backend / cloud aws / networking and content delivery / README.md

Amazon API Gateway

7 min read index source

Amazon API Gateway

Overview

Amazon API Gateway is a fully managed service that makes it easy for developers to create, publish, maintain, monitor, and secure APIs at any scale. It handles all the tasks involved in accepting and processing up to hundreds of thousands of concurrent API calls, including traffic management, authorization and access control, monitoring, and API version management.

Key Features

  • RESTful APIs: Create RESTful APIs with HTTP endpoints
  • WebSocket APIs: Build real-time two-way communication applications
  • HTTP APIs: Lightweight, low-latency HTTP APIs
  • API Management: Versioning, deployment, and lifecycle management
  • Security: Built-in authorization and access control
  • Monitoring: CloudWatch integration for metrics and logging
  • Caching: Reduce latency and improve performance
  • Throttling: Control API usage and prevent abuse

Interview Topics

1. API Gateway Types

  • REST APIs: Traditional RESTful APIs with full control
  • HTTP APIs: Optimized for HTTP APIs with lower cost
  • WebSocket APIs: Real-time bidirectional communication
  • Private APIs: VPC-only access for internal services

2. API Gateway Components

  • Resources: Logical entities that represent API objects
  • Methods: HTTP verbs (GET, POST, PUT, DELETE)
  • Integration: Backend service connections (Lambda, HTTP, VPC)
  • Stages: Deployment environments (dev, staging, prod)
  • Models: Request/response schemas and validation

3. Integration Types

  • Lambda Integration: Serverless function integration
  • HTTP Integration: External HTTP endpoints
  • VPC Link: Private VPC resource integration
  • Mock Integration: Test responses without backend
  • AWS Service Integration: Direct AWS service integration

4. Security and Authorization

  • IAM Authorization: AWS IAM-based access control
  • Lambda Authorizer: Custom authorization logic
  • Cognito User Pools: User authentication and authorization
  • API Keys: Simple access control
  • Resource Policies: Fine-grained access control

5. Request/Response Processing

  • Request Mapping: Transform incoming requests
  • Response Mapping: Transform backend responses
  • Integration Request: Backend request formatting
  • Integration Response: Backend response processing
  • Error Handling: Custom error responses

Common Interview Questions

Basic Questions

  1. What is Amazon API Gateway and when would you use it?

    • Fully managed API management service
    • Use for creating, publishing, and managing APIs
    • Handles traffic management, security, and monitoring
    • Ideal for microservices and serverless architectures

  2. What are the different types of APIs you can create with API Gateway?

    • REST APIs: Full-featured RESTful APIs
    • HTTP APIs: Optimized for HTTP with lower cost
    • WebSocket APIs: Real-time bidirectional communication
    • Private APIs: VPC-only access

  3. How do you create an API Gateway?

    aws apigateway create-rest-api \
  --name "MyAPI" \
  --description "My REST API"

Advanced Questions

  1. How do you integrate API Gateway with Lambda?

    Resources:
  MyApi:
    Type: AWS::ApiGateway::RestApi
    Properties:
      Name: MyAPI
  
  MyResource:
    Type: AWS::ApiGateway::Resource
    Properties:
      RestApiId: !Ref MyApi
      ParentId: !GetAtt MyApi.RootResourceId
      PathPart: "items"
  
  MyMethod:
    Type: AWS::ApiGateway::Method
    Properties:
      RestApiId: !Ref MyApi
      ResourceId: !Ref MyResource
      HttpMethod: GET
      AuthorizationType: NONE
      Integration:
        Type: AWS_PROXY
        IntegrationHttpMethod: POST
        Uri: !Sub "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${MyLambdaFunction.Arn}/invocations"

  2. What are Lambda Authorizers and how do you implement them?

    • Custom authorization functions
    • Validate tokens and return IAM policies
    • Support for JWT, OAuth, and custom tokens
    • Caching for performance optimization

  3. How do you handle CORS in API Gateway?

    • Configure CORS headers in method responses
    • Set up preflight OPTIONS method
    • Handle different origins and methods
    • Implement proper error handling

Troubleshooting Questions

  1. What if API Gateway requests are timing out?

    • Check Lambda function timeout settings
    • Verify integration timeout configuration
    • Monitor backend service performance
    • Implement proper error handling

  2. How do you handle API versioning?

    • Use stages for version management
    • Implement semantic versioning
    • Use base path mappings
    • Maintain backward compatibility

Best Practices

1. API Design

  • Use RESTful conventions
  • Implement proper HTTP status codes
  • Design consistent response formats
  • Use meaningful resource names

2. Security

  • Implement proper authorization
  • Use HTTPS for all endpoints
  • Validate input data
  • Implement rate limiting

3. Performance

  • Enable caching where appropriate
  • Use compression for responses
  • Optimize integration timeouts
  • Monitor and optimize latency

4. Monitoring

  • Set up CloudWatch metrics
  • Implement proper logging
  • Monitor error rates
  • Track API usage patterns

5. Cost Optimization

  • Choose appropriate API type
  • Optimize caching strategies
  • Monitor usage patterns
  • Use reserved capacity where possible

Use Cases

1. Microservices Architecture

  • API aggregation and composition
  • Service discovery and routing
  • Centralized authentication
  • Request/response transformation

2. Mobile Applications

  • Backend API for mobile apps
  • User authentication and authorization
  • Real-time communication
  • Content delivery optimization

3. Serverless Applications

  • Lambda function integration
  • Event-driven architectures
  • Real-time data processing
  • WebSocket communication

4. Third-party Integrations

  • External API management
  • Data transformation
  • Security and access control
  • Rate limiting and throttling

Integration Patterns

1. Lambda Integration

  • Serverless backend processing
  • Event-driven architectures
  • Real-time data processing
  • Microservices implementation

2. HTTP Integration

  • External service integration
  • Legacy system integration
  • Third-party API management
  • Data transformation

3. VPC Integration

  • Private resource access
  • Database connectivity
  • Internal service communication
  • Hybrid cloud architectures

4. AWS Service Integration

  • Direct AWS service access
  • S3 integration for file operations
  • DynamoDB integration for data access
  • SQS/SNS integration for messaging

Security Considerations

1. Authentication

  • Implement proper authentication
  • Use IAM roles and policies
  • Support multiple auth methods
  • Secure token handling

2. Authorization

  • Implement fine-grained access control
  • Use resource policies
  • Validate user permissions
  • Audit access patterns

3. Data Protection

  • Encrypt data in transit
  • Validate input data
  • Implement proper error handling
  • Monitor for security threats

4. Compliance

  • Maintain audit trails
  • Implement data retention policies
  • Ensure regulatory compliance
  • Regular security assessments

Cost Optimization

1. API Type Selection

  • Use HTTP APIs for simple use cases
  • Choose REST APIs for complex requirements
  • Optimize WebSocket usage
  • Monitor API costs

2. Caching Strategy

  • Implement appropriate caching
  • Use CloudFront for global caching
  • Optimize cache hit rates
  • Monitor cache performance

3. Usage Optimization

  • Implement rate limiting
  • Monitor API usage patterns
  • Optimize request/response sizes
  • Use compression where appropriate

4. Integration Optimization

  • Optimize Lambda function execution
  • Use appropriate timeouts
  • Implement efficient data processing
  • Monitor integration costs

Performance Optimization

1. Latency Optimization

  • Enable caching at multiple levels
  • Use CloudFront for global distribution
  • Optimize integration timeouts
  • Implement connection pooling

2. Throughput Optimization

  • Implement proper throttling
  • Use appropriate instance types
  • Optimize request processing
  • Monitor performance metrics

3. Scalability

  • Design for horizontal scaling
  • Implement auto-scaling
  • Use appropriate capacity planning
  • Monitor scaling patterns

4. Reliability

  • Implement proper error handling
  • Use circuit breakers
  • Monitor service health
  • Implement fallback mechanisms

Disaster Recovery

1. Backup Strategies

  • Backup API configurations
  • Maintain deployment history
  • Document recovery procedures
  • Test recovery processes

2. Multi-Region Deployment

  • Deploy APIs across regions
  • Implement failover procedures
  • Use Route 53 for traffic routing
  • Monitor regional health

3. Data Recovery

  • Implement data backup strategies
  • Use cross-region replication
  • Maintain data consistency
  • Test recovery procedures

4. Service Continuity

  • Implement health checks
  • Use circuit breakers
  • Monitor service availability
  • Implement alerting

Migration Strategies

1. From Traditional APIs

  • Map existing endpoints
  • Implement equivalent functionality
  • Migrate authentication systems
  • Test thoroughly

2. From Other API Management Tools

  • Map API specifications
  • Implement equivalent features
  • Migrate security configurations
  • Validate functionality

3. Application Modernization

  • Implement microservices patterns
  • Use serverless architectures
  • Optimize for cloud-native features
  • Implement proper monitoring

Common Pitfalls

1. Security Issues

  • Inadequate authentication
  • Poor authorization implementation
  • Exposed sensitive data
  • Insufficient input validation

2. Performance Problems

  • Inadequate caching
  • Poor integration design
  • Insufficient monitoring
  • Inefficient data processing

3. Cost Management

  • Over-provisioning resources
  • Inefficient caching strategies
  • Poor usage monitoring
  • Inadequate cost optimization

4. Operational Issues

  • Poor error handling
  • Inadequate monitoring
  • Insufficient logging
  • Poor documentation

Resources

Interview angle

  • “HTTP API or REST API?” - HTTP API is cheaper, lower latency and the default for new work. REST API when you need what it uniquely offers: request or response transformation, API keys with usage plans, WAF integration, private endpoints, or caching.
  • “API Gateway or an Application Load Balancer in front of a container?” - API Gateway for per-route authorisation, throttling, usage plans and Lambda integration. ALB when you already run containers and want a cheaper path with fewer per-request features. At high sustained volume, API Gateway’s per-request price becomes the deciding factor.
  • “What are the limits that bite?” - the 29-second integration timeout, and payload size caps. Anything longer needs an async pattern: accept the request, return 202 with a job id, and let the client poll or receive a webhook.
  • “How do you authorise?” - a Lambda authoriser for custom logic, a JWT authoriser for OIDC tokens, or IAM auth for service-to-service. Cache authoriser results, or you pay the authorisation latency on every request.
  • “How do you protect the backend from a traffic spike?” - throttling and usage plans at the gateway, so the limit is enforced before your compute scales. This is the bulkhead argument applied at the edge. See ../../../../system_design/02_resilience/02_circuit_breakers_and_bulkheads.md.