API Gateway

Question 1

what is amazon API Gateway

Answer 1

API Gateway is a fully managed service that makes it easy for developers to publish, maintain, monitor, and secure APIs at any scale

Question 2

what can an API gateway do

Answer 2

Expose HTTPS endpoints to define a Restful API
Maintains multiple versions of your API
send each API endpoint to a different target
scale effortlessly
Track and control usage of API-key
Throttle requests to prevent attacks
Connect to CloudWatch to log all requests for monitoring
Run efficiently with low cost
serverless-ly connect to services like Lambda and Dynamo DB

Question 3

How do you configure API Gateway

Answer 3

Define an API (container)
Defines Resources and nested Resources (URL Paths)
For each Resource
select supported HTTP methods(Verbs)
Set security
Choose target(such as EC2, Lambda, DynamoDB, etc)
It sets request and response transformations

Question 4

How do I deploy API Gateway

Answer 4

Deploy API to a stage
Uses API GW domain, by default
Can use Custom domain
Now supports AWS Certificate Manager:free SSL/TLS certs

Question 5

API Gateway Caching

Answer 5

API Gateway caches the response based on TTL set.. If the same request comes again, it returns the response from the cache instead of the calling the endpoint again

Question 6

Same Origin Policy

Answer 6

In computing, same origin policy is an important concept in web application model.. Under the policy, a web browser permits scripts contained in a first web page to access data in second web page, but only if both web pages are from same origin.

This is done to prevent Cross-Site Scripting Attacks (XSS)
Enforced by web browsers
Ignored by tools like PostMan and curl

Question 7

Cross Origin Resource Sharing ((CORS)

Answer 7

Cross Origin Resource sharing is a mechanism that allows restricted resources(eg.fonts) on a web page to be requested from a different domain from which the first resource was served

In amazon, we will be using different domain names, For s3 we use s3 domain name, for cloud front cloud front domain name, in api gw , by api gw domain name.

CORS is one way the server at the other end ( not the client code in the browser) can relax the same-origin policy.

Question 8

error -“Origin Policy cannot be read at the remote resource?”

Answer 8

You need to enable CORS on API Gateway

Question 9

CORS is enforced by the client

Answer 9

True