API Gateway and Serverless APIs

AWS Cloud & DevOps Engineering · Lesson 15 · AWS Application Platform

Lesson Overview

TechLearningPro often needs a first-class HTTP API for mobile clients, partner webhooks, and lightweight progress endpoints that do not justify managing a full ALB+ASG continuum. Amazon API Gateway provides managed REST and HTTP APIs with routing, throttling, authorization integrations, stages, and—commonly—Lambda proxy integration. Lesson 14 built solid functions; this lesson puts a governed front door in front of them, and compares when ALB from Elastic Load Balancing and Route 53 remains the better edge for container/EC2 fleets.

You will explore REST versus HTTP APIs at a practical selection level, authorizers, usage plans/API keys where appropriate, stage variables, mapping/proxy patterns, CORS for browser players, and error response discipline—without inventing Gateway features or fake throttle quotas. Budgets and cleanup remain mandatory: API Gateway and its companion logs can outlive the lab if forgotten.

Learning Objectives

By the end of this lesson you will be able to:

1. Explain the problem this capability solves for TechLearningPro’s progress platform and Monday board.
2. Define core terminology accurately and map it to AWS service boundaries.
3. Compare major implementation options and justify a default choice for common workloads.
4. Design identity (IAM) interactions with least privilege and no embedded secrets.
5. Design network exposure intentionally, building on Module 1 VPC and security group habits.
6. Configure reliability mechanisms: health, retries, timeouts, or equivalent failure controls.
7. Configure basic observability: logs/metrics signals you will deepen in Module 4.
8. Identify primary cost drivers and verify them on current public pricing pages.
9. Apply the capability in a realistic lab with success and failure path tests.
10. Recognize at least five anti-patterns that cause outages, leaks, or surprise bills.
11. Troubleshoot with a sequenced diagnostic checklist rather than random console clicking.
12. Write a short ADR for a controversial design fork.
13. Cross-link prior lessons (IAM, VPC, ELB/CloudFront/Lambda as relevant) and next lessons.
14. Complete cleanup with tags and budgets still enabled.
15. Answer interview questions with evidence-oriented stories, not certification claims.

Prerequisites

• Module 1 foundations: accounts, IAM, CLI, VPC, security groups, EC2/ASG awareness, S3, data stores, Well-Architected/cost habits.
• Earlier Module 2 lessons as linked in the overview.
• Sandbox AWS account with an active budget alert before creating billable resources.
• Willingness to delete lab resources the same day evidence is captured.
• For container topics: willingness to use local Docker tooling or Cloud shell alternatives without copying an entire second course—see /learn/docker for deeper Docker-only learning.

Detailed Core Concepts

REST API vs HTTP API

API Gateway offers REST APIs (feature-rich, broader integration and governance features historically) and HTTP APIs (simpler, often lower cost/latency for common Lambda/JWT use cases). Exact feature deltas evolve—consult the current AWS comparison documentation when choosing. For many TechLearningPro serverless microservice endpoints, HTTP APIs with JWT authorizers or Lambda authorizers are enough. Choose REST when you need specific REST-only capabilities your design requires after verification.

Resources, methods, integrations

Define routes such as POST /progress and GET /progress/{id}. Integrations commonly target Lambda, HTTP endpoints, or AWS services. Lambda proxy integration passes the HTTP request as an event and expects a structured statusCode/headers/body response—reducing mapping template complexity. Non-proxy mappings exist but add maintenance cost; prefer proxy unless you must transform.

Stages and deployments

Stages (dev, staging, prod) publish snapshots of the API configuration. Deploy explicitly; do not assume console edits are live. Stage variables can parameterize integrations carefully—avoid stuffing secrets into stage variables; use Secrets Manager patterns later.

Authorization

Options include IAM authorization, Cognito user pool authorizers, JWT authorizers on HTTP APIs, Lambda authorizers for custom policy logic, and none (public)—public only for truly public endpoints. TechLearningPro progress reads/writes need authz tied to learner identity. API keys and usage plans throttle partners; API keys are not a strong authentication story for people—treat them as identifier/throttle tools for external systems.

Throttling and quotas

Account and stage/method throttles protect backends. Exact defaults and burst behaviors are documented and may be account-specific—look up Service Quotas and API Gateway throttle settings rather than inventing RPS numbers. Coordinate reserved Lambda concurrency so Gateway accepts traffic your functions can process, or return controlled 429s.

CORS

Browser lesson players on another origin need CORS configuration on the API. Misconfigured CORS presents as browser failures while curl succeeds—test with the real Origin header.

Custom domains and TLS

Attach custom domain names with ACM certificates (Region rules differ—verify). Route 53 alias to the API Gateway domain. Align with CloudFront if you place Gateway behind CloudFront for WAF/edge—supported patterns exist; do not invent them without docs.

Access logging and execution logging

Enable access logs to CloudWatch/Logs or supported destinations for audit. Avoid logging authorization headers and payloads with PII. Execution logging verbosity differs by API type—use carefully in prod.

Cost dimensions

Charges typically involve API calls and data transfer, with differences between REST and HTTP APIs—check current pricing. Caching (where available on REST) adds dimensions and must not cache private progress responses.

Architecture and Design Diagrams

mermaidCopy
flowchart TB
  Client["Mobile / web player"]
  APIGW["API Gateway HTTP/REST API
auth + throttle + stage"]
  Auth["JWT / Lambda authorizer"]
  Fn["Lambda progress handlers"]
  DB["DynamoDB / RDS via VPC if needed"]
  Client --> APIGW --> Auth
  APIGW --> Fn --> DB

textCopy
Route 53 alias → API custom domain → stage → route → Lambda proxy → data store
429 if throttled; 401/403 if authorizer denies; 502 if Lambda errors poorly handled

Technical Explanation

Request path

Client calls HTTPS method on custom domain. TLS terminates at API Gateway. Authorizer runs when configured. If allowed, integration invokes Lambda synchronously. Lambda returns proxy response. Gateway maps to HTTP response. Throttling may reject before invoke. Timeouts are bounded—long work should be async (202 + worker) rather than stretching synchronous Gateway+Lambda to the limit.

Error mapping

Unhandled Lambda errors become 502 from the client perspective if not formatted. Return explicit 4xx for client mistakes with stable error codes the player understands. Do not leak stack traces to learners.

Idempotency for POST progress

Clients retry. Use idempotency keys stored in DynamoDB conditional writes. Authorizer identity + key scopes the write.

Comparing ALB+ECS vs API Gateway+Lambda

Steady high-throughput HTTP with complex routing and long-lived connections may favor ALB+ECS. Spiky, infrequent, many small endpoints may favor Gateway+Lambda. Mixed platforms are normal: board via ALB, partner webhook via Gateway.

Practical Implementation or Design Walkthrough

Problem

Create an HTTP API (preferred for lab simplicity unless you need REST features) with a Lambda integration for GET /health and POST /progress (in-memory or DynamoDB stub), add an authorizer or IAM auth for the progress route, configure throttling at a low lab value to demonstrate 429, test CORS preflight if applicable, then clean up.

Steps

1. Budget on; tags Project=tlp-lesson15.
2. Reuse or create a small Lambda from lesson 14 patterns returning proxy JSON.
3. Create API; add routes; grant API Gateway invoke permission on Lambda.
4. Protect POST /progress with JWT/Lambda authorizer or temporary IAM auth for lab—document the choice. Keep /health public if desired.
5. Deploy to stage lab.
6. Success: authorized POST returns 200; GET health 200.
7. Failures: (a) missing/invalid auth → 401/403; (b) throttle by flooding within lab ethics → 429; (c) Lambda throw → controlled 5xx without stack trace leak.
8. Cleanup: delete API, stages, custom domains, log groups, functions, authorizers, unused certs.

Enterprise Real-World Scenarios

TechLearningPro: API keys mistaken for user auth

Partners shared keys in mobile builds; scrapers wrote fake progress. Fix: real user authz; keys only for server-to-server with rotation; WAF later.

Caching private responses on REST cache

Enabled Gateway cache for “speed”; cross-user bleed risk. Fix: never cache authenticated progress; disable method cache.

Throttle mis-set to near zero in prod deploy

Stage variable mistake caused global 429 during launch. Fix: deployment checklist; synthetic canary; rollback stage deployment.

Lambda timeout longer than Gateway timeout

Clients saw failures while Lambda still ran side effects twice. Fix: align timeouts; make side effects idempotent; prefer async for long tasks.

Best Practices

• Start from least privilege and private-by-default networking.
• Prefer managed integrations documented by AWS over homemade credential distribution.
• Make failure visible: health checks, DLQs, alarms hooks, or equivalent.
• Tag every billable resource with Project, Owner, Environment.
• Budget before create; cleanup after evidence.
• Measure performance before changing five knobs at once.
• Keep secrets out of source, images, user data, and screenshots.
• Document retry/idempotency behavior for any at-least-once path.
• Use current official documentation for quotas, regional availability, and API syntax.
• Prefer immutable versioned artifacts (AMIs, images, function versions, hashed assets).
• Separate blast radiuses: batch versus interactive; staging versus prod.
• Align TLS and DNS names with learner-facing hostnames.
• Refuse Classic/legacy defaults for new designs when modern successors exist.
• Connect changes to Monday board impact in the ADR.
• Keep Module 4 observability backlog explicit when you only enable basic logs now.

Common Mistakes and Anti-Patterns

World-open security groups or public buckets “for debugging.” Symptom: scanners and leaks. Fix: lock down immediately; use SSM and private patterns.

Admin-equivalent roles on compute. Symptom: ransomware-scale blast radius. Fix: scope actions and resources; remove wildcards.

No failure path testing. Symptom: first production failure is silent. Fix: two negative tests in every lab.

Invented quotas, flags, or prices. Symptom: designs that cannot be built or finance fiction. Fix: cite live docs/pricing with date.

Skipping budgets and cleanup. Symptom: Cost Explorer surprises. Fix: rubric fails without cleanup evidence.

Caching or logging personalized progress unsafely. Symptom: privacy incidents. Fix: no shared cache of private API data; redact logs.

Pet DNS or pet instances instead of stable edges and cattle. Symptom: replace breaks learners. Fix: ALB/CloudFront/ASG/ECS services patterns.

Blocking on long synchronous work inside short-timeout facades. Symptom: 504s and storms. Fix: async redesign.

Mixing sticky in-memory sessions with Multi-AZ replaceability. Symptom: AZ loss logs users out incorrectly. Fix: externalize state.

Copying outdated blog IP allowlists or deprecated runtimes. Symptom: outages and blocked deploys. Fix: current managed prefix lists/docs; supported runtimes only.

Troubleshooting and Design Review

Work top-down: DNS → TLS → edge/API permissions → compute identity → network path → application logs → data store. Record request IDs. Confirm you are in the intended Region and account. Confirm tags match the workload you think you are debugging. For permission failures, distinguish caller identity versus resource policy. For timeouts, distinguish client, edge, compute, and dependency timeouts. For throttling, check service quotas and account-level concurrency. For intermittent faults, consider multi-AZ imbalance, cold starts, or dependency rate limits.

Design review exit criteria for this lesson: diagram; IAM summary; network summary; success evidence; two failure evidences; cost dimension list without fake rates; budget proof; cleanup proof; ADR for one decision; explicit list of items deferred to later lessons (WAF, full IaC, advanced observability).

Interview Questions and Answers

Q1. What problem does API Gateway solve for a learning platform?
It provides a managed building block so TechLearningPro can deliver secure, scalable learner experiences without reinventing undifferentiated infrastructure—while still requiring good IAM, networking, and operations.

Q2. What are the main alternatives?
Often ALB+EC2/ECS versus API Gateway+Lambda versus CloudFront+S3 for bytes—selection depends on protocol, lifecycle, and state. State the trade-offs rather than a single “best.”

Q3. Which identity permissions are required at minimum?
Execution/task roles for AWS API access; invoke/resource policies for event sources; human access via Identity Center least privilege—not long-lived keys in code.

Q4. What fails first under load?
Dependencies (DB connection pools), concurrency throttles, or upstream rate limits—measure rather than guess.

Q5. How do you detect failure?
Health checks, error metrics, throttles, DLQ depth, synthetic probes against /health or critical API paths.

Q6. How do you make it safer?
Private networking, least privilege, encryption, no secrets in artifacts, authz before expensive work.

Q7. How do you make it more reliable?
Multi-AZ targets/tasks, retries with idempotency, timeouts, capacity floors, tested restore/deploy rollback.

Q8. How do you control cost?
Tags, budgets, delete idle, right-size memory/CPU, cache bytes at CDN, avoid NAT when endpoints suffice—verify pricing dimensions live.

Q9. What would you refuse to do in a sandbox?
Buy long commitments, open public data stores, disable budgets, invent features for homework flair.

Q10. How does this connect to Well-Architected?
Map controls to security, reliability, performance, cost, ops, sustainability with evidence.

Q11. What belongs in a later lesson?
Deep WAF, org SCPs, full CI/CD, mesh networking—name them rather than half-implementing.

Q12. Does this course certify you as an AWS Solutions Architect?
No. It builds engineering practice and portfolio evidence without certification claims.

Hands-On Exercises

Budget alert and cleanup (required)

Confirm AWS Budgets (or equivalent) before creating resources. Tag Project=tlp-lesson15. After evidence: delete lab resources in dependency order; recheck tagged inventory across Regions you used; leave budgets enabled; note residual storage that billing may still show temporarily.

Primary exercise

Implement the practical walkthrough above for API Gateway. Capture architecture notes, success test, two failure tests, and cleanup.

Challenge

Extend with a production constraint (stricter authz, lower budget, multi-account boundary on paper, or higher traffic). Write a one-page ADR explaining what you changed and what you refused to hand-wave.

Expansion block 1: API Gateway in the TechLearningPro progress platform

Operators responsible for Monday’s board treat API Gateway as part of a larger reliability story rather than a standalone lab toy. Before enabling traffic, they write the failure mode in one sentence: what the learner sees, what the teacher sees, and what the on-call engineer sees. They define which metrics prove health and which logs are permitted to contain curriculum metadata versus forbidden raw assessment answers. They confirm IAM roles follow least privilege with resource ARNs scoped to tlp-* prefixes where possible. They confirm network exposure is intentional: no public open management ports, no world-writable buckets, no secrets in deployment artifacts. They confirm a budget alert is active and that Cost Explorer can filter this workload by tags after billing delay. They schedule cleanup or transfer ownership with an expiry tag.

Design discussions for API Gateway should compare alternatives honestly. Sometimes EC2 or ECS is clearer for long-lived WebSocket lesson rooms; sometimes Lambda is clearer for bursty upload processing; sometimes API Gateway is unnecessary if ALB already exposes the fleet; sometimes CloudFront should serve bytes that developers mistakenly wanted to stream from compute. Choosing the smaller blast radius usually beats choosing the newest service name. When unsure, prototype in sandbox with budgets, measure, then write an ADR.

Implementation hygiene for API Gateway includes reproducible builds, pinned runtime or base image versions that are currently supported, automated tests for the success path and at least two failure paths, and evidence captured for homework or change tickets. Avoid relying on click-ops alone for anything you will need to recreate after an account scrub. Module 3 will industrialize IaC; Module 2 still expects you to document every console click you cannot yet express as code.

Security reviews ask whether authorization happens before expensive work, whether tenancy isolation holds under retries, whether signing keys or tokens can leak via logs, and whether destructive IAM actions are constrained. Reliability reviews ask about timeouts, retries, idempotency, multi-AZ dependencies, and dead-letter paths. Performance reviews ask what the bottleneck is after a simple load test. Cost reviews ask which pricing dimensions dominate and whether idle resources remain. Sustainability reviews ask whether idle capacity or duplicate storage can be removed. These questions are the Well-Architected habit from lesson 11 applied to API Gateway.

If documentation and this lesson ever appear to disagree on a flag name, quota, or regional feature, trust current AWS documentation and note the access date in your deliverable. This course explicitly forbids inventing features to sound advanced. Interview answers that include “I would verify the current quota in Service Quotas” score higher than fabricated precision.

Expansion block 2: API Gateway in the TechLearningPro progress platform

Operators responsible for Monday’s board treat API Gateway as part of a larger reliability story rather than a standalone lab toy. Before enabling traffic, they write the failure mode in one sentence: what the learner sees, what the teacher sees, and what the on-call engineer sees. They define which metrics prove health and which logs are permitted to contain curriculum metadata versus forbidden raw assessment answers. They confirm IAM roles follow least privilege with resource ARNs scoped to tlp-* prefixes where possible. They confirm network exposure is intentional: no public open management ports, no world-writable buckets, no secrets in deployment artifacts. They confirm a budget alert is active and that Cost Explorer can filter this workload by tags after billing delay. They schedule cleanup or transfer ownership with an expiry tag.

Design discussions for API Gateway should compare alternatives honestly. Sometimes EC2 or ECS is clearer for long-lived WebSocket lesson rooms; sometimes Lambda is clearer for bursty upload processing; sometimes API Gateway is unnecessary if ALB already exposes the fleet; sometimes CloudFront should serve bytes that developers mistakenly wanted to stream from compute. Choosing the smaller blast radius usually beats choosing the newest service name. When unsure, prototype in sandbox with budgets, measure, then write an ADR.

Implementation hygiene for API Gateway includes reproducible builds, pinned runtime or base image versions that are currently supported, automated tests for the success path and at least two failure paths, and evidence captured for homework or change tickets. Avoid relying on click-ops alone for anything you will need to recreate after an account scrub. Module 3 will industrialize IaC; Module 2 still expects you to document every console click you cannot yet express as code.

Security reviews ask whether authorization happens before expensive work, whether tenancy isolation holds under retries, whether signing keys or tokens can leak via logs, and whether destructive IAM actions are constrained. Reliability reviews ask about timeouts, retries, idempotency, multi-AZ dependencies, and dead-letter paths. Performance reviews ask what the bottleneck is after a simple load test. Cost reviews ask which pricing dimensions dominate and whether idle resources remain. Sustainability reviews ask whether idle capacity or duplicate storage can be removed. These questions are the Well-Architected habit from lesson 11 applied to API Gateway.

If documentation and this lesson ever appear to disagree on a flag name, quota, or regional feature, trust current AWS documentation and note the access date in your deliverable. This course explicitly forbids inventing features to sound advanced. Interview answers that include “I would verify the current quota in Service Quotas” score higher than fabricated precision.

Expansion block 3: API Gateway in the TechLearningPro progress platform

Operators responsible for Monday’s board treat API Gateway as part of a larger reliability story rather than a standalone lab toy. Before enabling traffic, they write the failure mode in one sentence: what the learner sees, what the teacher sees, and what the on-call engineer sees. They define which metrics prove health and which logs are permitted to contain curriculum metadata versus forbidden raw assessment answers. They confirm IAM roles follow least privilege with resource ARNs scoped to tlp-* prefixes where possible. They confirm network exposure is intentional: no public open management ports, no world-writable buckets, no secrets in deployment artifacts. They confirm a budget alert is active and that Cost Explorer can filter this workload by tags after billing delay. They schedule cleanup or transfer ownership with an expiry tag.

Design discussions for API Gateway should compare alternatives honestly. Sometimes EC2 or ECS is clearer for long-lived WebSocket lesson rooms; sometimes Lambda is clearer for bursty upload processing; sometimes API Gateway is unnecessary if ALB already exposes the fleet; sometimes CloudFront should serve bytes that developers mistakenly wanted to stream from compute. Choosing the smaller blast radius usually beats choosing the newest service name. When unsure, prototype in sandbox with budgets, measure, then write an ADR.

Implementation hygiene for API Gateway includes reproducible builds, pinned runtime or base image versions that are currently supported, automated tests for the success path and at least two failure paths, and evidence captured for homework or change tickets. Avoid relying on click-ops alone for anything you will need to recreate after an account scrub. Module 3 will industrialize IaC; Module 2 still expects you to document every console click you cannot yet express as code.

Security reviews ask whether authorization happens before expensive work, whether tenancy isolation holds under retries, whether signing keys or tokens can leak via logs, and whether destructive IAM actions are constrained. Reliability reviews ask about timeouts, retries, idempotency, multi-AZ dependencies, and dead-letter paths. Performance reviews ask what the bottleneck is after a simple load test. Cost reviews ask which pricing dimensions dominate and whether idle resources remain. Sustainability reviews ask whether idle capacity or duplicate storage can be removed. These questions are the Well-Architected habit from lesson 11 applied to API Gateway.

If documentation and this lesson ever appear to disagree on a flag name, quota, or regional feature, trust current AWS documentation and note the access date in your deliverable. This course explicitly forbids inventing features to sound advanced. Interview answers that include “I would verify the current quota in Service Quotas” score higher than fabricated precision.

Expansion block 4: API Gateway in the TechLearningPro progress platform

Operators responsible for Monday’s board treat API Gateway as part of a larger reliability story rather than a standalone lab toy. Before enabling traffic, they write the failure mode in one sentence: what the learner sees, what the teacher sees, and what the on-call engineer sees. They define which metrics prove health and which logs are permitted to contain curriculum metadata versus forbidden raw assessment answers. They confirm IAM roles follow least privilege with resource ARNs scoped to tlp-* prefixes where possible. They confirm network exposure is intentional: no public open management ports, no world-writable buckets, no secrets in deployment artifacts. They confirm a budget alert is active and that Cost Explorer can filter this workload by tags after billing delay. They schedule cleanup or transfer ownership with an expiry tag.

Design discussions for API Gateway should compare alternatives honestly. Sometimes EC2 or ECS is clearer for long-lived WebSocket lesson rooms; sometimes Lambda is clearer for bursty upload processing; sometimes API Gateway is unnecessary if ALB already exposes the fleet; sometimes CloudFront should serve bytes that developers mistakenly wanted to stream from compute. Choosing the smaller blast radius usually beats choosing the newest service name. When unsure, prototype in sandbox with budgets, measure, then write an ADR.

Implementation hygiene for API Gateway includes reproducible builds, pinned runtime or base image versions that are currently supported, automated tests for the success path and at least two failure paths, and evidence captured for homework or change tickets. Avoid relying on click-ops alone for anything you will need to recreate after an account scrub. Module 3 will industrialize IaC; Module 2 still expects you to document every console click you cannot yet express as code.

Security reviews ask whether authorization happens before expensive work, whether tenancy isolation holds under retries, whether signing keys or tokens can leak via logs, and whether destructive IAM actions are constrained. Reliability reviews ask about timeouts, retries, idempotency, multi-AZ dependencies, and dead-letter paths. Performance reviews ask what the bottleneck is after a simple load test. Cost reviews ask which pricing dimensions dominate and whether idle resources remain. Sustainability reviews ask whether idle capacity or duplicate storage can be removed. These questions are the Well-Architected habit from lesson 11 applied to API Gateway.

If documentation and this lesson ever appear to disagree on a flag name, quota, or regional feature, trust current AWS documentation and note the access date in your deliverable. This course explicitly forbids inventing features to sound advanced. Interview answers that include “I would verify the current quota in Service Quotas” score higher than fabricated precision.

Expansion block 5: API Gateway in the TechLearningPro progress platform

Operators responsible for Monday’s board treat API Gateway as part of a larger reliability story rather than a standalone lab toy. Before enabling traffic, they write the failure mode in one sentence: what the learner sees, what the teacher sees, and what the on-call engineer sees. They define which metrics prove health and which logs are permitted to contain curriculum metadata versus forbidden raw assessment answers. They confirm IAM roles follow least privilege with resource ARNs scoped to tlp-* prefixes where possible. They confirm network exposure is intentional: no public open management ports, no world-writable buckets, no secrets in deployment artifacts. They confirm a budget alert is active and that Cost Explorer can filter this workload by tags after billing delay. They schedule cleanup or transfer ownership with an expiry tag.

Design discussions for API Gateway should compare alternatives honestly. Sometimes EC2 or ECS is clearer for long-lived WebSocket lesson rooms; sometimes Lambda is clearer for bursty upload processing; sometimes API Gateway is unnecessary if ALB already exposes the fleet; sometimes CloudFront should serve bytes that developers mistakenly wanted to stream from compute. Choosing the smaller blast radius usually beats choosing the newest service name. When unsure, prototype in sandbox with budgets, measure, then write an ADR.

Implementation hygiene for API Gateway includes reproducible builds, pinned runtime or base image versions that are currently supported, automated tests for the success path and at least two failure paths, and evidence captured for homework or change tickets. Avoid relying on click-ops alone for anything you will need to recreate after an account scrub. Module 3 will industrialize IaC; Module 2 still expects you to document every console click you cannot yet express as code.

Security reviews ask whether authorization happens before expensive work, whether tenancy isolation holds under retries, whether signing keys or tokens can leak via logs, and whether destructive IAM actions are constrained. Reliability reviews ask about timeouts, retries, idempotency, multi-AZ dependencies, and dead-letter paths. Performance reviews ask what the bottleneck is after a simple load test. Cost reviews ask which pricing dimensions dominate and whether idle resources remain. Sustainability reviews ask whether idle capacity or duplicate storage can be removed. These questions are the Well-Architected habit from lesson 11 applied to API Gateway.

If documentation and this lesson ever appear to disagree on a flag name, quota, or regional feature, trust current AWS documentation and note the access date in your deliverable. This course explicitly forbids inventing features to sound advanced. Interview answers that include “I would verify the current quota in Service Quotas” score higher than fabricated precision.

Expansion block 6: API Gateway in the TechLearningPro progress platform

Operators responsible for Monday’s board treat API Gateway as part of a larger reliability story rather than a standalone lab toy. Before enabling traffic, they write the failure mode in one sentence: what the learner sees, what the teacher sees, and what the on-call engineer sees. They define which metrics prove health and which logs are permitted to contain curriculum metadata versus forbidden raw assessment answers. They confirm IAM roles follow least privilege with resource ARNs scoped to tlp-* prefixes where possible. They confirm network exposure is intentional: no public open management ports, no world-writable buckets, no secrets in deployment artifacts. They confirm a budget alert is active and that Cost Explorer can filter this workload by tags after billing delay. They schedule cleanup or transfer ownership with an expiry tag.

Design discussions for API Gateway should compare alternatives honestly. Sometimes EC2 or ECS is clearer for long-lived WebSocket lesson rooms; sometimes Lambda is clearer for bursty upload processing; sometimes API Gateway is unnecessary if ALB already exposes the fleet; sometimes CloudFront should serve bytes that developers mistakenly wanted to stream from compute. Choosing the smaller blast radius usually beats choosing the newest service name. When unsure, prototype in sandbox with budgets, measure, then write an ADR.

Implementation hygiene for API Gateway includes reproducible builds, pinned runtime or base image versions that are currently supported, automated tests for the success path and at least two failure paths, and evidence captured for homework or change tickets. Avoid relying on click-ops alone for anything you will need to recreate after an account scrub. Module 3 will industrialize IaC; Module 2 still expects you to document every console click you cannot yet express as code.

Security reviews ask whether authorization happens before expensive work, whether tenancy isolation holds under retries, whether signing keys or tokens can leak via logs, and whether destructive IAM actions are constrained. Reliability reviews ask about timeouts, retries, idempotency, multi-AZ dependencies, and dead-letter paths. Performance reviews ask what the bottleneck is after a simple load test. Cost reviews ask which pricing dimensions dominate and whether idle resources remain. Sustainability reviews ask whether idle capacity or duplicate storage can be removed. These questions are the Well-Architected habit from lesson 11 applied to API Gateway.

If documentation and this lesson ever appear to disagree on a flag name, quota, or regional feature, trust current AWS documentation and note the access date in your deliverable. This course explicitly forbids inventing features to sound advanced. Interview answers that include “I would verify the current quota in Service Quotas” score higher than fabricated precision.

Expansion block 7: API Gateway in the TechLearningPro progress platform

Operators responsible for Monday’s board treat API Gateway as part of a larger reliability story rather than a standalone lab toy. Before enabling traffic, they write the failure mode in one sentence: what the learner sees, what the teacher sees, and what the on-call engineer sees. They define which metrics prove health and which logs are permitted to contain curriculum metadata versus forbidden raw assessment answers. They confirm IAM roles follow least privilege with resource ARNs scoped to tlp-* prefixes where possible. They confirm network exposure is intentional: no public open management ports, no world-writable buckets, no secrets in deployment artifacts. They confirm a budget alert is active and that Cost Explorer can filter this workload by tags after billing delay. They schedule cleanup or transfer ownership with an expiry tag.

Design discussions for API Gateway should compare alternatives honestly. Sometimes EC2 or ECS is clearer for long-lived WebSocket lesson rooms; sometimes Lambda is clearer for bursty upload processing; sometimes API Gateway is unnecessary if ALB already exposes the fleet; sometimes CloudFront should serve bytes that developers mistakenly wanted to stream from compute. Choosing the smaller blast radius usually beats choosing the newest service name. When unsure, prototype in sandbox with budgets, measure, then write an ADR.

Implementation hygiene for API Gateway includes reproducible builds, pinned runtime or base image versions that are currently supported, automated tests for the success path and at least two failure paths, and evidence captured for homework or change tickets. Avoid relying on click-ops alone for anything you will need to recreate after an account scrub. Module 3 will industrialize IaC; Module 2 still expects you to document every console click you cannot yet express as code.

Security reviews ask whether authorization happens before expensive work, whether tenancy isolation holds under retries, whether signing keys or tokens can leak via logs, and whether destructive IAM actions are constrained. Reliability reviews ask about timeouts, retries, idempotency, multi-AZ dependencies, and dead-letter paths. Performance reviews ask what the bottleneck is after a simple load test. Cost reviews ask which pricing dimensions dominate and whether idle resources remain. Sustainability reviews ask whether idle capacity or duplicate storage can be removed. These questions are the Well-Architected habit from lesson 11 applied to API Gateway.

If documentation and this lesson ever appear to disagree on a flag name, quota, or regional feature, trust current AWS documentation and note the access date in your deliverable. This course explicitly forbids inventing features to sound advanced. Interview answers that include “I would verify the current quota in Service Quotas” score higher than fabricated precision.

Expansion block 8: API Gateway in the TechLearningPro progress platform

Operators responsible for Monday’s board treat API Gateway as part of a larger reliability story rather than a standalone lab toy. Before enabling traffic, they write the failure mode in one sentence: what the learner sees, what the teacher sees, and what the on-call engineer sees. They define which metrics prove health and which logs are permitted to contain curriculum metadata versus forbidden raw assessment answers. They confirm IAM roles follow least privilege with resource ARNs scoped to tlp-* prefixes where possible. They confirm network exposure is intentional: no public open management ports, no world-writable buckets, no secrets in deployment artifacts. They confirm a budget alert is active and that Cost Explorer can filter this workload by tags after billing delay. They schedule cleanup or transfer ownership with an expiry tag.

Design discussions for API Gateway should compare alternatives honestly. Sometimes EC2 or ECS is clearer for long-lived WebSocket lesson rooms; sometimes Lambda is clearer for bursty upload processing; sometimes API Gateway is unnecessary if ALB already exposes the fleet; sometimes CloudFront should serve bytes that developers mistakenly wanted to stream from compute. Choosing the smaller blast radius usually beats choosing the newest service name. When unsure, prototype in sandbox with budgets, measure, then write an ADR.

Implementation hygiene for API Gateway includes reproducible builds, pinned runtime or base image versions that are currently supported, automated tests for the success path and at least two failure paths, and evidence captured for homework or change tickets. Avoid relying on click-ops alone for anything you will need to recreate after an account scrub. Module 3 will industrialize IaC; Module 2 still expects you to document every console click you cannot yet express as code.

Security reviews ask whether authorization happens before expensive work, whether tenancy isolation holds under retries, whether signing keys or tokens can leak via logs, and whether destructive IAM actions are constrained. Reliability reviews ask about timeouts, retries, idempotency, multi-AZ dependencies, and dead-letter paths. Performance reviews ask what the bottleneck is after a simple load test. Cost reviews ask which pricing dimensions dominate and whether idle resources remain. Sustainability reviews ask whether idle capacity or duplicate storage can be removed. These questions are the Well-Architected habit from lesson 11 applied to API Gateway.

If documentation and this lesson ever appear to disagree on a flag name, quota, or regional feature, trust current AWS documentation and note the access date in your deliverable. This course explicitly forbids inventing features to sound advanced. Interview answers that include “I would verify the current quota in Service Quotas” score higher than fabricated precision.

Expansion block 9: API Gateway in the TechLearningPro progress platform

Operators responsible for Monday’s board treat API Gateway as part of a larger reliability story rather than a standalone lab toy. Before enabling traffic, they write the failure mode in one sentence: what the learner sees, what the teacher sees, and what the on-call engineer sees. They define which metrics prove health and which logs are permitted to contain curriculum metadata versus forbidden raw assessment answers. They confirm IAM roles follow least privilege with resource ARNs scoped to tlp-* prefixes where possible. They confirm network exposure is intentional: no public open management ports, no world-writable buckets, no secrets in deployment artifacts. They confirm a budget alert is active and that Cost Explorer can filter this workload by tags after billing delay. They schedule cleanup or transfer ownership with an expiry tag.

Design discussions for API Gateway should compare alternatives honestly. Sometimes EC2 or ECS is clearer for long-lived WebSocket lesson rooms; sometimes Lambda is clearer for bursty upload processing; sometimes API Gateway is unnecessary if ALB already exposes the fleet; sometimes CloudFront should serve bytes that developers mistakenly wanted to stream from compute. Choosing the smaller blast radius usually beats choosing the newest service name. When unsure, prototype in sandbox with budgets, measure, then write an ADR.

Implementation hygiene for API Gateway includes reproducible builds, pinned runtime or base image versions that are currently supported, automated tests for the success path and at least two failure paths, and evidence captured for homework or change tickets. Avoid relying on click-ops alone for anything you will need to recreate after an account scrub. Module 3 will industrialize IaC; Module 2 still expects you to document every console click you cannot yet express as code.

Security reviews ask whether authorization happens before expensive work, whether tenancy isolation holds under retries, whether signing keys or tokens can leak via logs, and whether destructive IAM actions are constrained. Reliability reviews ask about timeouts, retries, idempotency, multi-AZ dependencies, and dead-letter paths. Performance reviews ask what the bottleneck is after a simple load test. Cost reviews ask which pricing dimensions dominate and whether idle resources remain. Sustainability reviews ask whether idle capacity or duplicate storage can be removed. These questions are the Well-Architected habit from lesson 11 applied to API Gateway.

If documentation and this lesson ever appear to disagree on a flag name, quota, or regional feature, trust current AWS documentation and note the access date in your deliverable. This course explicitly forbids inventing features to sound advanced. Interview answers that include “I would verify the current quota in Service Quotas” score higher than fabricated precision.

Expansion block 10: API Gateway in the TechLearningPro progress platform

Operators responsible for Monday’s board treat API Gateway as part of a larger reliability story rather than a standalone lab toy. Before enabling traffic, they write the failure mode in one sentence: what the learner sees, what the teacher sees, and what the on-call engineer sees. They define which metrics prove health and which logs are permitted to contain curriculum metadata versus forbidden raw assessment answers. They confirm IAM roles follow least privilege with resource ARNs scoped to tlp-* prefixes where possible. They confirm network exposure is intentional: no public open management ports, no world-writable buckets, no secrets in deployment artifacts. They confirm a budget alert is active and that Cost Explorer can filter this workload by tags after billing delay. They schedule cleanup or transfer ownership with an expiry tag.

Design discussions for API Gateway should compare alternatives honestly. Sometimes EC2 or ECS is clearer for long-lived WebSocket lesson rooms; sometimes Lambda is clearer for bursty upload processing; sometimes API Gateway is unnecessary if ALB already exposes the fleet; sometimes CloudFront should serve bytes that developers mistakenly wanted to stream from compute. Choosing the smaller blast radius usually beats choosing the newest service name. When unsure, prototype in sandbox with budgets, measure, then write an ADR.

Implementation hygiene for API Gateway includes reproducible builds, pinned runtime or base image versions that are currently supported, automated tests for the success path and at least two failure paths, and evidence captured for homework or change tickets. Avoid relying on click-ops alone for anything you will need to recreate after an account scrub. Module 3 will industrialize IaC; Module 2 still expects you to document every console click you cannot yet express as code.

Security reviews ask whether authorization happens before expensive work, whether tenancy isolation holds under retries, whether signing keys or tokens can leak via logs, and whether destructive IAM actions are constrained. Reliability reviews ask about timeouts, retries, idempotency, multi-AZ dependencies, and dead-letter paths. Performance reviews ask what the bottleneck is after a simple load test. Cost reviews ask which pricing dimensions dominate and whether idle resources remain. Sustainability reviews ask whether idle capacity or duplicate storage can be removed. These questions are the Well-Architected habit from lesson 11 applied to API Gateway.

If documentation and this lesson ever appear to disagree on a flag name, quota, or regional feature, trust current AWS documentation and note the access date in your deliverable. This course explicitly forbids inventing features to sound advanced. Interview answers that include “I would verify the current quota in Service Quotas” score higher than fabricated precision.

Lesson Summary

This lesson expanded API Gateway for TechLearningPro’s AWS Application Platform module with architecture, security, reliability, cost honesty, labs, and interview practice. Keep Module 1 habits as you compose higher-level platform services. Next: Containers with Docker for AWS Workloads. Also deepen Docker generally at /learn/docker without treating it as a substitute for this AWS-shaped lesson.

Further Reading

• Official AWS documentation for the services named in this lesson (verify current Region support, quotas, and pricing).
• AWS Well-Architected Framework
• AWS Pricing Calculator for estimates—do not hardcode rates into runbooks
• Course links: /learn/aws-cloud-devops-engineering