title: Securing an existing API behind AWS API Gateway
body: <p>Suppose I have a RESTful API that sits on a Windows EC2 cluster, behind an ELB. The existing API is a .NET application and hosted in IIS.</p>
  
  <p>I want to try and put AWS API Gateway in front of the existing API, so that security, scalability, etc. is handled by AWS. Essentially set up AWS Gateway as a HTTP proxy to the existing API. </p>
  
  <p>From the AWS documentation it states that the existing API must be made public. But it should be secured by verifying the calls are originating from Amazon API Gateway by checking the client side certificate.</p>
  
  <p><a href="http://docs.aws.amazon.com/apigateway/latest/developerguide/getting-started-client-side-ssl-authentication.html" rel="nofollow noreferrer">http://docs.aws.amazon.com/apigateway/latest/developerguide/getting-started-client-side-ssl-authentication.html</a></p>
  
  <p>However the SSL connections for the existing API are terminated at the ELB. Hence when we check the client certificate, on the request, in code - it doesn't exist. </p>
  
  <p>What would need to be done to get the client certificate at the EC2/IIS/code level? </p>
  
  <p>Or is there an alternative way to secure the existing API and ensure AWS API Gateway can still communicate with it? </p>