When to choose:
Simpler, faster, less costing Restful API (than REST API)
Less features (caching, body transformation & validation, edge optimised)
Always better to start with (than REST)
Route = method + resource path -> integration target
Method: GET POST.... ANY
Resource path:
notmal: /some/path
path variable: /pets/{id}
greedy path variable (catches all child resources), put "+" at end: /some/greedy/{proxy+}
$default: catch everything else
name
Identity source: default $request.header.Authorization
Issurer URL (in "issuer" field of authorization server's well-known metadata endpoint)
Audience: client ID registered with ID provider, or any string in JWT audience claim for authorizer to verify
Provides: name, region, lambda (arn), payload format version (2.0), response mode, caching, ID source
Response mode (https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-lambda-authorizer.html#http-api-lambda-authorizer.payload-format-response):
simple - boolean + optional context (can be passed to lambda integration)
IAM policy - principalId + policyDocument + context
Client must use Signature Version 4 to sign requests with AWS credentials
Lambda, HTTP, AWS Service (first class integration), private
Supports: multiple integration targets (multiple lambdas & HTTP mixed)
provides: region, ARN, payload-format-version (2.0 recommended)
INFO {
version: '2.0',
routeKey: 'GET /test-delete-func',
rawPath: '/test-delete-func',
rawQueryString: '',
headers: {
accept: '*/*',
'content-length': '0',
host: 'yac57a0ox8.execute-api.us-west-2.amazonaws.com',
'user-agent': 'curl/7.68.0',
'x-amzn-trace-id': 'Root=1-60d95f51-367c1b6118fac4255741ff13',
'x-forwarded-for': '49.199.220.23',
'x-forwarded-port': '443',
'x-forwarded-proto': 'https'
},
requestContext: {
accountId: '482175935212',
apiId: 'yac57a0ox8',
domainName: 'yac57a0ox8.execute-api.us-west-2.amazonaws.com',
domainPrefix: 'yac57a0ox8',
http: {
method: 'GET',
path: '/test-delete-func',
protocol: 'HTTP/1.1',
sourceIp: '49.199.220.23',
userAgent: 'curl/7.68.0'
},
requestId: 'BnvUvg33PHcEPyw=',
routeKey: 'GET /test-delete-func',
stage: '$default',
time: '28/Jun/2021:05:34:09 +0000',
timeEpoch: 1624858449334
},
isBase64Encoded: false
}
Parameters:
header.<header_name>
querystring.<querystring_name>
path
Modifications: overwrite, append, remove
Value (modify with):
header, querystring, path, path.part, body, body.json_path, stageVariable, context value, static value
match status code first
parameter to modify: header, status code
modifications: overwrite, append, remove (status code: overwrite only)
values: similar
"Configuration environments" API deploy to (prod, staging, etc.)
Must deploy to a stage for API configuration changes to take effect (unless stage configured autodeploy)
Through console - default stage $default (auto-deploy)
name
automatic deployment:
Enabled: automatically updates with latest route configuration
Disabled: must attach deployment
Stage Variables:
key/value pairs
Tags
stage nane is added to URL ($default be just root)
stage variable can be used:
in lambda function integration, to choose different lambda function (or different version / aliases) in different stage: ${stageVariables.lbfunc}
can be passed into lambda use parameter mapping
See:
Stages
CORS
Work with custom domain names
Access-Control-Allow-Origin
Access-Control-Allow-Headers
Access-Control-Allow-Methods
Access-Control-Expose-Headers
Access-Control-Max-Age
Access-Control-Allow-Credentials
Throttling:
route level: need to use CLI or SDK, not from web console (yet)
default route throttling: burst / rate limit
account throttling (for all APIs): burst / rate limit
Mutual TLS:
Client must present certificate as well
Metrics
Logging