What's changed: In-scope service coverage (axis B): added definitions, roles, and selection criteria for EKS/EFS (s1), AppSync/ELB/Route 53/WAF (s2), and Aurora (s3).
1.2Exposing APIs with Amazon API Gateway
Understand exposing APIs with API Gateway (routing, auth, throttling, stages, caching), REST/HTTP/WebSocket differences, and Lambda integration.
The managed "front door" for safely exposing your backend (e.g., Lambda) is Amazon API Gateway. It handles routing, authentication, throttling, and more.
1.2.1What API Gateway does
- Routing: dispatches by path/method to a backend (Lambda, HTTP).
- Auth: control access with IAM, Cognito authorizers (user pools), or Lambda authorizers (custom logic).
- Throttling/caching: protect with rate/burst limits; reduce load and latency with response caching.
- Stages: per-environment deployment units (dev/prod); switch settings with stage variables.
- Types: simple/cheap HTTP API, feature-rich REST API, bidirectional WebSocket API.
API Gateway is the managed "front door" that offloads auth, rate control, and routing from your backend. For per-request authorization, use a Cognito authorizer when you have a login platform, or a Lambda authorizer for custom logic. Throttling protects the backend from spikes/abuse, and caching reuses identical responses to cut latency and cost. Deploy per stage (dev/prod), switching targets via stage variables. Choose the HTTP API (cheap) for simple needs, the REST API for fine control/caching/request validation, and the WebSocket API for bidirectional communication (e.g., chat).
| Requirement | Choice/feature |
|---|---|
| Simple, cheap REST | HTTP API |
| Fine control/caching/validation | REST API |
| Bidirectional | WebSocket API |
| Auth via login platform | Cognito authorizer |
| Custom-logic auth | Lambda authorizer |
Scenario: an API for a mobile app. Clients call Lambda through API Gateway. Authenticate users with a Cognito authorizer (token validation), protect against spikes with throttling, and speed up frequent GETs with caching. Separate dev/prod stages, switching the target Lambda alias via stage variables. Use HTTP API if simple, REST API if you need fine control.
Watch the mix-ups: (1) Cognito authorizer (user-pool tokens) vs Lambda authorizer (custom logic). (2) Stages = per-environment deployment units (dev/prod). (3) HTTP API (cheap/simple) vs REST API (rich, caching/validation) by requirement. (4) API Gateway itself handles auth/throttling (don’t implement in the backend).
Q. HTTP API or REST API? HTTP API for simple/cheap; REST API for caching, request validation, fine control. Q. Cognito vs Lambda authorizer? Cognito validates user-pool tokens; Lambda authorizes via custom logic. Q. What is a stage? A per-environment deployment unit (dev/prod); stage variables switch targets.
Common on DVA: managed API exposure/auth/throttling = API Gateway, switching dev/prod = stages, per-request authorization = Cognito/Lambda authorizers, simple = HTTP API / rich = REST API.
1.2.2GraphQL, load balancing, DNS, and web protection
REST is not the only way to expose an API. AWS AppSync is a managed GraphQL API: clients fetch exactly the fields they need in one request, and it suits real-time updates via subscriptions and offline sync for mobile (data sources include DynamoDB, Lambda, RDS). Choose AppSync when you need a GraphQL layer over multiple data sources or real-time subscriptions; API Gateway for general REST/HTTP. When you expose horizontally scaled EC2/containers, Elastic Load Balancing (ELB) fronts and distributes traffic and uses health checks to drop unhealthy targets (ALB for HTTP/HTTPS, NLB for ultra-low-latency L4). Domain-name access is handled by Amazon Route 53 (managed DNS), which offers routing policies (weighted, latency, failover) and health checks. To protect public endpoints from SQL injection, XSS, and excessive requests, apply AWS WAF to API Gateway, ALB, or CloudFront with managed and rate-based rules.
| What you want | Service |
|---|---|
| GraphQL API, real-time/offline sync | AWS AppSync |
| Load-balance to EC2/containers | Elastic Load Balancing (ELB) |
| DNS resolution and routing | Amazon Route 53 |
| Protect against web exploits | AWS WAF |
1.2.3Section summary
- API Gateway = managed routing, auth, throttling, caching, stages
- Authorization via Cognito/Lambda authorizers; environments via stages; types HTTP/REST/WebSocket API
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. Which AWS service safely exposes a backend (e.g., Lambda) and provides managed auth and throttling?
Q2. What in API Gateway separates deployments per environment like dev and prod?
Q3. What commonly authorizes each request in API Gateway?