title: VPC settings to restrict access of Elastic Beanstalk URL to only API Gateway?
body: <p>I have an Elastic Beanstalk web service running Tomcat + Java 8. I also have an API Gateway, which will contain an endpoint pointing to a VPC Link. I am having issues with deploying the Beanstalk with the settings I believe I should be using. My goal is to make the Beanstalk web service only accessible via the API Gateway endpoint, so no external user/service can access the xyz.us-east-2.elasticbeanstalk.com URL directly.</p>
  
  <p>To accomplish this, I created a VPC through the console that uses the <code>10.0.0.0/16</code> IPv4 block.</p>
  
  <p>I also created two sets of subnets, "EC2Subnets" which uses <code>10.0.0.0/24</code>, and "ELBSubnets" which uses <code>10.0.1.0/24</code>.</p>
  
  <p>From the ebcli, I run:</p>
  
  <p><code>$eb create MyApp --elb-type network --vpc</code></p>
  
  <p>Which prompts for some info:</p>
  
  <p><code>
  Enter the VPC ID: vpc-myvpcID
  Do you want to associate a public IP address? (Y/n): y
  Enter a comma-separated list of Amazon EC2 subnets: subnet-myec2subnetID
  Enter a comma-separated list of Amazon ELB subnets: subnet-myelbsubnetID
  Enter a comma-separated list of Amazon VPC security groups: 
  Do you want the load balancer to be public? (Select no for internal) (Y/n): n
  </code></p>
  
  <p>Doing this causes a hang in adding the EC2 instance to Beanstalk, and eventually leads to an error: "The EC2 instances failed to communicate with AWS Elastic Beanstalk, either because of configuration problems with the VPC or a failed EC2 instance. Check your VPC configuration and try launching the environment again."</p>
  
  <p>What am I doing wrong? Obviously something is wrong with my network, but I am struggling to see what it is exactly.</p>
  
  <p><strong>EDIT:</strong> Managed to figure it out; the VPC needed an Internet Gateway added to its Route Table. To do this, I created an Internet Gateway, attached it to the VPC, then went into that VPC's route table and added the newly created gateway to correspond to <code>0.0.0.0/0</code>.</p>