Amazon API Gateway

Overview

Clients need a way to invoke a Lambda function that uses DynamoDB for an API. Options:

• The client invokes the Lambda function directly, which requires IAM permissions for the client.
• An Application Load Balancer in front of Lambda exposes it as an HTTP endpoint.
• API Gateway: a serverless offering to create REST APIs that are public and accessible to clients. The client talks to API Gateway, which proxies the request to Lambda.

API Gateway gives more than an HTTP endpoint: authentication, usage plans, development stages and more. API Gateway plus 02-AWS-Lambda is a full serverless application with no infrastructure to manage.

Features

• Support for the WebSocket protocol (real-time streaming).
• API versioning (v1, v2, v3 without breaking clients).
• Multiple environments (dev, test, prod).
• Security: many ways for authentication and authorization.
• API keys and request throttling for clients making too many requests.
• Swagger / Open API 3.0 import and export of API definitions.
• Transform and validate requests and responses.
• Generate SDK and API specifications.
• Cache API responses.

Integrations

Example: API Gateway with Kinesis Data Streams

Clients send HTTP requests to API Gateway, which is configured to send messages into Kinesis Data Streams securely, without giving clients AWS credentials and without managing servers. From there, records can go to Kinesis Data Firehose and into an S3 bucket in JSON format.

Endpoint Types

Security

• ACM certificate for an Edge-Optimized endpoint must be in us-east-1.
• For a Regional endpoint the certificate must be in the same region as the API Gateway stage.
• Set up a CNAME or A-alias record in Route 53 pointing to the API Gateway.

Hands-On Walkthrough

Create a REST API

1. Open the API Gateway console. API types: HTTP API, WebSocket API, REST API (public or private). Only REST API is used here (try the new console).
2. Choose REST API -> Build. Options: create new, import from an Open API definition file, clone an existing API, or the example API.
3. New API named MyFirstAPI. Endpoint type options: Regional, Edge-optimized, Private. Choose Regional. Click Create API.

Create a Lambda function

1. In Lambda create api-gateway-route-gets with a Python runtime (Python 3.11, any Python 3 works).
2. Paste the code from lambda-code.py: it returns statusCode 200, headers with Content-Type: application/json, and a body of json.dumps "Hello from Lambda".
3. Click Deploy. Test with an event DemoTest: result is "hello from Lambda" with status 200.

Create the GET method

1. In the API click Create method, type GET.
2. Integration types (five): Lambda function, HTTP, Mock, AWS service (any service in any region), VPC link. Choose Lambda function.
3. Paste the function ARN and enable Lambda proxy integration (full request passed to Lambda and the response sent back).
4. Timeout: Lambda can run 5 or 15 minutes, but API Gateway has a limited timeout. Default is 29 seconds. It can be customized to less than 29 seconds. For Regional and private REST APIs it can also be raised above 29 seconds through a Service Quotas request; edge-optimized APIs cannot.

5. Click Create method. API Gateway is automatically granted the right to invoke the function. Verify in Lambda -> Configuration -> Permissions -> resource-based policy statement: the API Gateway is allowed to invoke the function if the source API is the one for route GET.
6. Method execution shows: method request, Lambda integration request (proxy), integration response (API Gateway parses what Lambda sends) and method response (application/json).
7. Use the Test tab (optional query strings and headers). Result: status 200, body "hello from Lambda", header content type JSON. The execution log is shown, useful for debugging.

Debug the event

• Add print(event) in the function, deploy, test again, then check CloudWatch Logs (Monitoring -> latest log stream).
• The event includes the resource (/), path (/), method (GET), headers, query string parameters and more. Lambda can use this to forge a response.

Add a /houses resource

1. Create resource houses, then a GET method with Lambda proxy integration.
2. Create a second function (Python) with the body changed to "hello from my pretty house", deploy, paste its ARN.
3. Test: 200 "hello from my pretty house". Now / and /houses invoke two different Lambda functions.

Deploy to a stage

1. Click Deploy API, choose New stage named dev.
2. Copy the invoke URL into a browser. /dev returns "hello from Lambda", /dev/houses returns "hello from my pretty house".
3. A wrong path such as /wrong returns the error "message missing authentication token".

Questions & Answers