TYK API Gateway to AWS API Execute Gateway + Lambda

TYK API Gateway does not provide a simple integration for invoking Lambda and I remember reading Kong does.  In any case, this is about how to securely integrate TYK with Lambda - Or in general, consuming internal/private AWS Api gateway in your application.

Here are the high-level steps 

1) Create a VPC Endpoint for API Gateway - with a security group that allows 443 from the TYK Node/application nodes ( Security-group in the source is the best choice). Note the Endpoint ID (used  for API Gateway Resource Policy) and DNS Name (not the individual AZ but the generic one - to be used for API definition on TYK API Gateway )

2) Create a Private AWS API gateway - with a nicely tied security group and the resource policy would look something like this ( replace highlighted place holders with your configurations) 

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": "*",
            "Action": "execute-api:Invoke",
            "Resource": "arn:aws:execute-api:us-west-2:012345678910:yourapiid/*",
            "Condition": {
                "StringEquals": {
                    "aws:sourceVpce": "vpce-yourapiendpointid"
                }
            }
        }
    ]

}

3) Create the TYK API with Target URL as https://VPCE-DNS noted from step 1 and edit the global settings from endpoint designer to inject an upstream header x-apigw-api-id with value of the yourapiid

4) That's all :). Test your API. Apply appropriate auth mechanism to the TYK API. Have fun