Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS DEV > API GATEWAY > Flashcards

API GATEWAY Flashcards

1
Q

Inegrations

A

Lambda Function: REST API

HTTP: Expose HTTP endpoint
API on premise
ALB on Cloud enviroment
Add rate limit, cache, user auth, api keys

AWS service
Expose any aws api through gateway
auth, deploy public, rate control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

API gateway endpoint types

A

Edge Optimized
Cloudfront edge location routing of request
API gateway in one region services multiple others

Regional
Clients in same region
can be integrated with cloudfront for more control
Api clients in one region

Private
Only in VPC, use resource policy to access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

API Gateway Deployment

A

Changes not implemented until Deployment, this makes it LIVE

Deployed to Stages: Dev , Prod , TEST

Each stage gets own configuration, can be rolled back as each step of stage is kept.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

API Breaking Change

A

Blue/Green deployment of versions, allows stages to be assigned V1 and V2

when new stage deployed, new API url generated, users are directed slowly over to new stage without breaking old stage user sessions. full migration over time.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Stage Variables

A

Stage Variables are similar to ENVIROMENT VARIABLES

Used for items that change often, changing configuration variables.

Usage:
Configure HTTP endpoints dev/test/prod
Pass config parameters to AWS Lambda through mapping templates

Passed to the context object in AWS lambda

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Stage Variable-> Lambda Alias

A

Dev Stage -> DEV alias ->Latest lambda function

Test Stage -> Prod Alias -> Lambda V1 (95%) Lambda V2 (5%)
Prod Stage -> Test Alias -> Lambda V2 (100)%

This allows prod to send 5% of traffic over to new stage.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

API GATEWAY CANARY Deployment

A

Allows testing of new API gateway

Client traffic moves 95% to the prod stage, then 5% will be directed to canary, this allows testing before offloading 100%

Prod Stage -> V1
Prod Stage Canary -> V2

Allows Blue-Green Deployment

  • Allows Separate metric and logs
  • override stage variables
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

API gateway integration: MOCK

A

MOCK: for Development , allows to make gateway to be made without actually sending back responses to backend. enables you to develop your API independently from your backend.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

API INTEGRATION:

HTTP/AWS Lambda / other services

A

HTTP/AWS (Lambda / other services)
Custom HTTP
Custom AWS service integration
Configure integration request and integration response
setup data mapping suing mapping templates for request and response. API gateway has power to change request and response.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

API integration

A

You choose an API integration type according to the types of integration endpoint you work with and how you want data to pass to and from the integration endpoint.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

API INTEGRATION:

AWS Proxy

A

Incoming request is the input to Lambda
Function is responsible for the logic of request/response

NO MAPPING TEMPLATE, cant change HEADERS , or QUERY STRING PARAM, These are passed to lambda function as arguments

Lambda takes invocation, and processes and creates a function response. Work is on backend, API gateway just proxy request through

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

API INTEGRATION:

HTTP Proxy

A

NO MAPPING TEMPLATE
HTTP request is passed to the backend (ex ALB)
HTTP response from Backend is forwarded by API gateway

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q 
Mapping Templates (AWS OR HTTP)
NO PROXY
A

USE: Modify Request and responses

Rename / Modify Query String Parameters
Modify Body Content
Add Headers

Uses Velocity Template Language VTL
Filter output results, and removes unnecessary data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Mapping template example

A

JSON to XML with soap

Client -JSON-> API -XML->SOAP API
SOAP API -XML-> API -JSON->Client

API gateway:

extract data that comes in by JSON
build soap message based on request data (mapping template)
Call SOAP service with built XML
receive XML
Tranform XML response to JSON back to user.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Swagger

A

API definition as code

Import existing Swagger/ OpenAPI 3.0

Method 
Method Request
Integration Request
Method response
\+AWS extensions for API

Can export current API as Swagger/OPENAPI

Swagger written in YAML or JSON
Swagger can be used to generate SDK for apps

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

CACHING API response

A

Caching reduce calls to backend

Default TTL is 300, 5 min
MAX is 3600, min is 60

Defined per stage or override per Method

Cache encryption can occur
Size 0.5GB to 237GB

Expensive, only use in production

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Cache invalidation

A

Can be flushed entirely
or clients can invalidate

Cache-Control:Max-age=0
Need permissions from IAM
if not impose Inavlidatecache policy or not choose “require auth” option in console then any client can invalidate cache!!!

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

METHOD

A

The primary or most-commonly-used HTTP verbs (or methods, as they are properly called) are POST, GET, PUT, PATCH, and DELETE. These correspond to create, read, update, and delete (or CRUD) operations, respectively.

In API Gateway, an API method embodies a method request and a method response. You set up an API method to define what a client should or must do to submit a request to access the service at the backend and to define the responses that the client receives in return. … An API method request is an HTTP request.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

STAGE

A

A stage is a named reference to a deployment, which is a snapshot of the API. You use a Stage to manage and optimize a particular deployment. For example, you can configure stage settings to enable caching, customize request throttling, configure logging, define stage variables, or attach a canary release for testing.

20
Q

API Usage Plans

A

Usage plan

Who can access Stage and Method
Speed of Access
What keys are linked to ID clients and meter access
Can Configure throttle limits and quota limits that are enforced on individual client.

21
Q

API Keys

A

Alphanumeric String, distribute to clients
Can be used with usage plans to control access
Throttle limit is applied to API keys
Quota limits is the overall number of max requests

22
Q

Correct Order for API key

A

Configure and use a Plan

  1. Create API, Configure methods in API to require API Key, Deploy API into stages
  2. Generate or import API key to distrbiute application to dev’s or customers who will use key
  3. Create usage plan with desired throttle and quota limits
  4. Associate API stages and API keys with usage plan!

**Callers of API must supply assigned API key in
X-api-Key Header in requests to API

23
Q

monitor: Cloud watch Logs

A

Cloudwatch Logging at Stage level , Via Log level

Can override settings on a per API basis

Error: Anything that results in error
Info: anything outgoing or incoming from API
Debug

Log has: information about request / response body

24
Q

Monitor: X-ray Tracing

A

Enable Tracing to get extra information about request in API gateway

X-ray Gateway + AWS lambda give full picture

25
Q

Cloudwatch Metrics: CachehitCount/CacheMissCount

A

Efficiency of cache
Hits Good /Dont want low
Misses Bad /Dont want high

26
Q

Cloudwatch Metrics: Count

A

Total number of API requests in a period

27
Q

Cloudwatch Metrics: Integration Latency

A

Time:

Between API gateway relays request to backend and when it received response

28
Q

Cloudwatch Metrics: Latency

A

Time between when API gateway receives request from Client and when it returns back

Integration latency + Api gateway overhead.

29
Q

Throttling

A

Account limit total
10,000
Soft limit can be changed

In case of throttle: 429 Too many requests, can be retried

Can limit Stage limit & Method Limit to improve performance

Can define Usage plans to throttle per customer

JUST LIKE LAMBDA, ONE BAD API CAN TAKE DOWN ALL REST>

30
Q

4xx error

A

CLIENT

400 Bad request
403 Access Denied WAF issue
429 Quota Exceeded , Throttle active

31
Q

5cc error

A

SERVER

502: Bad Gateway, when backend gives back a incomputable answer that cant be sent back.
503: Service Unavailable exception
504: Integration failure: Endpoint request timeout of 29seconds!

32
Q

API CORS

A

Cross Origin Resource Sharing:

API calls from different domain

can be enabled via console

33
Q

Options for CORS: Preflight requests

A

Access-Control-Allow-Methods
Access-Control-Allow-headers
Access-Control-Allow-origin

34
Q

HOW cors happens

cross origin: APIexample.com
Origin: ebsiteexample.com

A

Preflight request will reach out from origin to API Gateway
Options/
Host:Apiexample.com (this is API)
origin:websiteexample.com (This is different domain)

Preflight response will sent back to browser
Access-Control-Allow-origin: websiteexample.com
Access-Control-Allow-Methods: Get, put, delete

Browser sends to API now to make request

Get /
Host: Apiexample.com
Origin: ebsiteexample.com

35
Q

IAM permissions and API

A

Create IAM policy authorization and attach to user/role

Authentication via IAM
Authorization via IAM policy

Good to provide access within AWS to EC2/lambda

36
Q

IAM permissions from API: Sigv4

A

Signature Version 4 is the process to add authentication information to AWS requests sent by HTTP. For security, most requests to AWS must be signed with an access key, which consists of an access key ID and secret access key.

37
Q

Sigv4 signing process in Header

A

Client:

Via REST API with Sigv4 Header will send message to API gateway

API GATEWAY: This gateway undergoes policy check with IAM

BACKEND: Policy Check then unlocks access to Lambda Backend.

connection complete.

38
Q

API GATEWAY: Resources policy

A

WHO CAN ACCESS API:

Amazon API Gateway resource policies are JSON policy documents that you attach to an API to control whether a specified principal (typically an IAM user or role) can invoke the API. You can use API Gateway resource policies to allow your API to be securely invoked by:

For CORS account access, specified AWS account
Specific IP address access
For VPC access endpoint

39
Q

API GATEWAY Security: Cognito Pool

A

Authentication: Cognito User pool
Authorization: API gateway Methods

Cognito fully manage lifecycle of user , token expires automatically
Verification of id auto from AWS cognito
No custom implementation

  1. Cognito User pool: Authenticate and retrieve token to be given to client
  2. Client: Rest API and Pass token from above given to API gateway

2A. Token evaluated from Cognito User Token

  1. Success will allow access to backend.
40
Q

API Gateway Security: Lambda Authorizer

A

Authentication: External
Authorization: Lambda Function

Formerly Custom Authorizer

Third Party Auth System: Authentication request received by client, retrieve token

Token is passed to gateway: Via header or Request Params to API gateway

Api Gateway: Context of request plus token sent to LAMBDA AUTHORIZER

Lambda Authorizer: Lambda function verifies token by talking to third party authentication system

If Verified: IAM principal and policy is created
Policy is CACHED, into policy CACHE for future use.

Api gateway will now talk to backend.

41
Q

request parameters

A

Request parameters are the result of submitting an HTTP request with a query string that specifies the name/value pairs, or of submitting an HTML form that specifies the name/value pairs. The name and the values are always strings. … Parameters are Strings, and generally can be retrieved, but not set.

42
Q

GATEWAY SECURITY SUMMARY

A

IAM:
roles and user already in account, resource policy for across accounts
handle authenticate/authorization
leverages Sigv4

Custom Authorizer:
Great for Third party tokens
flexible for what iam policy is returned
handle auth verification and authorization in lambda function, we will need to pay for lambda function and results are cached.

cognito user pool
Manage own user pool, google etc.
No code needed
Implement authorization in backend

43
Q

HTTP API

A 
NO AWS LABMDA
NO IAM
NO MOCK
NO USAGE PLANS
NO API KEYS
YES COGNITO
YES OPEN ID / OAUTH 2.0

Low latency, cost effective
Lambda Proxy
Http Proxy
Private Integration

Support OIDC/OAUTH 2.0 authorization (unlike REST)\
built in support for CORS

NO USAGE PLANS AND API KEYS!
NO MAPPING TEMPLATE ALL PROXY

LAMBDA PROXY:
The Lambda proxy integration allows the client to call a single Lambda function in the backend. The function accesses many resources or features of other AWS services, including calling other Lambda functions. … To enable this, the client must follow application protocols enacted by the backend Lambda function.

HTTP proxy: integration enables you to connect an API route to a publicly routable HTTP endpoint

Private Integration:
This is an endpoint network interface that you create in your VPC. Using resource policies, you can allow or deny access to your API from selected VPCs and VPC endpoints

44
Q

REST API usage

A

Yes to
AWS LAMBDA
IAM
Amazon Cognito

Doesn’t use OpenID connect / Oauth 2.0

45
Q

rest vs http API

A

HTTP IS CHEAPER AND SIMPLE

Amazon API Gateway announced HTTP APIs, enabling customers to quickly build high performance RESTful APIs that are up to 71% cheaper than REST APIs also available from API Gateway. HTTP APIs are optimized for building APIs that proxy to AWS Lambda functions or HTTP backends, making them ideal for serverless workloads.

46
Q

WEBSOCKET API

A

PERSISTANT
REAL TIME
DASHBOARD

Two way interaction between browser and server
Server can push info to client
Enables Stateful application

Stateful application use cases:
Real-time application; 
Chat
Games
Financial trading

Works with
AWS services
Other HTTP endpoints

AWS DEV (17 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions