Support for private REST API Gateways

[cvangerpen]

The Cirrus and STAC server API Gateways may now be set to PRIVATE rather than always being set to EDGE. If private, the necessary VPC endpoint (and associated resource) configuration will be handled automatically.

Related issue(s)

• None

Proposed Changes

1. The api_rest_type input variable is now exposed at the root level for both cirrus_inputs and stac_server_inputs config objects and is propagated through to the cirrus and stac-server modules. This allows the default of EDGE to be overwritten.
2. If either API Gateway is configured as PRIVATE, the following ancillary resources are created within that module:
   • A security group that restricts inbound access to TCP over 443.
   • A VPC interface endpoint for the API Gateway service. The security group above is used. Only resources in the FilmDrop private subnets can access it.
   • An IAM policy document to manage execute-api:Invoke permissions for the API Gateway. Only traffic from the new VPC endpoint is allowed.
3. The stac-server output stac_server_api_domain_name has been updated to account for a private API Gateway endpoint (the domain name must include the VPCe ID).

Note that the VPCe used for private stac-server and cirrus API Gateways will not use private DNS resolution as there can only be one interface endpoint per service with private DNS enabled; instead, the APIs will need to be invoked using their API Gateway + associated VPCe URL. A custom domain name may also be configured outside of the module as needed; such configuration is beyond the scope of this module.

Testing

This change was validated by the following observations:

1. An existing FilmDrop deployment (with EDGE-type API Gateways) was modified to use PRIVATE-type API Gateways and without any CloudFront distribution to front it.
2. Deployed and confirmed the VPCe was created with ENI accessibility in each of FilmDrop's private subnets
3. Confirmed the API Gateway was not accessible from outside of the VPC
4. Confirmed the API Gateway was accessible from within the VPC in the private subnets when using the VPCe-linked URL
   • 

...

Checklist

• I have deployed and validated this change
• Changelog
  • I have added my changes to the changelog
  • No changelog entry is necessary
• README migration
  • I have added any migration steps to the Readme
  • No migration is necessary