title: AWS API Gateway - Can you mix private access and public authenticated access?
body: <p>We have 2 AWS accounts</p>
  <p><strong>A</strong> has an public facing Cognito authed API Gateway</p>
  <p><strong>B</strong> has some EC2 boxes that contain various apps that also need to call the API</p>
  <p>Is there a way to configure the authentication so the internal requests from account B do not need to auth - in the same way a private API can? - whilst still allowing public authed access ?</p>
  <p>I created a private API that had a Resource Policy to allow a VPC end point from account B account to call it, which works, but then the API is no longer public.</p>
  <p>With a public API I can lock it down to the Role assigned to the EC2 box in account B, using the following Resource Policy</p>
  <pre><code>{
      &quot;Version&quot;: &quot;2012-10-17&quot;,
      &quot;Statement&quot;: [
          {
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Principal&quot;: {
                  &quot;AWS&quot;: &quot;arn:aws:iam::{ACCOUNT_B_ID}:role/role-name&quot;
              },
              &quot;Action&quot;: &quot;execute-api:Invoke&quot;,
              &quot;Resource&quot;: &quot;arn:aws:execute-api:eu-west-1:{ACCOUNT_A_ID}:{API_ID}/*/*/*&quot;
          }
      ]
  }
  </code></pre>
  <p>But then we have no public access (as to be expected), but also we get <code>{&quot;message&quot;:&quot;Forbidden&quot;}</code> with the internal access!</p>
  <p>Can the two be mixed?</p>