# Ensure API Gateway Not Edge Optimized

- Source: https://support.icompaas.com/support/solutions/articles/62000228286-ensure-api-gateway-not-edge-optimized
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Security Controls](https://support.icompaas.com/support/solutions/62000065178) › [AWS Services](https://support.icompaas.com/support/solutions/folders/62000097507)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

### **Description:**

Amazon API Gateway is an AWS service for creating, publishing, maintaining, monitoring, and securing REST, HTTP, and WebSocket APIs at any scale. An **API endpoint** type refers to the hostname of the API. The API endpoint type can be **edge-optimized**, **regional**, or **private**, depending on where the majority of your API traffic originates from.

-   An **edge-optimized API endpoint** is best for geographically distributed clients. API requests are routed to the nearest CloudFront Point of Presence (POP). This is the default endpoint type for API Gateway REST APIs.
    
-   A **regional API endpoint** is intended for clients in the same region. When a client running on an EC2 instance calls an API in the same region, or when an API is intended to serve a small number of clients with high demands, a regional API reduces connection overhead.
    
-   A **private API endpoint** is an API endpoint that can only be accessed from your Amazon Virtual Private Cloud (VPC) using an interface VPC endpoint, which is an endpoint network interface (ENI) that you create in your VPC.
    

### **Rationale:**

By not having API Gateway as Edge Optimized, it will not enable incoming requests that are routed through the AWS "Edge Network," which is the CloudFront network, with its 100+ global **edge** locations.

### **Impact:**  

If the clients of your **API** **Gateway** stage are inside AWS and within the same region where you deployed the **API** (such as when the **API** is being called by other systems in EC2 within the region), then you will most likely want a **Regional** endpoint. 

### **Default value:**

Endpoints are selected when creating the API Gateway.

### **Pre-Requisite:**

Initially, you must have an API gateway.

### **Remediation:**

#### **Test Plan:**

-   **AWS Console Process**
    

1.  Go to API Gateway console [API Gateway (amazon.com)](https://us-east-1.console.aws.amazon.com/apigateway/main/apis?region=us-east-1 "https://us-east-1.console.aws.amazon.com/apigateway/main/apis?region=us-east-1") and select APIs.![](https://support.icompaas.com/assets/kb/af2f93582a2343ec.png)
    
2.  In the APIs panel you can see the APIs endpoint type![](https://support.icompaas.com/assets/kb/3b3507a80f017f97.png)

  

  

**Using AWS CLI**

  

aws apigateway get-rest-api  
  --region <region-name>  
  --rest-api-id <rest-api-name>  
  --query 'endpointConfiguration.types'

### **Implementation Steps:**

-   **AWS Console Process**
    

1.  Sign into the AWS Management Console.
    
2.  Navigate to API Gateway Console at [https://console.aws.amazon.com/apigateway](https://console.aws.amazon.com/apigateway "https://console.aws.amazon.com/apigateway").
    
3.  Click on **APIs** in the left navigation pane.
    
4.  Select the API you want to modify and click on it.
    
5.  Click on the **Settings** under the API you opened. ![](https://support.icompaas.com/assets/kb/470eae79d566e136.png)
    
6.  In the settings page opened, go to the **Endpoint Configuration** section and choose **Regional** or **Private** in the Dropdown menu.

![](https://support.icompaas.com/assets/kb/6ad4221583be0a1b.png)

  

**Using AWS CLI**

To use the AWS CLI to update an edge-optimized API whose API ID is `{api-id}`, call [update-rest-api](https://docs.aws.amazon.com/cli/latest/reference/apigateway/update-rest-api.html "https://docs.aws.amazon.com/cli/latest/reference/apigateway/update-rest-api.html") as follows:

aws apigateway update-rest-api \\  
    --rest-api-id {api-id}   
    --patch-operations op=replace,path=/endpointConfiguration/types/EDGE,value=REGIONAL

### **Backout Plan:**

-   **AWS Console Process**
    

1.  Go to API Gateway console [API Gateway (amazon.com)](https://us-east-1.console.aws.amazon.com/apigateway/main/apis?region=us-east-1 "https://us-east-1.console.aws.amazon.com/apigateway/main/apis?region=us-east-1") and select APIs
    
2.  Click on the API that you want to change.![](https://support.icompaas.com/assets/kb/fd11b008f1dbd495.png)
    
3.  In the left navigation, click on settings. ![](https://support.icompaas.com/assets/kb/5b4ae834e382aa44.png)
    
4.  In Endpoint Configuration change the endpoint type from edge optimized to regional or private. ![](https://support.icompaas.com/assets/kb/bfe49f326b47066c.png)
    
5.  Scroll down and click on save changes.

  

**Using AWS CLI**

The AWS CLI to update regional to edge-optimized APIs whose API ID is `{api-id}`.

aws apigateway update-rest-api \\  
    --rest-api-id {api-id} \\  
    --patch-operations op=replace,path=/endpointConfiguration/types/REGIONAL,value=EDGE

### **References:**

[![](https://support.icompaas.com/assets/kb/528951b5a44297d1.png)Amazon API Gateway concepts - Amazon API Gateway](https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-basic-concept.html) 

[![](https://support.icompaas.com/assets/kb/fbc21a1ed0192960.png)Change a public or private API endpoint type in API Gateway - Amazon API Gateway](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-api-migration.html) 

[![](https://support.icompaas.com/assets/kb/253ccccec7056a55.png)Choose an endpoint type to set up for an API Gateway API - Amazon API Gateway](https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-api-endpoint-types.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.