Allows us to create REST APIs which are accessible by the clients
AWS Lambda + API Gateway: No infrastructure to manage
API Gateway provides support for WebSocket Protocol
It handles API versioning (v1, v2, etc.)
It handles different environment (dev, tets, prod)
It handles security (authentication and authorization)
It can create API keys, handles request throttling
Supports common standards: Swagger / Open API
It can transform and validate requests and responses
We can generate SDK and API specifications
We can cache API responses
API Gateway - Integrations
Lambda Functions
It can invoke Lambda functions
Easy way to expose REST API backed by AWS Lambda
HTTP
Exposes HTTP endpoints in the back-end. Example: internal HTTP API on premise, Application Load Balancer, etc. By this we can add features like rate limiting, user authentication, API keys to existing back-ends
AWS Service
We can expose any AWS API through API Gateway, examples: API for starting a Step Function workflow, API for posting a message to SQS
Endpoint Types
Edge-Optimized (default): for global clients
Requests are routed through the CloudFormation Edge locations
The API Gateway still lives in only one region
Regional:
For clients within the same region
Could manually be combined with CloudFront having more control over caching strategies and distributions
Private:
Can only be accessed from a VPC using an ENI
We can use resource policies to define access
Security
IAM Permissions
We can give access to an API by creating an IAM policy authorization and attach it to an User/Role
API Gateway verifies IAM permissions passed by the calling application
Good practice to provide access within own infrastructure
It leverages Sig v4 signatures by adding the signature to a header
Lambda Authorizer (Custom Authorizer)
Uses AWS Lambda to validate the token from a header
Optionally the result of the authentication can be cached
Helps to use OAuth/SAML/3rd party type of authentication
The lambda must return an IAM policy for the user
Cognito User Pools
Cognito will manage the full user lifecycle
API gateway verifies identity automatically from AWS Cognito
No custom implementation is required
Cognito only helps with authentication, not authorization
Summary
IAM:
Great for user/roles already within an AWS account
Handles authentication + authorization
Leverages Sig v4
Custom Authorizer:
Great for 3rd party tokens
Very flexible in terms of what IAM policy is returned
Handles authentication + authorization
We pay per lambda invocation
Cognito User Pools
We manage our own user pool, which can be backed by Facebook, Google login, etc.