1. Amazon API Gateway
API Gateway is a service that receives and processes API calls.
The API serves as the “front door” for applications to access data, business logic, or functionality from your backend services.
Amazone’s API Gateway supports 2 types of APIs:
- HTTP / REST: HTTP APIs allow you to create RESTful APIs with lower latency and lower cost than REST APIs. If your API requires both API proxy functionality and API management functionality in the same solution, API Gateway also provides REST APIs.
- WEBSOCKET: Suitable for real-time two-way applications, typically an online chat application.
Some of the outstanding features that this service can bring are:
- Always available to accept requests
- There is an Auto-scale to handle hundreds of thousands of API calls at a time.
Speaking of which, you can see its similarity with the Elastíc Load Blancing service ‘Load Balancing’. But here are the differences.
For API Gateway, we can define information into API. This information includes path and method names.
In addition, the API Gateway also supports extracting data from:
- Variables on the path
- Query String on URL
- Body of the request
From this information you can form calls to the backend. From here you can process this data before returning it to the client.
To avoid the API being overloaded and abused due to too many requests (which cost a lot of money), Amazon API Gateway allows bottlenecking with the token bucket algorithm .
Here you can install 2 properties:
- Rate: maximum number of received requests per second
- Burst: The maximum number of requests that can be processed at a time
When the number of requests exceeds Rate or Burst the system will return error 429 – Too many Requests.
3. How API Gateway works
You can deploy the API on AWS region, VPC (Virtual Private Cloud), Amazon CloudFront Network. This allows you to use it in a variety of ways for both internal and external APIs.
As soon as the API Gateway receives a request, and the system has finished extracting the data from that request, now is the time to call the backend services like:
- Send this request to a Lambda function
- One EC2 (VPC)
- The AWS service is different
- A public or private URL (endpoint).
4. Monitoring (Monitoring)
Like many other AWS services, API also provides the management and tracking of this service’s performance metrics.
You can monitor performance metrics and information about API calls, data latency, and failure rates from the API Gateway console, so you can visually monitor calls to services. account through Amazon CloudWatch.
5. Authentication and Authorization (Authentication and Authorization)
The API Gateway provides several methods for this:
- Amazon Cognito: Allows use of 3rd party apps like Google, Facebook, Amazon. Users can use the accounts of these 3 providers to authenticate and decentralize API access.
- AWS Identity and Access Management (IAM): Use Signature version 4 (Sigv4). If you use another AWS service to access the API Gateway, that service’s SDK provides Sigv4 for authentication and authorization.
- AWS Lambda: OAuth, SAML, JWT token, use in case you want to customize.
6. API Key
You can leverage API Key to track a specific client.
Used to aid in distributing specific methods (with a new API Key used).
For licensed keys, similar to the bucket bottleneck mechanism above, we can set a specific number of Rate and Burst to specify the specific number of requests coming from a particular API Key.
7. API Development
During API development, you can take advantage of API Stages , You can use it to run multiple instances (Dev, Test, Production) at the same time through API Gateway.
Canary release is a feature you can use for a specific Stage, when a new Stage is deployed with Canary Release, it allows you to set the rate of flow of access to the newly deployed version.
For example, you can specify that only 5% of traffic will use the new update, the remaining 95% will still use the old version, then gradually increase to 10%, 20% until you make sure this new version can be run to all users.
This is a feature to prevent errors in new updates causing errors for all users.
You will probably notice that new Facebook updates sometimes only appear with a few accounts, other accounts take a while to be used.
To create documentation for your APIs, AWS provides Swagger export and import.