[{"data":1,"prerenderedAt":310},["ShallowReactive",2],{"content-svc-api-gateway-paved-path-building-an-api-platform-on-aws-secure":3},{"markdown":4,"frontMatterAttributes":5,"bodyRaw":57,"menu":58,"menuType":305,"isCollapseableMenu":61,"nextDocItem":181,"previousDocItem":123,"contributorPaths":306,"contentName":309,"slug":177,"readingTime":153},"\u003Cp>\u003Cem>Note: This lesson touches on basics of the API gateway security. Check the \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fwhitepapers\u002Flatest\u002Fsecurity-overview-amazon-api-gateway\u002Fabstract-and-introduction.html\">whitepaper\u003C\u002Fa> linked in the sidebar for a detailed walkthrough of Amazon API Gateway security implementation options.\u003C\u002Fem>\u003C\u002Fp>\n\u003Ch2>Access Control: Data Plane\u003C\u002Fh2>\n\u003Cp>API Gateway provides a wide variety of mechanisms to control access to the APIs:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>IAM Authorization - both \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fpermissions.html\">REST\u003C\u002Fa> and \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fhttp-api-access-control-iam.html\">HTTP\u003C\u002Fa> APIs.\u003C\u002Fli>\n\u003Cli>Lambda Authorizer - both \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fapigateway-use-lambda-authorizer.html\">REST\u003C\u002Fa> and \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fhttp-api-lambda-authorizer.html\">HTTP\u003C\u002Fa> APIs.\u003C\u002Fli>\n\u003Cli>Cognito user pools - both \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fapigateway-integrate-with-cognito.html\">REST\u003C\u002Fa> and \u003Ca href=\"https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fsecurity\u002Fhow-to-secure-api-gateway-http-endpoints-with-jwt-authorizer\u002F\">HTTP\u003C\u002Fa> APIs.\u003C\u002Fli>\n\u003Cli>JWT Authorizer - \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fhttp-api-jwt-authorizer.html\">HTTP\u003C\u002Fa> APIs only.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>You can combine these approaches with REST API \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fapigateway-resource-policies.html\">resource policies\u003C\u002Fa> to narrow down who can access your API:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Users from a specified AWS account.\u003C\u002Fli>\n\u003Cli>Specified source IP address ranges or CIDR blocks.\u003C\u002Fli>\n\u003Cli>Specified virtual private clouds (VPCs) or VPC endpoints (in any account).\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>You can also use mutual TLS (both \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Frest-api-mutual-tls.html\">REST\u003C\u002Fa> and \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fhttp-api-mutual-tls.html\">HTTP\u003C\u002Fa> APIs) and require clients to present X.509 certificates to verify their identity to access your API. \u003C\u002Fp>\n\u003Cp>For \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fapigateway-control-access-aws-waf.html\">REST APIs\u003C\u002Fa> you can integrate AWS Web Application Firewall (WAF) with that helps protect web applications and APIs from common web exploits, such as SQL injection and cross-site scripting (XSS) attacks. You can \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fwaf\u002Flatest\u002Fdeveloperguide\u002Faws-managed-rule-groups-list.html\">AWS managed rules\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fwaf\u002Flatest\u002Fdeveloperguide\u002Fmarketplace-managed-rule-groups.html\">AWS Marketplace managed rule groups\u003C\u002Fa>, or create your own.\u003C\u002Fp>\n\u003Ch2>Access Control: Control Plane\u003C\u002Fh2>\n\u003Cp>Use fine-grained \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fsecurity-iam.html\">IAM policies\u003C\u002Fa> to control access to API Gateway control plane. For example, you can enforce a \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fsecurity_iam_id-based-policy-examples.html#security_iam_id-based-policy-examples-private-api\">rule that users can create private REST APIs only\u003C\u002Fa>, or require that \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fsecurity_iam_id-based-policy-examples.html#security_iam_id-based-policy-examples-require-authorization\">all HTTP API routes have authorization\u003C\u002Fa>. \u003C\u002Fp>\n\u003Cp>\u003Cem>Note: You can use service control policies to control OU permissions in AWS Organizations.\u003C\u002Fem>\u003C\u002Fp>\n\u003Ch2>AWS Security Agent\u003C\u002Fh2>\n\u003Cp>At re:Invent 2025 AWS \u003Ca href=\"https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Faws\u002Fnew-aws-security-agent-secures-applications-proactively-from-design-to-deployment-preview\u002F\">announced Security Agent\u003C\u002Fa> a frontier agent that proactively secures your applications throughout the development lifecycle. It conducts automated application security reviews. \u003C\u002Fp>\n\u003Cp>AWS Security Agent is context-aware — it understands your entire application. It understands your application design, your code, and your specific security requirements. It continuously scans for security violations automatically and runs penetration tests on-demand instantly without scheduling. The penetration testing agent creates a customized attack plan informed by the context it has learned from your security requirements, design documents, and source code, and dynamically adapts as it runs based on what it discovers, such as endpoints, status and error codes, and credentials. \u003C\u002Fp>\n\u003Ch2>Security at all layers\u003C\u002Fh2>\n\u003Cp>As a general rule, apply security at all layers, not just the API. Each component of your architecture or AWS service has specific security features and controls. Check \u003Ca href=\"https:\u002F\u002Faws.amazon.com\u002Fsecurity\u002F\">Cloud Security\u003C\u002Fa> page for more information and guidance.\n\u003Cimg src=\"\u002Fassets\u002Fexternal\u002Fservice\u002Fapi-gateway\u002Fpaved-path\u002Fbuilding-an-api-platform-on-aws\u002Fassets\u002F5_security_all_layers.png\" alt=\"Apply security at all layers\">\u003C\u002Fp>\n\u003Ch2>Partner Solutions\u003C\u002Fh2>\n\u003Cp>AWS partner solutions can boost your API security. They often include payload analysis, penetration testing, application security testing, web application firewalls, etc. Following is a non-exhaustive list of the partners that include API specific features in their security solutions:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwww.checkpoint.com\u002F\">Check Point\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwww.paloaltonetworks.com\u002F\">Palo Alto Networks\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwww.contrastsecurity.com\u002F\">Contrast Security\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fnonamesecurity.com\u002F\">Noname Security\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fsalt.security\u002F\">Salt Security\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwww.cequence.ai\u002F\">Cequence Security\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwww.imperva.com\u002F\">Imperva\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwww.wallarm.com\u002F\">Wallarm\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwww.veracode.com\u002F\">Veracode\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>and many more...\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>\u003Cem>For full list of AWS Security Competency Partners, see \u003Ca href=\"https:\u002F\u002Faws.amazon.com\u002Fsecurity\u002Fpartner-solutions\u002F\">this page\u003C\u002Fa>.\u003C\u002Fem>\u003C\u002Fp>\n",{"title":6,"order":7,"resources":8},"Secure",5,[9,13,17,21,25,28,31,34,37,40,43,47,50,54],{"link":10,"text":11,"type":12},"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fsecurity.html","Security in Amazon API Gateway","Documentation",{"link":14,"text":15,"type":16},"https:\u002F\u002Fdocs.aws.amazon.com\u002Fwhitepapers\u002Flatest\u002Fsecurity-overview-amazon-api-gateway\u002Fabstract-and-introduction.html","Security Overview of Amazon API Gateway","Whitepaper",{"link":18,"text":19,"type":20},"https:\u002F\u002Fserverlessland.com\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Fintroduction","Amazon API Gateway governance in depth","Guide",{"link":22,"text":23,"type":24},"https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fcompute\u002Fenhancing-api-security-with-amazon-api-gateway-tls-security-policies\u002F","Enhancing API security with Amazon API Gateway TLS security policies","Blog",{"link":26,"text":27,"type":24},"https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fcompute\u002Faccessing-private-amazon-api-gateway-endpoints-through-custom-amazon-cloudfront-distribution-using-vpc-origins\u002F","Accessing private Amazon API Gateway endpoints through custom Amazon CloudFront distribution using VPC Origins",{"link":29,"text":30,"type":24},"https:\u002F\u002Faws.amazon.com\u002Fabout-aws\u002Fwhats-new\u002F2024\u002F04\u002Famazon-cognito-customers-access-apis-verified-permissions\u002F","Amazon Cognito customers can secure access to APIs using Amazon Verified Permissions",{"link":32,"text":33,"type":24},"https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fmt\u002Fconfiguring-machine-to-machine-authentication-with-amazon-cognito-and-amazon-api-gateway-part-1\u002F","Configuring machine to machine Authentication with Amazon Cognito and Amazon API Gateway – Part 1",{"link":35,"text":36,"type":24},"https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fmt\u002Fconfiguring-machine-to-machine-authentication-with-amazon-cognito-and-amazon-api-gateway-part-2\u002F","Configuring machine to machine Authentication with Amazon Cognito and Amazon API Gateway – Part 2",{"link":38,"text":39,"type":24},"https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fcompute\u002Fconsuming-private-amazon-api-gateway-apis-using-mutual-tls\u002F","Consuming private Amazon API Gateway APIs using mutual TLS",{"link":41,"text":42,"type":24},"https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Farchitecture\u002Fhow-seatgeek-uses-aws-to-control-authorization-authentication-and-rate-limiting-in-a-multi-tenant-saas-application\u002F","How SeatGeek uses AWS Serverless to control authorization, authentication, and rate-limiting in a multi-tenant SaaS application",{"link":44,"text":45,"type":46},"https:\u002F\u002Fwww.youtube.com\u002Fwatch?v=GvyyJQ5m7x0","Scaling and securing private workloads using Amazon API Gateway","Video",{"link":48,"text":49,"type":46},"https:\u002F\u002Fwww.youtube.com\u002Fwatch?v=H4hCygngTrU","API Gateway private integrations | Serverless Office Hours",{"link":51,"text":52,"type":53},"https:\u002F\u002Fcatalog.workshops.aws\u002Fapigateway","The Amazon API Gateway Workshop","Workshop",{"link":55,"text":56,"type":53},"https:\u002F\u002Fcatalog.workshops.aws\u002Fserverless-patterns\u002Fen-US","Serverless Patterns","*Note: This lesson touches on basics of the API gateway security. Check the [whitepaper](https:\u002F\u002Fdocs.aws.amazon.com\u002Fwhitepapers\u002Flatest\u002Fsecurity-overview-amazon-api-gateway\u002Fabstract-and-introduction.html) linked in the sidebar for a detailed walkthrough of Amazon API Gateway security implementation options.*\n\n## Access Control: Data Plane\nAPI Gateway provides a wide variety of mechanisms to control access to the APIs:\n- IAM Authorization - both [REST](https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fpermissions.html) and [HTTP](https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fhttp-api-access-control-iam.html) APIs.\n- Lambda Authorizer - both [REST](https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fapigateway-use-lambda-authorizer.html) and [HTTP](https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fhttp-api-lambda-authorizer.html) APIs.\n- Cognito user pools - both [REST](https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fapigateway-integrate-with-cognito.html) and [HTTP](https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fsecurity\u002Fhow-to-secure-api-gateway-http-endpoints-with-jwt-authorizer\u002F) APIs.\n- JWT Authorizer - [HTTP](https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fhttp-api-jwt-authorizer.html) APIs only.\n\nYou can combine these approaches with REST API [resource policies](https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fapigateway-resource-policies.html) to narrow down who can access your API:\n- Users from a specified AWS account.\n- Specified source IP address ranges or CIDR blocks.\n- Specified virtual private clouds (VPCs) or VPC endpoints (in any account).\n\nYou can also use mutual TLS (both [REST](https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Frest-api-mutual-tls.html) and [HTTP](https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fhttp-api-mutual-tls.html) APIs) and require clients to present X.509 certificates to verify their identity to access your API. \n\nFor [REST APIs](https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fapigateway-control-access-aws-waf.html) you can integrate AWS Web Application Firewall (WAF) with that helps protect web applications and APIs from common web exploits, such as SQL injection and cross-site scripting (XSS) attacks. You can [AWS managed rules](https:\u002F\u002Fdocs.aws.amazon.com\u002Fwaf\u002Flatest\u002Fdeveloperguide\u002Faws-managed-rule-groups-list.html), [AWS Marketplace managed rule groups](https:\u002F\u002Fdocs.aws.amazon.com\u002Fwaf\u002Flatest\u002Fdeveloperguide\u002Fmarketplace-managed-rule-groups.html), or create your own.\n\n## Access Control: Control Plane\nUse fine-grained [IAM policies](https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fsecurity-iam.html) to control access to API Gateway control plane. For example, you can enforce a [rule that users can create private REST APIs only](https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fsecurity_iam_id-based-policy-examples.html#security_iam_id-based-policy-examples-private-api), or require that [all HTTP API routes have authorization](https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fsecurity_iam_id-based-policy-examples.html#security_iam_id-based-policy-examples-require-authorization). \n\n*Note: You can use service control policies to control OU permissions in AWS Organizations.*\n\n## AWS Security Agent\nAt re:Invent 2025 AWS [announced Security Agent](https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Faws\u002Fnew-aws-security-agent-secures-applications-proactively-from-design-to-deployment-preview\u002F) a frontier agent that proactively secures your applications throughout the development lifecycle. It conducts automated application security reviews. \n\nAWS Security Agent is context-aware — it understands your entire application. It understands your application design, your code, and your specific security requirements. It continuously scans for security violations automatically and runs penetration tests on-demand instantly without scheduling. The penetration testing agent creates a customized attack plan informed by the context it has learned from your security requirements, design documents, and source code, and dynamically adapts as it runs based on what it discovers, such as endpoints, status and error codes, and credentials. \n\n## Security at all layers\nAs a general rule, apply security at all layers, not just the API. Each component of your architecture or AWS service has specific security features and controls. Check [Cloud Security](https:\u002F\u002Faws.amazon.com\u002Fsecurity\u002F) page for more information and guidance.\n![Apply security at all layers](\u002Fassets\u002Fexternal\u002Fservice\u002Fapi-gateway\u002Fpaved-path\u002Fbuilding-an-api-platform-on-aws\u002Fassets\u002F5_security_all_layers.png)\n\n## Partner Solutions\nAWS partner solutions can boost your API security. They often include payload analysis, penetration testing, application security testing, web application firewalls, etc. Following is a non-exhaustive list of the partners that include API specific features in their security solutions:\n- [Check Point](https:\u002F\u002Fwww.checkpoint.com\u002F)\n- [Palo Alto Networks](https:\u002F\u002Fwww.paloaltonetworks.com\u002F)\n- [Contrast Security](https:\u002F\u002Fwww.contrastsecurity.com\u002F)\n- [Noname Security](https:\u002F\u002Fnonamesecurity.com\u002F)\n- [Salt Security](https:\u002F\u002Fsalt.security\u002F)\n- [Cequence Security](https:\u002F\u002Fwww.cequence.ai\u002F)\n- [Imperva](https:\u002F\u002Fwww.imperva.com\u002F)\n- [Wallarm](https:\u002F\u002Fwww.wallarm.com\u002F)\n- [Veracode](https:\u002F\u002Fwww.veracode.com\u002F)\n- and many more...\n\n*For full list of AWS Security Competency Partners, see [this page](https:\u002F\u002Faws.amazon.com\u002Fsecurity\u002Fpartner-solutions\u002F).*",[59,81,89,120,157,178,202,225,249,271,284],{"title":60,"collapsible":61,"isCollapsed":62,"content":63},"Introduction",false,true,[64],{"title":60,"order":65,"learningGoals":66,"prerequisite":69,"resources":72,"time":77,"path":78,"id":79,"link":80},1,[67,68],"Understand API lifecycle and an AWS point of view on building an API platform using Amazon API Gateway.","Learn AWS options and partner solutions to build an API platform with Amazon API Gateway.",[70,71],"Understanding of API management","Understanding of Amazon API Gateway",[73],{"link":74,"text":75,"type":76},"https:\u002F\u002Faws.amazon.com\u002Fapi-gateway\u002F","Learn more about Amazon API Gateway","text","1 min","introduction","introduction.md","\u002Fcontent\u002Fservice\u002Fapi-gateway\u002Fpaved-path\u002Fbuilding-an-api-platform-on-aws\u002Fintroduction",{"title":82,"collapsible":61,"isCollapsed":62,"content":83},"API Lifecycle",[84],{"title":82,"order":85,"time":77,"path":86,"id":87,"link":88},2,"api_lifecycle","api_lifecycle.md","\u002Fcontent\u002Fservice\u002Fapi-gateway\u002Fpaved-path\u002Fbuilding-an-api-platform-on-aws\u002Fapi_lifecycle",{"title":90,"collapsible":61,"isCollapsed":62,"content":91},"Plan",[92],{"title":90,"order":93,"resources":94,"time":116,"path":117,"id":118,"link":119},3,[95,98,101,104,107,110,113],{"link":96,"text":97,"type":46},"https:\u002F\u002Fwww.youtube.com\u002Fwatch?v=U6Zz_Bj6yEY","Building APIs: Choosing the best API solution & strategy for workloads",{"link":99,"text":100,"type":16},"https:\u002F\u002Fdocs.aws.amazon.com\u002Fwhitepapers\u002Flatest\u002Fbest-practices-api-gateway-private-apis-integration\u002Fbest-practices-api-gateway-private-apis-integration.html","Best Practices for Designing Amazon API Gateway Private APIs and Private Integration",{"link":102,"text":103,"type":24},"https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fcompute\u002Fimplementing-multi-region-failover-for-amazon-api-gateway\u002F","Implementing multi-Region failover for Amazon API Gateway",{"link":105,"text":106,"type":24},"https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fcompute\u002Farchitecting-multiple-microservices-behind-a-single-domain-with-amazon-api-gateway\u002F","Architecting multiple microservices behind a single domain with Amazon API Gateway",{"link":108,"text":109,"type":24},"https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fcompute\u002Fdynamically-routing-requests-with-amazon-api-gateway-routing-rules\u002F","Dynamically routing requests with Amazon API Gateway routing rules",{"link":111,"text":112,"type":24},"https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fcompute\u002Fusing-multiple-segments-in-amazon-api-gateway-base-path-mapping\u002F","Using multiple segments in Amazon API Gateway base path mapping",{"link":114,"text":115,"type":46},"https:\u002F\u002Fwww.youtube.com\u002Fwatch?v=JDbkoICzQro","Building well architected API Gateway APIs | Serverless Office Hours","2 min","plan","plan.md","\u002Fcontent\u002Fservice\u002Fapi-gateway\u002Fpaved-path\u002Fbuilding-an-api-platform-on-aws\u002Fplan",{"title":121,"collapsible":61,"isCollapsed":62,"content":122},"Develop\u002FTest",[123],{"title":121,"order":124,"resources":125,"time":153,"path":154,"id":155,"link":156},4,[126,129,132,135,138,141,144,148,151,152],{"link":127,"text":128,"type":46},"https:\u002F\u002Fwww.youtube.com\u002Fwatch?v=yfJZc3sJZ8E","I didn’t know Amazon API Gateway did that",{"link":130,"text":131,"type":24},"https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fcompute\u002Fbuilding-responsive-apis-with-amazon-api-gateway-response-streaming\u002F","Building responsive APIs with Amazon API Gateway response streaming",{"link":133,"text":134,"type":24},"https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fcompute\u002Fimplementing-custom-domain-names-for-private-endpoints-with-amazon-api-gateway\u002F","Implementing custom domain names for private endpoints with Amazon API Gateway",{"link":136,"text":137,"type":24},"https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fcompute\u002Fbuild-scalable-rest-apis-using-amazon-api-gateway-private-integration-with-application-load-balancer\u002F","Build scalable REST APIs using Amazon API Gateway private integration with Application Load Balancer",{"link":139,"text":140,"type":24},"https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fopensource\u002Fcreate-restful-apis-on-aws-with-openapi-specification-with-no-coding\u002F","Create RESTful APIs on AWS with OpenAPI Specification (With No Coding)",{"link":142,"text":143,"type":24},"https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fcompute\u002Fautomating-event-validation-with-amazon-eventbridge-schema-discovery\u002F","Automating event validation with Amazon EventBridge Schema Discovery",{"link":145,"text":146,"type":147},"https:\u002F\u002Fgithub.com\u002Faws-samples\u002Fserverless-samples\u002Ftree\u002Fmain\u002Fserverless-rest-api","Sample REST API implementations","Example",{"link":149,"text":150,"type":147},"https:\u002F\u002Fgithub.com\u002Faws-samples\u002Fserverless-samples\u002Ftree\u002Fmain\u002Fapigw-ai-agents","API developer experience customization and centralized guidance using AI Agents",{"link":51,"text":52,"type":53},{"link":55,"text":56,"type":53},"3 min","develop","develop.md","\u002Fcontent\u002Fservice\u002Fapi-gateway\u002Fpaved-path\u002Fbuilding-an-api-platform-on-aws\u002Fdevelop",{"title":6,"collapsible":61,"isCollapsed":61,"content":158},[159],{"title":6,"order":7,"resources":160,"time":153,"path":175,"id":176,"link":177},[161,162,163,164,165,166,167,168,169,170,171,172,173,174],{"link":10,"text":11,"type":12},{"link":14,"text":15,"type":16},{"link":18,"text":19,"type":20},{"link":22,"text":23,"type":24},{"link":26,"text":27,"type":24},{"link":29,"text":30,"type":24},{"link":32,"text":33,"type":24},{"link":35,"text":36,"type":24},{"link":38,"text":39,"type":24},{"link":41,"text":42,"type":24},{"link":44,"text":45,"type":46},{"link":48,"text":49,"type":46},{"link":51,"text":52,"type":53},{"link":55,"text":56,"type":53},"secure","secure.md","\u002Fcontent\u002Fservice\u002Fapi-gateway\u002Fpaved-path\u002Fbuilding-an-api-platform-on-aws\u002Fsecure",{"title":179,"collapsible":61,"isCollapsed":62,"content":180},"Deploy\u002FPublish",[181],{"title":179,"order":182,"resources":183,"time":77,"path":199,"id":200,"link":201},6,[184,187,190,193,195,198],{"link":185,"text":186,"type":24},"https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fcompute\u002Fzero-downtime-blue-green-deployments-with-amazon-api-gateway\u002F","Zero downtime blue\u002Fgreen deployments with Amazon API Gateway",{"link":188,"text":189,"type":24},"https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fcompute\u002Fperforming-canary-deployments-for-service-integrations-with-amazon-api-gateway\u002F","Performing canary deployments for service integrations with Amazon API Gateway",{"link":191,"text":192,"type":24},"https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fdevops\u002Fautomating-your-api-testing-with-aws-codebuild-aws-codepipeline-and-postman\u002F","Automating your API testing with AWS CodeBuild, AWS CodePipeline, and Postman",{"link":145,"text":194,"type":147},"Sample REST API implementations with CI\u002FCD pipelines",{"link":196,"text":197,"type":53},"https:\u002F\u002Fcatalog.workshops.aws\u002Fcomplete-aws-sam\u002Fen-US","The Complete AWS SAM Workshop",{"link":55,"text":56,"type":53},"deploy","deploy.md","\u002Fcontent\u002Fservice\u002Fapi-gateway\u002Fpaved-path\u002Fbuilding-an-api-platform-on-aws\u002Fdeploy",{"title":203,"collapsible":61,"isCollapsed":62,"content":204},"Scale",[205],{"title":203,"order":206,"resources":207,"time":77,"path":222,"id":223,"link":224},7,[208,211,215,218,221],{"link":209,"text":210,"type":24},"https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fcompute\u002Fbuilding-a-multi-region-serverless-application-with-amazon-api-gateway-and-aws-lambda\u002F","Building a Multi-region Serverless Application with Amazon API Gateway and AWS Lambda",{"link":212,"text":213,"type":214},"https:\u002F\u002Frepost.aws\u002Fquestions\u002FQUSs8ODCyJSRWR7mawaUIl4g\u002Fmulti-region-strategy-for-api-gateway","Multi Region strategy for API Gateway","re:Post",{"link":216,"text":217,"type":24},"https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fcompute\u002Fbuilding-resilient-private-apis-using-amazon-api-gateway\u002F","Building resilient private APIs using Amazon API Gateway",{"link":219,"text":220,"type":24},"https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fcompute\u002Farchitecting-for-scale-with-amazon-api-gateway-private-integrations\u002F","Architecting for scale with Amazon API Gateway private integrations",{"link":44,"text":45,"type":46},"scale","scale.md","\u002Fcontent\u002Fservice\u002Fapi-gateway\u002Fpaved-path\u002Fbuilding-an-api-platform-on-aws\u002Fscale",{"title":226,"collapsible":61,"isCollapsed":62,"content":227},"Monitor",[228],{"title":226,"order":229,"resources":230,"time":245,"path":246,"id":247,"link":248},8,[231,234,237,240,242],{"link":232,"text":233,"type":12},"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Frest-api-monitor.html","Monitoring REST APIs",{"link":235,"text":236,"type":12},"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fhttp-api-monitor.html","Monitoring your HTTP API",{"link":238,"text":239,"type":12},"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fwebsocket-api-monitor.html","Monitoring WebSocket APIs",{"link":145,"text":241,"type":147},"Sample REST API implementations with business specific metrics, dashboards and alerts in IaC templates",{"link":243,"text":244,"type":53},"https:\u002F\u002Fcatalog.workshops.aws\u002Fserverless-observability","AWS Serverless Observability Workshop","5 min","monitor","monitor.md","\u002Fcontent\u002Fservice\u002Fapi-gateway\u002Fpaved-path\u002Fbuilding-an-api-platform-on-aws\u002Fmonitor",{"title":250,"collapsible":61,"isCollapsed":62,"content":251},"Insights",[252],{"title":250,"order":253,"resources":254,"time":116,"path":268,"id":269,"link":270},9,[255,258,261,264,267],{"link":256,"text":257,"type":24},"https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fcompute\u002Fvisualizing-amazon-api-gateway-usage-plans-using-amazon-quicksight\u002F","Visualizing Amazon API Gateway usage plans using Amazon QuickSight",{"link":259,"text":260,"type":24},"https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fbig-data\u002Flog-analytics-the-easy-way-with-amazon-opensearch-serverless\u002F","Log analytics the easy way with Amazon OpenSearch Serverless",{"link":262,"text":263,"type":24},"https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fawsmarketplace\u002Fhow-to-gain-api-observability-with-amazon-api-gateway-and-moesif-in-minutes\u002F","How to gain API observability with Amazon API Gateway and Moesif in minutes",{"link":265,"text":266,"type":147},"https:\u002F\u002Fgithub.com\u002Faws-samples\u002Fserverless-samples\u002Ftree\u002Fmain\u002Fapigw-log-analytic","Logging API Gateway access logs, analyzing and visualizing them using Amazon QuickSight",{"link":243,"text":244,"type":53},"insights","insights.md","\u002Fcontent\u002Fservice\u002Fapi-gateway\u002Fpaved-path\u002Fbuilding-an-api-platform-on-aws\u002Finsights",{"title":272,"collapsible":61,"isCollapsed":62,"content":273},"Monetize",[274],{"title":272,"order":275,"resources":276,"time":116,"path":281,"id":282,"link":283},10,[277,278],{"link":256,"text":257,"type":24},{"link":279,"text":280,"type":24},"https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fcompute\u002Fmonetize-your-apis-in-aws-marketplace-using-api-gateway\u002F","Monetize your APIs in AWS Marketplace using API Gateway","monetize","monetize.md","\u002Fcontent\u002Fservice\u002Fapi-gateway\u002Fpaved-path\u002Fbuilding-an-api-platform-on-aws\u002Fmonetize",{"title":285,"collapsible":61,"isCollapsed":62,"content":286},"Discover",[287],{"title":285,"order":288,"resources":289,"time":116,"path":302,"id":303,"link":304},11,[290,293,296,299],{"link":291,"text":292,"type":12},"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fportals.html","API Gateway developer portals",{"link":294,"text":295,"type":24},"https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fcompute\u002Fimprove-api-discoverability-with-the-new-amazon-api-gateway-portal\u002F","Improve API discoverability with the new Amazon API Gateway Portal",{"link":297,"text":298,"type":24},"https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fapn\u002Fintegrating-readme-with-amazon-api-gateway-to-keep-your-developer-hub-up-to-date\u002F","Integrating ReadMe with Amazon API Gateway to Keep Your Developer Hub Up to Date",{"link":300,"text":301,"type":24},"https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fapn\u002Fhow-to-streamline-api-development-on-amazon-api-gateway-using-smartbear-swaggerhub\u002F","How to Streamline API Development on Amazon API Gateway Using SmartBear’s API Hub","discover","discover.md","\u002Fcontent\u002Fservice\u002Fapi-gateway\u002Fpaved-path\u002Fbuilding-an-api-platform-on-aws\u002Fdiscover","LESSON",[307,308],"content\u002Fcontributors\u002Farthi-jaganathan.json","content\u002Fcontributors\u002Fgiedrius-praspaliauskas.json","Building an API platform on AWS",1792665265497]