Designing APIs on AWS

1. Designing APIs on AWS

Cloud-native applications commonly expose functionality through APIs. In this chapter we are going to explore how to design, build, and deploy APIs on AWS.

2. API Gateway

Amazon API Gateway is a managed service for building APIs on AWS. It makes it easy for you to design, deploy, manage, and secure your APIs.

3. Amazon API Gateway capabilities

Developers use API Gateway to implement different types of API.

4. Amazon API Gateway capabilities

Direct requests to backend functionality.

5. Amazon API Gateway capabilities

Control and secure API access.

6. Amazon API Gateway capabilities

Protect backend services from excessive traffic (throttle requests).

7. Amazon API Gateway capabilities

Transform payloads (request and/or responses).

8. Amazon API Gateway capabilities

Publish APIs for consumers.

9. Amazon API Gateway capabilities

Provide API lifecycle support (versioning, deployment, alias).

10. API types

API Gateway supports three API types: REST, HTTP, and WebSockets.

11. API Gateway endpoints

Amazon API Gateway supports different endpoint types that control how APIs are exposed to clients. Edge-Optimized Endpoints use an AWS-managed CloudFront distribution to reduce latency for globally distributed users. Regional Endpoints are deployed directly into a specific AWS Region and are commonly used with custom CloudFront distributions. Private Endpoints are only accessible from within a VPC using AWS PrivateLink and are commonly used for internal enterprise services. Private APIs are not publicly accessible over the internet.

12. REST APIs

REST APIs provide the most feature-rich API Gateway offering, built on a synchronous request/response model.

13. REST API use cases

Common use cases include Enterprise APIs requiring full life-cycle management, APIs needing advanced security controls,third-party developer ecosystems using API keys and usage plans, and APIs requiring direct AWS service integrations without Lambda.

14. API Gateway REST API support

REST APIs key features include request validation, API keys, usage plans and throttling, Response caching (configurable TTL and cache keys), advanced request/response transformation via VTL mapping templates, IAM authentication (Signature V4), and Lambda authorizers using Cognito user pools.

15. API Gateway REST API support

REST APIs support three endpoint types: Edge-optimized, Regional, and Private. Additional features include AWS WAF integration for web exploit protection, canary release deployments, AWS X-Ray tracing and CloudWatch access and execution logging.

16. REST APIs trade-offs

However, they are typically more expensive and have slightly higher latency than HTTP APIs.

17. HTTP APIs

HTTP APIs are optimized for performance and cost over feature breadth.

18. HTTP API use cases

Common use cases for HTTP APIs include Serverless workloads and Lambda-backed APIs, microservices and lightweight proxy APIs, latency-sensitive applications, and APIs that use OAuth 2.0 / OIDC authentication.

19. API Gateway HTTP API support

HTTP APIs features include Lambda proxy integrations and Lambda authorizers, native JWT/OIDC authorization (Cognito, Auth0, Okta), built-in CORS configuration at the API level, private VPC integrations via VPC Link, and basic parameter mapping (rewrite headers, query strings, and paths).

20. HTTP API trade-offs

HTTP APIs do NOT support the following: API keys or usage plans, request validation, response caching, tracing requests with AWS X-Ray, transforming payloads with VTL mapping templates. They only support regional endpoints.

21. WebSocket APIs

WebSocket APIs support two-way communication between clients and servers. Unlike REST and HTTP APIs, WebSocket connections remain open, allowing servers to push data to connected clients.

22. WebSocket API use cases

Common use cases include chat applications, real-time notifications or real-time dashboards.

23. API Gateway WebSocket API support

Websocket APIs support data transformations of your payloads, request validations. WebSocket APIs defines specific routes on API Gateway. $connect is invoked when a client first establishes a WebSocket connection. $disconnect is invoked when a client disconnects from the WebSocket API, and $default handles messages that do not match a specific route.

24. API caching

Amazon API Gateway can cache API responses to reduce backend load and improve performance. Caching is typically used for frequently requested data, read-heavy APIs, and/or reducing Lambda invocations.

25. API caching

Cached responses automatically expire after a configurable time-to-live (TTL). Important considerations: stale data may be returned until the cache expires or is flushed.

26. API design best practices: use clear resource naming

API paths should represent resources rather than actions. Use nouns rather than verbs where possible. A Good example would be orders. Avoid something like getOrder.

27. API design best practices: version APIs

Versioning allows developers to evolve APIs safely over time. Versioning prevents breaking changes from affecting existing clients. Common approaches include URI Versioning, for example v1/orders, or using query parameters like /orders?version=1, or using HTTP headers, for example `Header: Accept-Version: v1`.

28. API developer portals

Amazon API Gateway provides portal capabilities that allow organizations to publish and share REST APIs and associated documentation with API consumers. Portals provide features such as API documentation, on-boarding guidance, SDK downloads, and API key registration and subscription workflows.

29. OpenAPI specifications

OpenAPI (Swagger) is a standard format used to describe RESTful APIs. API Gateway can import and export OpenAPI specifications.

30. Let's practice!

Now let's practice what we've learned about APIs on AWS.

Create Your Free Account

By continuing, you accept our Terms of Use, our Privacy Policy and that your data is stored in the USA.