So far we've been deploying the api and Aurora cluster into the default VPC, but for an upcoming public sandbox, we need create a fully sequestered environment. This is easy with the Aurora cluster as I'm using the CDK

new DatabaseCluster

construct there, but not as clear with the HTTP API

There’s a concept of a private API that u can create for a REST api that can only be access via a VPC link

Not that I’m aware of for HTTP api

Here’s some details on Private apis https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-private-apis.html

Been in the RDS stack too long, API GW is simpler

That does make things easier. Thank you!