateway
- EventBridge Connection (Private): Used by specifying a Resource Configuration. Requests via the Connection reach the destination in the order VPC Lattice → Resource Gateway → destination
Data flow:
- Step Functions executes the HTTP Task and references the EventBridge Connection
- The credentials associated with the Connection are used. Since the credentials are held as a Secrets Manager secret managed by the Connection, the execution role needs
events:RetrieveConnectionCredentialsand permission to read from Secrets Manager - Step Functions sends the request. VPC Lattice handles routing via the Resource Configuration associated with the Connection
- VPC Lattice reaches inside the VPC via the Resource Gateway, and the request is forwarded to the destination (Internal ALB) resolved by the in-VPC DNS according to the
IN_VPCsetting
Required IAM Permissions
The Step Functions execution role needs the following permissions.
states:InvokeHTTPEndpoint— Permission to execute the HTTP Taskevents:RetrieveConnectionCredentials— Retrieving the Connection's credentialssecretsmanager:GetSecretValue/secretsmanager:DescribeSecret— Access to the Secrets Manager used internally by the Connectionvpc-lattice-svcs:Invoke— Required when usingResourceConfigurationAuthType: AWS_IAMon the Resource Configuration
CFn Template Highlights
Internal ALB (Minimal Backend with Fixed Response)
ALB:
Type: AWS::ElasticLoadBalancingV2::LoadBalancer
Properties:
Scheme: internal
Subnets: !Ref SubnetIds
SecurityGroups:
- !Ref AlbSecurityGroup
HttpsListener:
Type: AWS::ElasticLoadBalancingV2::Listener
Properties:
LoadBalancerArn: !Ref ALB
Port: 443
Protocol: HTTPS
Certificates:
- CertificateArn: !Ref CertificateArn
DefaultActions:
- Type: fixed-response
FixedResponseConfig:
StatusCode: "200"
ContentType: application/json
MessageBody: '{"status":"ok","source":"internal-alb"}'
The endpoint called from the Step Functions HTTP Task via EventBridge Connection (Private) must use HTTPS, and the destination's certificate must be verifiable by a public CA (the Resource Configuration side is defined as TCP/443). Therefore, even for an Internal ALB, an ACM public certificate is required, and self-signed certificates cannot be used.
Resource Gateway + Resource Configuration
ResourceGateway:
Type: AWS::VpcLattice::ResourceGateway
Properties:
Name: eb-demo-resource-gw-v2
IpAddressType: IPV4
ResourceConfigDnsResolution: IN_VPC
VpcIdentifier: !Ref VpcId
SubnetIds: !Ref SubnetIds
SecurityGroupIds:
- !Ref ResourceGatewaySecurityGroup
ResourceConfiguration:
Type: AWS::VpcLattice::ResourceConfiguration
Properties:
Name: eb-demo-resource-cfg-v3
ResourceGatewayId: !GetAtt ResourceGateway.Id
ResourceConfigurationType: SINGLE
ResourceConfigurationAuthType: AWS_IAM
ProtocolType: TCP
PortRanges:
- "443"
AllowAssociationToSharableServiceNetwork: true
ResourceConfigurationDefinition:
DnsResource:
DomainName: !Ref AlbDomainName
IpAddressType: IPV4
Key points:
ResourceConfigDnsResolution: IN_VPC— The destination FQDN is resolved by the DNS resolver inside the VPC. This setting is required in a configuration like this one, where a custom FQDN for the Internal ALB is resolved by the in-VPC DNSResourceConfigurationAuthType: AWS_IAM— Enables IAM authentication at the VPC Lattice layer. With this setting, grantingvpc-lattice-svcs:Invoketo the Step Functions execution role is mandatory
Resource Gateway Security Group
ResourceGatewaySecurityGroup:
Type: AWS::EC2::SecurityGroup
Properties:
GroupDescription: Security group for VPC Lattice Resource Gateway
VpcId: !Ref VpcId
SecurityGroupIngress:
- IpProtocol: tcp
FromPort: 0
ToPort: 65535
CidrIp: 0.0.0.0/0
- IpProtocol: tcp
FromPort: 0
ToPort: 65535
CidrIpv6: "::/0"
In my testing, allowing only 443/TCP from the VPC CIDR resulted in a timeout, and it was resolved by following the requirement shown in the official documentation to "allow all TCP ports from 0.0.0.0/0." The reason is explained later in the "Gotchas" section.
EventBridge Connection Private Connectivity Settings
PrivateConnection:
Type: AWS::Events::Connection
Properties:
Name: eb-demo-private-connection
AuthorizationType: API_KEY
AuthParameters:
ApiKeyAuthParameters:
ApiKeyName: x-dummy-key
ApiKeyValue: dummy
InvocationConnectivityParameters:
ResourceParameters:
ResourceConfigurationArn: !GetAtt ResourceConfiguration.Arn
Specifying the Resource Configuration in InvocationConnectivityParameters is the core of Private connectivity. API_KEY is specified for AuthorizationType, but the backend in this test does not validate this API key. Reachability is controlled by ResourceConfigurationAuthType: AWS_IAM and vpc-lattice-svcs:Invoke.
Step Functions State Machine (Embedding the Connection ARN)
StateMachineA:
Type: AWS::StepFunctions::StateMachine
Properties:
StateMachineName: eb-demo-pattern-a-private
RoleArn: !GetAtt PatternARole.Arn
DefinitionString:
Fn::Join:
- ""
- - '{"StartAt":"CallPrivateApi","States":{"CallPrivateApi":{"Type":"Task","Resource":"arn:aws:states:::http:invoke","TimeoutSeconds":60,"Parameters":{"ApiEndpoint":"https://eb-demo.example.com/","Method":"GET","Authentication":{"ConnectionArn":"'
- Fn::GetStackOutput:
StackName: !Ref InfraStackName
OutputName: PrivateConnectionArn
- '"}},"End":true}}}'
Fn::Join is used to embed the Connection ARN in the ASL definition. Cross-stack references are done with Fn::GetStackOutput, retrieving the Connection ARN from Stack 1. Fn::GetStackOutput is a CloudFormation intrinsic function that lets you reference output values across stacks without using Fn::ImportValue + Export.
Test Results
I executed the state machine and confirmed that the Internal ALB's Fixed Response was returned with StatusCode 200.
{
"StatusCode": 200,
"StatusText": "OK",
"ResponseBody": {"status": "ok", "source": "internal-alb"},
"Headers": {
"server": ["awselb/2.0"],
"content-type": ["application/json; charset=utf-8"]
}
}
Gotchas
FQDN is required, and user-managed DNS registration is needed
The destination of a Resource Configuration is specified by FQDN (IP addresses are not allowed, as stated in the official documentation). I had to register a CNAME record corresponding to the ALB in my own managed DNS. In this case, I registered a CNAME from eb-demo.example.com → the ALB's DNS name.
Restricting the Resource Gateway security group's inbound causes a timeout
Initially I allowed only 443/TCP from the VPC CIDR (192.168.0.0/18), but communication from VPC Lattice to the Resource Gateway timed out. The official documentation states, as a security group requirement for the Resource Gateway, that all TCP ports must be allowed from 0.0.0.0/0, and I resolved it by following this requirement. It is also mentioned in the slides.
HTTP Task timeout has a 60-second upper limit
The Step Functions HTTP Task times out after a maximum of 60 seconds (as stated in the official documentation). It is not suited for long-running API calls.
Calling with API Gateway REST API + VPC Link v2
Architecture Diagram
Step Functions → apigateway:invoke (Optimized Integration, IAM 署名付き)
→ API Gateway REST API (AWS_IAM 認証 + リソースポリシー)
→ VPC Link v2 → Internal ALB
How It Works
Using the VPC Link integration of API Gateway REST API, the REST API receives HTTP requests and relays them to the Internal ALB inside the VPC. Step Functions calls it via Optimized Integration (apigateway:invoke). Specifying AuthType: IAM_ROLE automatically attaches an IAM signature using the execution role's credentials.
This uses the update (November 2025) that allows specifying an ALB directly in REST API private integrations. VPC Link v2 (AWS::ApiGatewayV2::VpcLink) is now supported for REST APIs too, allowing direct integration with an ALB without an NLB.
Required IAM Permissions
The Step Functions execution role needs the following permissions.
execute-api:Invoke— Permission to execute the REST API
Compared to Pattern A, the number of required permissions is smaller and simpler.
CFn Template Highlights
REST API + VPC Link v2 + AWS_IAM Authentication
VpcLink:
Type: AWS::ApiGatewayV2::VpcLink
Properties:
Name: eb-demo-vpc-link
SubnetIds: !Ref SubnetIds
SecurityGroupIds:
- !Ref VpcLinkSecurityGroup
RestApi:
Type: AWS::ApiGateway::RestApi
Properties:
Name: eb-demo-rest-api
EndpointConfiguration:
Types:
- REGIONAL
RestApiMethod:
Type: AWS::ApiGateway::Method
Properties:
RestApiId: !Ref RestApi
ResourceId: !GetAtt RestApi.RootResourceId
HttpMethod: GET
AuthorizationType: AWS_IAM
Integration:
Type: HTTP_PROXY
IntegrationHttpMethod: GET
ConnectionType: VPC_LINK
ConnectionId: !Ref VpcLink
IntegrationTarget: !Ref HttpListener
Uri: !Sub "http://${ALB.DNSName}/"
Since the request is relayed to the Internal ALB's HTTP listener via VPC Link v2 this time, no certificate is needed on the ALB side. The ALB's HTTP listener is specified in IntegrationTarget (I confirmed a 200 response with Uri also specified). With AuthorizationType: AWS_IAM, requests without an IAM signature are rejected at the REST API layer.
Step Functions Optimized Integration
StateMachineB:
Type: AWS::StepFunctions::StateMachine
Properties:
StateMachineName: eb-demo-pattern-b-apigw
RoleArn: !GetAtt PatternBRole.Arn
DefinitionString:
Fn::Join:
- ""
- - '{"StartAt":"CallRestApi","States":{"CallRestApi":{"Type":"Task","Resource":"arn:aws:states:::apigateway:invoke","Parameters":{"ApiEndpoint":"'
- Fn::GetStackOutput:
StackName: !Ref InfraStackName
OutputName: RestApiId
- '.execute-api.ap-northeast-1.amazonaws.com","Method":"GET","Stage":"prod","AuthType":"IAM_ROLE"},"End":true}}}'
When AuthType: IAM_ROLE is specified, Step Functions automatically generates the IAM signature using the execution role's credentials.
Test Results
I executed the state machine and confirmed that the Internal ALB's Fixed Response was returned with StatusCode 200.
{
"StatusCode": 200,
"StatusText": "OK",
"ResponseBody": {"status": "ok", "source": "internal-alb"},
"Headers": {
"server": ["awselb/2.0"],
"apigw-requestid": ["e5Nw0iQQtjMEJUA="],
"content-type": ["application/json; charset=utf-8"]
}
}
Additional Control with Resource Policies
With the REST API's AWS_IAM authentication alone, access is possible from any IAM entity in the same account that holds the execute-api:Invoke permission.
If you want to forcibly reject everything except a specific role on the REST API side, set an explicit Deny with a StringNotEquals condition in the resource policy.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Deny",
"Principal": "*",
"Action": "execute-api:Invoke",
"Resource": "arn:aws:execute-api:ap-northeast-1:123456789012:<api-id>/prod/GET/",
"Condition": {
"StringNotEquals": {
"aws:PrincipalArn": "arn:aws:iam::123456789012:role/<PatternBRole>"
}
}
},
{
"Effect": "Allow",
"Principal": "*",
"Action": "execute-api:Invoke",
"Resource": "arn:aws:execute-api:ap-northeast-1:123456789012:<api-id>/prod/GET/"
}
]
}
Why this is necessary: Within the same account, with AWS_IAM authentication and a resource policy containing only Allow, other IAM entities that hold execute-api:Invoke via an identity-based policy can also access the API. Adding an explicit Deny reliably rejects access from anyone other than the specified role.
I confirmed that Step Functions execution from PatternBRole still succeeded with 200 after applying the resource policy.
Comparison
| Aspect | EventBridge Connection (Private) | API Gateway REST API + VPC Link v2 |
|---|---|---|
| Connectivity path | SFn → Connection → VPC Lattice → ALB | SFn → API Gateway → VPC Link → ALB |
| ALB-side certificate | Required (public CA) | Not required in this HTTP integration |
| Protocol | HTTPS only | Both HTTP / HTTPS supported |
| Endpoint specification | FQDN required | ALB specified via VPC Link. No custom domain needed |
| Timeout | HTTP Task 60-second limit | API Gateway integration timeout default 29 seconds (can be extended via quota increase request) |
| User-managed DNS | Required | Not required |
| Required IAM permissions / control points | states:InvokeHTTPEndpoint + events:RetrieveConnectionCredentials + secretsmanager:GetSecretValue/DescribeSecret + vpc-lattice-svcs:Invoke |
execute-api:Invoke + REST API AWS_IAM + resource policy |
| Step Functions integration method | HTTP Task (http:invoke) |
Optimized Integration (apigateway:invoke) |
| EventBridge Rules integration | A setup reusing the same Private Connection with API Destination is expected to work (not verified in this article) | API Gateway can be a target of EventBridge Rules, but an AWS_IAM authentication setup requires additional design |
| VPC Lattice dependency | Yes | No |
| Resource Gateway SG | All TCP / 0.0.0.0/0 allow required |
None (no Resource Gateway needed) |
Selection Criteria
Cases where EventBridge Connection (Private) fits:
- The callers are confined to Step Functions / EventBridge
- You don't want to create an API Gateway execute-api URL as an entry point
- You want to use the same Connection with EventBridge API Destination as well (using a Private Connection with API Destination is not verified in this article)
- You want VPC Lattice Resource Configuration / Resource Gateway to be the center of reachability control
- You don't need API Gateway's API management features (throttling, usage plans, etc.)
Cases where API Gateway REST API + VPC Link v2 fits:
- You just want to call an Internal ALB from Step Functions and keep the configuration simple
- You want to configure access control in an easy-to-understand way with IAM authentication + resource policy
- You want to avoid custom domain DNS management and preparing public CA certificates
Summary
I confirmed that with either configuration, EventBridge Connection (Private) or API Gateway REST API + VPC Link v2, Step Functions can call an Internal ALB inside a VPC without a Lambda relay.
Both let you control access centered on IAM, but the authorization layer and connectivity path differ. Pattern A goes through VPC Lattice / Resource Configuration, while Pattern B uses API Gateway as the entry point. To restrict Pattern B to a specific role, combine it with an explicit Deny in the REST API's resource policy.
If you want to call APIs inside a VPC while staying within Step Functions / EventBridge, EventBridge Connection (Private) is an option; if you want an entry point as an API Gateway REST API, API Gateway REST API + VPC Link v2 is an option.
There are cases where SNS or SQS is simpler if asynchronous processing is acceptable, but if you want to call an API inside a VPC synchronously and get a return value, please try the two approaches in this article.
References
Appendix: Full CloudFormation Templates
Stack 1: 01-infra.yaml (ALB, VPC Lattice, Connection, API Gateway)
AWSTemplateFormatVersion: "2010-09-09"
Description: "Stack 1: Internal ALB + EventBridge Connection (Private) + API Gateway REST API"
Parameters:
VpcId:
Type: AWS::EC2::VPC::Id
Default: vpc-0example1234567890
SubnetIds:
Type: CommaDelimitedList
Default: "subnet-0example1a,subnet-0example1c,subnet-0example1d"
CertificateArn:
Type: String
Default: arn:aws:acm:ap-northeast-1:123456789012:certificate/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
AlbDomainName:
Type: String
Default: eb-demo.example.com
Resources:
# ============================================================
# 共通: Internal ALB
# ============================================================
AlbSecurityGroup:
Type: AWS::EC2::SecurityGroup
Properties:
GroupDescription: Allow HTTP/HTTPS from VPC CIDR
VpcId: !Ref VpcId
SecurityGroupIngress:
- IpProtocol: tcp
FromPort: 80
ToPort: 80
CidrIp: 192.168.0.0/18
- IpProtocol: tcp
FromPort: 443
ToPort: 443
CidrIp: 192.168.0.0/18
ALB:
Type: AWS::ElasticLoadBalancingV2::LoadBalancer
Properties:
Scheme: internal
Subnets: !Ref SubnetIds
SecurityGroups:
- !Ref AlbSecurityGroup
HttpListener:
Type: AWS::ElasticLoadBalancingV2::Listener
Properties:
LoadBalancerArn: !Ref ALB
Port: 80
Protocol: HTTP
DefaultActions:
- Type: fixed-response
FixedResponseConfig:
StatusCode: "200"
ContentType: application/json
MessageBody: '{"status":"ok","source":"internal-alb"}'
HttpsListener:
Type: AWS::ElasticLoadBalancingV2::Listener
Properties:
LoadBalancerArn: !Ref ALB
Port: 443
Protocol: HTTPS
Certificates:
- CertificateArn: !Ref CertificateArn
DefaultActions:
- Type: fixed-response
FixedResponseConfig:
StatusCode: "200"
ContentType: application/json
MessageBody: '{"status":"ok","source":"internal-alb"}'
# ============================================================
# パターン A: EventBridge Connection (Private) via VPC Lattice
# ============================================================
ResourceGatewaySecurityGroup:
Type: AWS::EC2::SecurityGroup
Properties:
GroupDescription: Security group for VPC Lattice Resource Gateway
VpcId: !Ref VpcId
SecurityGroupIngress:
- IpProtocol: tcp
FromPort: 0
ToPort: 65535
CidrIp: 0.0.0.0/0
- IpProtocol: tcp
FromPort: 0
ToPort: 65535
CidrIpv6: "::/0"
ResourceGateway:
Type: AWS::VpcLattice::ResourceGateway
Properties:
Name: eb-demo-resource-gw-v2
IpAddressType: IPV4
ResourceConfigDnsResolution: IN_VPC
VpcIdentifier: !Ref VpcId
SubnetIds: !Ref SubnetIds
SecurityGroupIds:
- !Ref ResourceGatewaySecurityGroup
ResourceConfiguration:
Type: AWS::VpcLattice::ResourceConfiguration
Properties:
Name: eb-demo-resource-cfg-v3
ResourceGatewayId: !GetAtt ResourceGateway.Id
ResourceConfigurationType: SINGLE
ResourceConfigurationAuthType: AWS_IAM
ProtocolType: TCP
PortRanges:
- "443"
AllowAssociationToSharableServiceNetwork: true
ResourceConfigurationDefinition:
DnsResource:
DomainName: !Ref AlbDomainName
IpAddressType: IPV4
PrivateConnection:
Type: AWS::Events::Connection
Properties:
Name: eb-demo-private-connection
AuthorizationType: API_KEY
AuthParameters:
ApiKeyAuthParameters:
ApiKeyName: x-dummy-key
ApiKeyValue: dummy
InvocationConnectivityParameters:
ResourceParameters:
ResourceConfigurationArn: !GetAtt ResourceConfiguration.Arn
# ============================================================
# パターン B: API Gateway REST API + VPC Link v2
# ============================================================
VpcLinkSecurityGroup:
Type: AWS::EC2::SecurityGroup
Properties:
GroupDescription: Security group for API Gateway VPC Link
VpcId: !Ref VpcId
SecurityGroupIngress:
- IpProtocol: tcp
FromPort: 80
ToPort: 80
CidrIp: 192.168.0.0/18
VpcLink:
Type: AWS::ApiGatewayV2::VpcLink
Properties:
Name: eb-demo-vpc-link
SubnetIds: !Ref SubnetIds
SecurityGroupIds:
- !Ref VpcLinkSecurityGroup
RestApi:
Type: AWS::ApiGateway::RestApi
Properties:
Name: eb-demo-rest-api
EndpointConfiguration:
Types:
- REGIONAL
RestApiMethod:
Type: AWS::ApiGateway::Method
Properties:
RestApiId: !Ref RestApi
ResourceId: !GetAtt RestApi.RootResourceId
HttpMethod: GET
AuthorizationType: AWS_IAM
Integration:
Type: HTTP_PROXY
IntegrationHttpMethod: GET
ConnectionType: VPC_LINK
ConnectionId: !Ref VpcLink
IntegrationTarget: !Ref HttpListener
Uri: !Sub "http://${ALB.DNSName}/"
RestApiDeployment:
Type: AWS::ApiGateway::Deployment
DependsOn: RestApiMethod
Properties:
RestApiId: !Ref RestApi
RestApiStage:
Type: AWS::ApiGateway::Stage
Properties:
RestApiId: !Ref RestApi
DeploymentId: !Ref RestApiDeployment
StageName: prod
PublicConnection:
Type: AWS::Events::Connection
Properties:
Name: eb-demo-public-connection
AuthorizationType: API_KEY
AuthParameters:
ApiKeyAuthParameters:
ApiKeyName: x-dummy-key
ApiKeyValue: dummy
Outputs:
AlbDnsName:
Value: !GetAtt ALB.DNSName
AlbHttpsListenerArn:
Value: !Ref HttpsListener
PrivateConnectionArn:
Value: !GetAtt PrivateConnection.Arn
PublicConnectionArn:
Value: !GetAtt PublicConnection.Arn
RestApiEndpoint:
Value: !Sub "https://${RestApi}.execute-api.${AWS::Region}.amazonaws.com/prod"
RestApiId:
Value: !Ref RestApi
Stack 2: 02-stepfunctions.yaml (IAM Role × 2, State Machine × 2)
AWSTemplateFormatVersion: "2010-09-09"
Description: "Stack 2: Step Functions state machines (Pattern A: Private Connection, Pattern B: REST API)"
Parameters:
InfraStackName:
Type: String
Default: eb-connection-infra
Resources:
# ============================================================
# IAM Role - Pattern A (Private Connection)
# ============================================================
PatternARole:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: Allow
Principal:
Service: states.amazonaws.com
Action: sts:AssumeRole
Policies:
- PolicyName: HttpInvokePrivate
PolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: Allow
Action: states:InvokeHTTPEndpoint
Resource: "*"
- Effect: Allow
Action: events:RetrieveConnectionCredentials
Resource:
Fn::GetStackOutput:
StackName: !Ref InfraStackName
OutputName: PrivateConnectionArn
- Effect: Allow
Action:
- secretsmanager:GetSecretValue
- secretsmanager:DescribeSecret
Resource:
Fn::Join:
- ""
- - "arn:aws:secretsmanager:"
- !Ref AWS::Region
- ":"
- !Ref AWS::AccountId
- ":secret:events!connection/eb-demo-private-connection/*"
- Effect: Allow
Action: vpc-lattice-svcs:Invoke
Resource: "*"
# ============================================================
# IAM Role - Pattern B (REST API direct integration)
# ============================================================
PatternBRole:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: Allow
Principal:
Service: states.amazonaws.com
Action: sts:AssumeRole
Policies:
- PolicyName: HttpInvokeRestApi
PolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: Allow
Action: execute-api:Invoke
Resource:
Fn::Join:
- ""
- - "arn:aws:execute-api:"
- !Ref AWS::Region
- ":"
- !Ref AWS::AccountId
- ":"
- Fn::GetStackOutput:
StackName: !Ref InfraStackName
OutputName: RestApiId
- "/prod/GET/"
# ============================================================
# ステートマシン A: EventBridge Connection (Private) 経由
# ============================================================
StateMachineA:
Type: AWS::StepFunctions::StateMachine
Properties:
StateMachineName: eb-demo-pattern-a-private
RoleArn: !GetAtt PatternARole.Arn
DefinitionString:
Fn::Join:
- ""
- - '{"StartAt":"CallPrivateApi","States":{"CallPrivateApi":{"Type":"Task","Resource":"arn:aws:states:::http:invoke","TimeoutSeconds":60,"Parameters":{"ApiEndpoint":"https://eb-demo.example.com/","Method":"GET","Authentication":{"ConnectionArn":"'
- Fn::GetStackOutput:
StackName: !Ref InfraStackName
OutputName: PrivateConnectionArn
- '"}},"End":true}}}'
# ============================================================
# ステートマシン B: API Gateway REST API 経由 (Optimized Integration)
# ============================================================
StateMachineB:
Type: AWS::StepFunctions::StateMachine
Properties:
StateMachineName: eb-demo-pattern-b-apigw
RoleArn: !GetAtt PatternBRole.Arn
DefinitionString:
Fn::Join:
- ""
- - '{"StartAt":"CallRestApi","States":{"CallRestApi":{"Type":"Task","Resource":"arn:aws:states:::apigateway:invoke","Parameters":{"ApiEndpoint":"'
- Fn::GetStackOutput:
StackName: !Ref InfraStackName
OutputName: RestApiId
- '.execute-api.ap-northeast-1.amazonaws.com","Method":"GET","Stage":"prod","AuthType":"IAM_ROLE"},"End":true}}}'
Outputs:
StateMachineArnPatternA:
Value: !GetAtt StateMachineA.Arn
StateMachineArnPatternB:
Value: !GetAtt StateMachineB.Arn
