How to only allow API Gateway requests to reach our EC2 instances
Since November 2017, it is now possible to directly interact with servers in a VPC \o/

See: 


https://stackoverflow.com/questions/32671394/can-i-specify-http-endpoint-in-a-vpc-as-resource-in-aws-api-gateway
http://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-private-integration.html