AMAZON API GATEWAY

CREATE, MAINTAIN, AND SECURE APIS AT ANY SCALE

INTRODUCTION FOUNDATIONS REQUEST FLOW RESPONSE FLOW GATEWAY TYPES
API Gateway is a fully-managed service that acts as a front API Gateway allows you to securely create APIs at any The Request Flow is everything that happens before the The Response Flow is everything that comes after the API Gateway comes in three different flavors, offering
door to your application’s ecosystem.

scale, not only to expose AWS resources like Lambda but integration is triggered, like authentication and integration, like transformations so your clients get an different features and pricing
anything that speaks HTTP.

authorization processing (see Authorizers) or request expected output for the results of your integration. REST - the default and most common type
It's easy to perceive it just as an HTTP mediator between a validation. HTTP - reduced set of features in comparison to REST,
client and an internal AWS service like Lambda, but there's In a nutshell, its built of three major parts but way cheaper and easier to set up
more to explore as it offers a lot of valuable features. Request Flow - everything that happens before your USAGE PLANS WebSockets - for building real-time applications.
destination is called: Authorize, validate & transform PROXY RESOURCE API keys can be used as a method for rate limiting and
Bind different HTTP requests to a single integration.

throttling the clients of your APIs by defining

Integration - calling the target destination - like a
ERROR HANDLING Lambda function - and actual handling your request
a threshold for the requests per second AUTHORIZERS
You request can get rejected by your API for a lot of different Example: /api/v1/customers/{id}
burst sizes: a time-window that can exceed the threshold Authorizers enable you to protect your downstream
Response Flow - the post-destination step: transforming
reasons. Among other things It will bind calls for example t the maximum number of requests for a time-window.

services and forward a security context that contains

responses for your clients.

missing or invalid authorization /api/v1/customers/88ec6f6f

information about the authenticated identity.

payload does not match your validation model but not t This adds a layer of protection against flooding and misuse.

There are different types of authorizers, including the

a or benefits: the request & response flow allows you to
M j
invalid methods or routes.

/api/v1/customers/88ec6f6f/orders

default JWT, a Cognito User Pool or a custom Lambda

do a lot without writing much or any code, e.g
Requests which are blocked due to rate-limiting are not function.

use a mapping templates written in the Velocity

By default, API Gateway will return a HTTP 400 Bad You can extend the proxy indicator with a + to capture all billed - this is the same for requests that are rejected due to
Template Language (VTL) to transform input
Request response with a message indicating the type of values that come after.
invalid authentication/authorization by your Authorizers. The default JWT for HTTP Gateway is great to integrate with
authenticate via JWTs with the default JWT Authorizer
failure. e.g. BAD_REQUEST_BODY or INVALID_MEDIA_TYPE.

Example: /api/v1/{proxy+}
any identity provider supporting OAuth2/OpenID.
Will match for exampl
You’re also able to use response templates to construct PROXY INTEGRATION /api/v1/customer RESPONSE HANDLING
payloads that contain detailed errors by using variable
️
API Gateway is also able to forward your request as is to /api/v1/order
If you're not using a proxy integration, you need to define REQUEST VALIDATION
integration responses. Those are the counterpart to our Validating requests before they hit your integration comes
substitution from the context object of your request. a Lambda function via a default mapping template o /api/v1/orders/5aa989ff

integration request in the request flow and transform the with major benefits of reducing the number of invocations
an HTTP endpoint - forwarding your entire request

backend responses into something API Gateway can handle.

for and saving boilerplate code at your integration.

... and everything else that's under /api/v1.

M ONITORING The proxy integration makes API Gateway really easy to
This is also done by using VTL. Additionally, you need to
CloudWatch already tracks a lot of metrics for our API determine if our integration request was successful or if it You’re able to do parameter validation (requiring query
use, but remove some of its powerful features. INTEGRATION
Gateways out of the box, including:
returned an error - also finding out which exact error parameters or headers) as well as payload validation
• number of HTTP 4xx and 5xx responses
occurred. (dedicated models for your incoming request payloads,
• execution & integration errors
including the accepted content type or payload

Integration
Integration

Request Flow

Response Request
• integration latency

containments).
Method
AWS SERVICE PROXY INGERATION

... and any more services

Request It's also possible to directly integrate your API Gateway to
Besides that, you can enable API Gateway to write logs to
CloudWatch which will help you to investigate issues with
AWS services like DynamoDB, e.g. to insert, update or delete PRICING
items.

Free for the first 12 months - every month - per type

your integration.

Response Flow

REST: 1m API call

Third-party apps like Dashbird.io help you to monitor all Method
This is useful for simple data ingestion services which then HTTP: 1m API call
of your REST & HTTP API Gateways with just minimal Response don't require any operations or maintainance. WebSockets: 1m messages & 750k connection minutes

configuration in a central place - including low-noise

REST Gateway is much more expensive than HTTP.

notifications about issues to your favorite channels. API GATEWAY Looking at us-east-1, it is $3.5 vs. $1 per 1m requests,
meaining HTTP gateway is ~71% cheaper.