Amazon API Gateway now supports mutual TLS for backend integrations
Amazon API Gateway enables mutual TLS for backend integrations with REST APIs, allowing the use of ACM certificates and supporting end-to-end mutual authentication.
Amazon API Gateway's REST API now supports presenting ACM certificates during TLS handshakes for backend integrations, enabling mutual TLS. Previously limited to self-signed certificates, it now uses certificates signed by trusted CAs. Integration endpoints validate the certificate to confirm connections originate from the API. Certificates can be imported from existing PKIs or issued and managed via AWS Private Certificate Authority. API Gateway automatically reflects certificate re-imports or updates without redeployment or downtime. Combined with existing client mTLS support, this allows mutual authentication for both client-to-API and API-to-backend connections, a common requirement in regulated environments like financial services and healthcare, as well as zero-trust settings. Backend mTLS integration is available in all commercial AWS regions and AWS GovCloud (US), configurable via the API Gateway console, AWS CLI, or AWS CloudFormation.
Why it matters
This change is useful for developers who need to enhance security between APIs and backend systems, particularly in highly regulated industries.