☰ All modules Tier 1 · API Gateway GuideCheat sheet ‹ lambdadynamodb ›
Contents
  1. How API Gateway appears on DVA-C02
  2. 1. API types REST HTTP and WebSocket
  3. 2. Endpoint types and custom domain names
  4. 3. Integration types proxy and non proxy
  5. 4. Mapping templates models and request validation
  6. 5. Deployments stages stage variables and canary releases
  7. 6. Caching
  8. 7. Throttling usage plans and API keys
  9. 8. IAM authorization and resource policies
  10. 9. Cognito JWT and Lambda authorizers
  11. 10. CORS
  12. 11. Error codes timeouts and payload limits
  13. 12. Logging metrics and tracing
  14. 13. WebSocket APIs
  15. 14. OpenAPI import export and SDK generation
  16. Quick decision rules
  17. Changed vs older material

API Gateway — DVA-C02 Mastery Guide

  • Sources: course chapter 16 (API Gateway). The course serves as the syllabus only; all wording here is original. Neighbouring topics are cross-referenced to the module that owns them (Lambda aliases, Cognito user pools, SigV4 signing, CloudFront, X-Ray instrumentation).
  • Written 2026-10-12; values checked against AWS docs on 2026-10-12. The marker ⚠️ Changed: <current>. Older material may say <old>. flags a value or behaviour that differs from the course or older practice tests: learn the current value. ⚠️ unverified marks something that could not be confirmed in current AWS documentation: do not rely on it. Every change is listed in Changed vs older material; this module's rows in notes/current-facts.md are pending your confirmation.
  • Tier 1 (highest exam weight), bank target 40 questions. Domains: Development with AWS Services (primary), Deployment, Security.
  • How to use it: /explain <topic> teaches from these sections (concept → exam facts → developer angle → traps → 3 check questions); /quiz api-gateway asks bank questions whose source_note links point at the ## N. headings below; /drill api-gateway fires short recall prompts from notes/api-gateway-cheat-sheet.md. Suggested loop: read a section and answer its practice questions before opening the answers → /explain what is still unclear → /quiz api-gateway → /drill api-gateway.

How API Gateway appears on DVA-C02

API Gateway is the front door of nearly every serverless scenario on the exam. Questions seldom ask what it is; they ask which API type, integration, setting or authorizer meets a stated constraint, and how to read the status code a client receives.

Typical question shapes: a scenario with one deciding constraint ("LEAST operational overhead", "without changing the Lambda code", "per-customer limits"); an error code or metric to diagnose; "Which TWO…" with five options; the exact setting, header or CLI command that does the job.

Domain map: Development → §1, §3, §4, §6, §11, §13 · Deployment → §5, §12, §14 · Security → §2 (private APIs), §7 (API keys and throttling), §8, §9, §10.

Out of scope here: network design (VPC link subnets, endpoint DNS architecture) beyond the settings a developer sets; Lambda internals (see notes/lambda-guide.md); Cognito user pool configuration (see notes/advanced-identity-guide.md); SigV4 mechanics and retries with backoff (see notes/cli-sdk-policies-guide.md); CloudFront behaviours (see notes/cloudfront-guide.md).

# Topic Why it is on the exam
1 API types REST HTTP and WebSocket Picking the product from a feature list, a cost target or a push requirement
2 Endpoint types and custom domain names Edge vs Regional vs private; certificate Region; VPC-only access
3 Integration types proxy and non proxy The Lambda proxy contract, service integrations, async Lambda, invoke permissions
4 Mapping templates models and request validation VTL transformations, 415 passthrough rejections, 400 validation before the backend
5 Deployments stages stage variables and canary releases Redeploy rules, stage variables plus Lambda aliases, canary promotion
6 Caching TTLs, cache keys, invalidation permissions, REST-only
7 Throttling usage plans and API keys Token bucket levels, 429s, per-client plans, API keys are not authentication
8 IAM authorization and resource policies SigV4, execute-api:Invoke ARNs, cross-account evaluation, WAF
9 Cognito JWT and Lambda authorizers Choosing the authorizer, cached decisions, 401 vs 403
10 CORS Preflight, proxy integrations returning headers, gateway responses
11 Error codes timeouts and payload limits Each code to its cause; the 29 s and 10 MB limits and their exceptions
12 Logging metrics and tracing Execution vs access logs, the CloudWatch role, metrics, X-Ray
13 WebSocket APIs Routes, connection IDs, @connections callbacks
14 OpenAPI import export and SDK generation API as code, merge vs overwrite, export extensions, client SDKs

1. API types REST HTTP and WebSocket

Concept

Exam facts

Feature REST API HTTP API
Endpoint types Edge-optimized, Regional, private Regional only
API keys, usage plans, per-client throttling Yes No
Caching Yes No (put CloudFront in front)
Request validation, body transformation (VTL) Yes No (parameter mapping only)
Mock integrations, custom gateway responses, console test invoke Yes No
AWS WAF, resource policies, private endpoint Yes No
Canary release deployments Yes No
Automatic deployments No Yes
Authorizers IAM, Cognito user pool, Lambda (TOKEN or REQUEST) IAM, JWT (Cognito or any OIDC issuer), Lambda (REQUEST)
X-Ray tracing, execution logs, access logs to Firehose Yes No (access logs to CloudWatch Logs)
Private integrations ALB or NLB (VPC link V2) ALB, NLB or Cloud Map
Client certificate for backend authentication Yes No
Response streaming Yes No

Developer angle

# REST API (v1 control plane): set the endpoint type explicitly
aws apigateway create-rest-api --name orders-api --endpoint-configuration types=REGIONAL

# HTTP API quick create: API + Lambda integration + catch-all route + auto-deploying $default stage
aws apigatewayv2 create-api --name orders-http --protocol-type HTTP \
  --target arn:aws:lambda:eu-west-1:111122223333:function:orders-api

# WebSocket API: the route selection expression is an API-level setting
aws apigatewayv2 create-api --name chat-ws --protocol-type WEBSOCKET --route-selection-expression '$request.body.action'

Traps

Practice questions

  1. A team is building a public API for a mobile app. Every route calls one Lambda function, users present JWTs issued by a third-party OpenID Connect provider, and the API must cost as little as possible. No caching or per-customer quotas are needed. Which option meets these requirements?

    • A. A REST API with a Lambda authorizer that validates the JWT on each request
    • B. A REST API with an Amazon Cognito user pool authorizer federated to the provider
    • C. An HTTP API with a JWT authorizer for the provider's issuer and audience
    • D. A WebSocket API with a Lambda authorizer on the $connect route

  2. A company must expose an API that enforces request quotas per customer, blocks SQL injection attempts with managed rules, and caches responses for 60 seconds. Which TWO statements about this design are true? (Select TWO.)

    • A. An HTTP API with route-level throttling enforces the per-customer quotas.
    • B. The API has to be a REST API, because usage plans, AWS WAF and caching are REST features.
    • C. An HTTP API can associate an AWS WAF web ACL with its $default stage.
    • D. A 60-second cache can be enabled on an HTTP API stage.
    • E. Customers are identified by API keys associated with a usage plan.
Answers
  1. C. HTTP APIs validate OIDC/OAuth 2.0 JWTs natively and are priced below REST APIs. A works but costs more (REST pricing plus authorizer invocations); B adds a Cognito user pool the requirement does not need; D is built for persistent two-way connections.
  2. B, E. Usage plans with API keys, WAF and caching are REST features that HTTP APIs lack, and a usage plan recognises customers by their API key. A fails because HTTP API throttling is per stage or route, not per client; C and D fail because HTTP APIs support neither WAF nor caching.

2. Endpoint types and custom domain names

Concept

Exam facts

Developer angle

# Regional custom domain with a certificate from the API's own Region
aws apigateway create-domain-name --domain-name api.example.com \
  --regional-certificate-arn arn:aws:acm:eu-west-1:111122223333:certificate/0f1e2d3c-4b5a-6978-8a9b-0c1d2e3f4a5b \
  --endpoint-configuration types=REGIONAL --security-policy TLS_1_2

# Map the prod stage to https://api.example.com/orders
aws apigateway create-base-path-mapping --domain-name api.example.com \
  --rest-api-id a1b2c3d4e5 --stage prod --base-path orders

# Call a private API from inside the VPC when private DNS is off
curl -s https://vpce-0a1b2c3d4e5f60718-abcdefgh.execute-api.eu-west-1.vpce.amazonaws.com/prod/orders \
  -H 'x-apigw-api-id: a1b2c3d4e5'

Resource policy for a private API: allow invocation, then deny anything that did not arrive through one VPC endpoint.

{"Version": "2012-10-17", "Statement": [
  {"Effect": "Allow", "Principal": "*", "Action": "execute-api:Invoke", "Resource": "execute-api:/*"},
  {"Effect": "Deny", "Principal": "*", "Action": "execute-api:Invoke", "Resource": "execute-api:/*",
   "Condition": {"StringNotEquals": {"aws:SourceVpce": "vpce-0a1b2c3d4e5f60718"}}}]}

Traps

Practice questions

  1. A Regional REST API in ap-southeast-2 serves clients in Australia only, and its custom domain must stay Regional. Creating the domain fails with the team's ACM certificate, which was issued in us-east-1. What should the developer do?

    • A. Request or import an ACM certificate for the domain in ap-southeast-2.
    • B. Create the custom domain as edge-optimized so the us-east-1 certificate is accepted.
    • C. Point a CNAME record for the domain at the API's default execute-api hostname.
    • D. Attach the certificate to the API's prod stage in the stage settings.

  2. An internal REST API must be callable only by applications in one VPC, and the traffic must not traverse the internet. Which TWO steps are required? (Select TWO.)

    • A. Create the API with the private endpoint type and an interface VPC endpoint for execute-api in the VPC.
    • B. Create an HTTP API and attach a VPC link to the application subnets.
    • C. Keep a Regional endpoint and allow the VPC's private CIDR range with aws:SourceIp in a resource policy.
    • D. Attach a resource policy that allows execute-api:Invoke only when aws:SourceVpce matches the VPC endpoint.
    • E. Set disableExecuteApiEndpoint to keep internet clients out.
Answers
  1. A. A Regional custom domain takes an ACM certificate from the API's own Region. B would accept the us-east-1 certificate but breaks the requirement to keep the domain Regional; C bypasses the custom domain, so clients see a certificate for the wrong hostname; D fails because certificates belong to the custom domain name, not to a stage.
  2. A, D. A private endpoint plus a resource policy scoped to the VPC endpoint keeps traffic inside AWS. B gives an API private backends, not a private front door; C still exposes a public endpoint and private IPs never appear as the source; E only forces clients onto a custom domain.

3. Integration types proxy and non proxy

Concept

Type Backend What you configure Typical use
AWS_PROXY Lambda (Lambda proxy) Nothing to map; the function parses the request and returns status, headers and body Default choice for Lambda backends
AWS Lambda (custom) or any AWS service action Integration request and response, mapping templates, an IAM role Call SQS, Kinesis, Step Functions or DynamoDB directly; reshape Lambda input and output
HTTP_PROXY HTTP endpoint The URL, optionally header or parameter mappings Pass-through to an existing HTTP service or a private ALB or NLB
HTTP HTTP endpoint (custom) Integration request and response with templates Translate between client and legacy backend formats
MOCK None A request template that picks the status code, plus integration responses Prototypes, tests, CORS preflight

Exam facts

Developer angle

# Lambda proxy integration on ANY /orders/{proxy+}
aws apigateway put-integration --rest-api-id a1b2c3d4e5 --resource-id k9l8m7 \
  --http-method ANY --type AWS_PROXY --integration-http-method POST \
  --uri arn:aws:apigateway:eu-west-1:lambda:path/2015-03-31/functions/arn:aws:lambda:eu-west-1:111122223333:function:orders-api/invocations

# Allow this API (every stage, method and path) to invoke the function
aws lambda add-permission --function-name orders-api --statement-id apigw-orders-invoke \
  --action lambda:InvokeFunction --principal apigateway.amazonaws.com \
  --source-arn "arn:aws:execute-api:eu-west-1:111122223333:a1b2c3d4e5/*"

# HTTP API first-class integration: put the request body on an SQS queue, no Lambda
aws apigatewayv2 create-integration --api-id x1y2z3 --integration-type AWS_PROXY \
  --integration-subtype SQS-SendMessage --payload-format-version 1.0 \
  --credentials-arn arn:aws:iam::111122223333:role/apigw-sqs-send \
  --request-parameters '{"QueueUrl": "https://sqs.eu-west-1.amazonaws.com/111122223333/orders", "MessageBody": "$request.body"}'

# Map a Lambda custom-integration error message to 400 (400 must also be a method response)
aws apigateway put-integration-response --rest-api-id a1b2c3d4e5 --resource-id k9l8m7 \
  --http-method POST --status-code 400 --selection-pattern "Invalid.*"

A Lambda proxy handler that always returns the required shape (body is a string):

import json

def handler(event, context):
    order_id = (event.get("pathParameters") or {}).get("proxy", "")
    status, payload = (200, {"orderId": order_id}) if order_id else (400, {"message": "order id required"})
    return {"statusCode": status, "headers": {"Content-Type": "application/json"}, "body": json.dumps(payload)}

Traps

Practice questions

  1. A developer deploys a REST API with a Lambda proxy integration. Requests reach the function, its logs show it completed successfully, but clients receive 502 Bad Gateway. The function returns {"status": 200, "message": "ok"}. What should the developer change?

    • A. Increase the integration timeout to 29 seconds.
    • B. Add an integration response mapping template that wraps the output in JSON.
    • C. Grant lambda:InvokeFunction to apigateway.amazonaws.com on the function.
    • D. Return statusCode, headers and a string body from the function.

  2. A REST API must accept an order and place it on an Amazon SQS queue, returning immediately. There is no business logic, and the solution must have the LEAST operational overhead. Which TWO configuration steps are required? (Select TWO.)

    • A. Create a Lambda proxy integration whose function calls SendMessage.
    • B. Create an HTTP proxy integration that points at the queue URL.
    • C. Create an AWS integration for the SQS SendMessage action with a mapping template that builds the request.
    • D. Enable caching on the method so repeated orders are not sent twice.
    • E. Give API Gateway an IAM role with sqs:SendMessage on the queue as the integration credentials.
Answers
  1. D. The output lacks statusCode and a string body, so API Gateway rejects it as a malformed proxy response. A is irrelevant because the function finished; B does not apply because proxy integrations ignore integration templates; C would produce a 500 before the function runs, but here it ran.
  2. C, E. An AWS integration with a template and a role sends the message without any function. A works but adds a function to maintain; B cannot sign requests to SQS, so it would only work against a queue opened to anonymous callers; D does not deduplicate anything and does not apply to POST by default.

4. Mapping templates models and request validation

Concept

Exam facts

Developer angle

Integration request template for POST /orders/{id}?customer=c-42 with a JSON body:

#set($body = $input.path('$'))
{
  "orderId": "$util.escapeJavaScript($input.params('id'))",
  "customerId": "$util.escapeJavaScript($input.params('customer'))",
  "itemCount": $body.items.size(),
  "requestId": "$context.requestId",
  "table": "$stageVariables.ordersTable"
}

Integration response template that keeps two fields of each item:

#set($root = $input.path('$'))
[#foreach($item in $root.items){"id": "$item.id", "status": "$item.status"}#if($foreach.hasNext),#end#end]

# A validator, a model and a POST method that uses both
aws apigateway create-request-validator --rest-api-id a1b2c3d4e5 \
  --name body-only --validate-request-body --no-validate-request-parameters
aws apigateway create-model --rest-api-id a1b2c3d4e5 --name OrderModel --content-type application/json \
  --schema '{"type": "object", "required": ["sku", "quantity"], "properties": {"sku": {"type": "string"}, "quantity": {"type": "integer", "minimum": 1}}}'
aws apigateway put-method --rest-api-id a1b2c3d4e5 --resource-id k9l8m7 --http-method POST \
  --authorization-type NONE --request-validator-id v4l1d8 --request-models application/json=OrderModel

# HTTP API: parameter mapping that adds a header for the backend
aws apigatewayv2 update-integration --api-id x1y2z3 --integration-id i9j8k7 \
  --request-parameters '{"append:header.x-request-id": "$context.requestId"}'

Traps

Practice questions

  1. A REST API fronts a legacy SOAP service that accepts only XML, while clients send JSON. The team does not want to run or maintain any extra compute. What should the developer configure?

    • A. An HTTP API with parameter mapping that sets Content-Type: text/xml
    • B. A REST API HTTP custom integration with VTL request and response templates
    • C. A REST API HTTP proxy integration with the WHEN_NO_MATCH passthrough behavior
    • D. A Lambda proxy integration whose function converts JSON to XML and calls the service

  2. A POST method must reject requests that lack the X-Tenant-Id header or whose JSON body lacks a string sku, without invoking the backend. Which TWO actions are required? (Select TWO.)

    • A. Create a model whose JSON schema requires sku, and attach it to the method for application/json.
    • B. Set the integration passthrough behavior to NEVER.
    • C. Mark X-Tenant-Id as a required method request header and assign a validator that checks the body, query strings and headers.
    • D. Add an integration request template that sets sku to an empty string when it is missing.
    • E. Add a Lambda authorizer that inspects the header and the body.
Answers
  1. B. VTL templates on a REST custom integration convert JSON to XML and back without any compute. A changes a header, not the body; C forwards the JSON unchanged; D works but adds a function to run and maintain.
  2. A, C. The model checks the body and the validator, with the header marked required, rejects bad requests with 400 before the backend. B only rejects unmapped content types; D transforms rather than rejects and still calls the backend; E fails because authorizers never see the request body.

5. Deployments stages stage variables and canary releases

Concept

Exam facts

Developer angle

# Deploy to prod and set stage variables in one call
aws apigateway create-deployment --rest-api-id a1b2c3d4e5 --stage-name prod \
  --description "orders v1.4" --variables lambdaAlias=prod,ordersTable=orders-prod

# Change one stage variable later (takes effect without a redeploy)
aws apigateway update-stage --rest-api-id a1b2c3d4e5 --stage-name prod \
  --patch-operations op=replace,path=/variables/ordersTable,value=orders-prod-v2

# Roll back: point the stage at an earlier deployment (IDs from get-deployments)
aws apigateway update-stage --rest-api-id a1b2c3d4e5 --stage-name prod \
  --patch-operations op=replace,path=/deploymentId,value=d3p10y

# Canary: send 10 % of prod traffic to a new deployment that uses alias "canary"
aws apigateway create-deployment --rest-api-id a1b2c3d4e5 --stage-name prod \
  --canary-settings percentTraffic=10.0,stageVariableOverrides={lambdaAlias=canary},useStageCache=false

# Promote the canary (the canary settings remain, at 0 %)
aws apigateway update-stage --rest-api-id a1b2c3d4e5 --stage-name prod \
  --patch-operations '[{"op":"replace","path":"/canarySettings/percentTraffic","value":"0.0"},{"op":"copy","from":"/canarySettings/stageVariableOverrides","path":"/variables"},{"op":"copy","from":"/canarySettings/deploymentId","path":"/deploymentId"}]'

# Integration URI with an alias stage variable, and the invoke permission every alias needs
aws apigateway put-integration --rest-api-id a1b2c3d4e5 --resource-id k9l8m7 \
  --http-method GET --type AWS_PROXY --integration-http-method POST \
  --uri 'arn:aws:apigateway:eu-west-1:lambda:path/2015-03-31/functions/arn:aws:lambda:eu-west-1:111122223333:function:orders-api:${stageVariables.lambdaAlias}/invocations'

for alias in dev prod canary; do
  aws lambda add-permission --function-name "orders-api:${alias}" --statement-id "apigw-${alias}" \
    --action lambda:InvokeFunction --principal apigateway.amazonaws.com \
    --source-arn "arn:aws:execute-api:eu-west-1:111122223333:a1b2c3d4e5/*/GET/orders"
done

Traps

Practice questions

  1. A REST API integrates with orders-api:${stageVariables.alias}. The developer creates Lambda alias blue, sets the prod stage variable alias to blue, and every call to prod now fails with 500 Internal Server Error. The dev stage, which uses alias dev, still works. What is the MOST likely fix?

    • A. Create a new deployment of the API on the prod stage.
    • B. Turn on Lambda proxy integration for the method and redeploy.
    • C. Grant apigateway.amazonaws.com invoke permission on orders-api:blue.
    • D. Add lambda:InvokeFunction on the alias to the function's execution role.

  2. A developer wants 5 % of production traffic to exercise a new API deployment that also calls a new Lambda alias, compare its error rate with the current version, and then make it the production version. Which TWO actions accomplish this? (Select TWO.)

    • A. Create a prod-new stage and ask 5 % of the clients to switch to its URL.
    • B. Enable canary settings on the prod stage with percentTraffic 5.0 and a stage variable override for the alias.
    • C. Configure weighted routing on the Lambda alias and leave the API unchanged.
    • D. Compare the canary's CloudWatch metrics and logs with the stage's, then promote the canary.
    • E. Enable automatic deployments on the stage so the canary is promoted when errors drop.
Answers
  1. C. Each alias reached through a stage variable needs its own invoke permission; dev works because its alias has one. A changes nothing because stage variables need no redeploy and the configuration is already deployed; B does not touch permissions; D edits the role the function runs with, which does not control who may invoke it.
  2. B, D. A canary on the stage splits traffic randomly, keeps separate logs and metrics, and is then promoted. A depends on clients choosing URLs; C cannot include the new API deployment; E is an HTTP API feature and never promotes canaries.

6. Caching

Concept

Exam facts

Developer angle

# Provision a 0.5 GB cache on prod and enable caching for its GET methods
aws apigateway update-stage --rest-api-id a1b2c3d4e5 --stage-name prod --patch-operations \
  op=replace,path=/cacheClusterEnabled,value=true op=replace,path=/cacheClusterSize,value=0.5 \
  op=replace,path=/*/*/caching/enabled,value=true

# GET /products: 60 s TTL, encrypted entries, authorization required for Cache-Control
aws apigateway update-stage --rest-api-id a1b2c3d4e5 --stage-name prod \
  --patch-operations op=replace,path=/~1products/GET/caching/ttlInSeconds,value=60 \
                     op=replace,path=/~1products/GET/caching/dataEncrypted,value=true \
                     op=replace,path=/~1products/GET/caching/requireAuthorizationForCacheControl,value=true \
                     op=replace,path=/~1products/GET/caching/unauthorizedCacheControlHeaderStrategy,value=FAIL_WITH_403

# Make the "category" query string part of the cache key
aws apigateway put-method --rest-api-id a1b2c3d4e5 --resource-id p7r8d9 --http-method GET \
  --authorization-type NONE --request-parameters "method.request.querystring.category=false"
aws apigateway put-integration --rest-api-id a1b2c3d4e5 --resource-id p7r8d9 --http-method GET \
  --type HTTP_PROXY --integration-http-method GET --uri 'https://catalog.example.com/products' \
  --request-parameters "integration.request.querystring.category=method.request.querystring.category" \
  --cache-key-parameters "method.request.querystring.category"

# Empty the stage cache after a bulk data change
aws apigateway flush-stage-cache --rest-api-id a1b2c3d4e5 --stage-name prod

Identity policy that lets a back-office role refresh cached entries (it then sends a SigV4-signed GET /products with Cache-Control: max-age=0):

{"Version": "2012-10-17", "Statement": [{"Effect": "Allow", "Action": "execute-api:InvalidateCache",
  "Resource": "arn:aws:execute-api:eu-west-1:111122223333:a1b2c3d4e5/prod/GET/products"}]}

Traps

Practice questions

  1. A catalog REST API filters results with the category query string. After caching was enabled on the stage, users browsing category=garden sometimes receive kitchen products. The team wants to keep the benefit of caching. What should the developer do?

    • A. Add category as a cache key parameter on the method's integration.
    • B. Reduce the stage cache TTL to 0 seconds for every method in the stage.
    • C. Flush the stage cache with flush-stage-cache every hour.
    • D. Switch the method to a Lambda proxy integration.

  2. A REST API caches GET /prices for 300 seconds. A pricing service must refresh a single cached entry right after each price change, and no other client may bypass the cache. Which TWO actions meet these requirements? (Select TWO.)

    • A. Have the pricing service call flush-stage-cache after each change.
    • B. Raise the method's TTL to 3,600 seconds so entries expire less often.
    • C. Put public clients on a usage plan with a lower quota.
    • D. Require authorization for cache invalidation and use the FAIL_WITH_403 strategy.
    • E. Grant the pricing service's role execute-api:InvalidateCache and send signed requests with Cache-Control: max-age=0.
Answers
  1. A. Adding category to the cache key stores each category separately. B removes caching altogether; C still mixes categories between flushes; D changes the integration type, not the cache key.
  2. D, E. Requiring authorization blocks other clients, and the permitted role refreshes one entry with Cache-Control: max-age=0. A empties the whole cache; B delays freshness; C limits volume but still lets anyone bypass the cache.

7. Throttling usage plans and API keys

Concept

Exam facts

Developer angle

# Stage-wide default limits plus a tighter limit for one expensive method
aws apigateway update-stage --rest-api-id a1b2c3d4e5 --stage-name prod --patch-operations \
  op=replace,path=/*/*/throttling/rateLimit,value=500 op=replace,path=/*/*/throttling/burstLimit,value=1000 \
  op=replace,path=/~1reports/POST/throttling/rateLimit,value=20

# "basic" tier: 10 rps, burst 20, 50,000 requests per month
aws apigateway create-usage-plan --name basic --api-stages apiId=a1b2c3d4e5,stage=prod \
  --throttle burstLimit=20,rateLimit=10 --quota limit=50000,offset=0,period=MONTH

# Issue a key to a customer and attach it to the plan
aws apigateway create-api-key --name customer-acme --enabled
aws apigateway create-usage-plan-key --usage-plan-id u5p1an --key-id k3y1d2 --key-type API_KEY

# Require the key on a method (then redeploy the API)
aws apigateway update-method --rest-api-id a1b2c3d4e5 --resource-id k9l8m7 \
  --http-method GET --patch-operations op=replace,path=/apiKeyRequired,value=true

# Usage so far this month (the client sends the key as x-api-key)
aws apigateway get-usage --usage-plan-id u5p1an --key-id k3y1d2 \
  --start-date 2026-10-01 --end-date 2026-10-12

# HTTP API: per-route throttling on a stage
aws apigatewayv2 update-stage --api-id x1y2z3 --stage-name '$default' \
  --route-settings '{"POST /orders": {"ThrottlingBurstLimit": 200, "ThrottlingRateLimit": 100}}'

Traps

Practice questions

  1. A SaaS company sells its REST API in two tiers. Free-tier customers may send 1,000 requests per day at no more than 5 requests per second; paid customers get higher limits. Which solution meets these requirements with the LEAST operational overhead?

    • A. Track each customer's requests in DynamoDB from a Lambda authorizer and deny calls over the limit.
    • B. Set method throttling on the stage to 5 requests per second for every client.
    • C. Create one stage per customer and configure stage-level throttling on each.
    • D. Create a usage plan per tier with its throttle and daily quota, and attach each customer's API key.

  2. During month-end, a reporting API returns bursts of 429 Too Many Requests while CloudWatch shows its backend idle. Other APIs in the same account and Region are throttled at the same moments. Which TWO actions address the problem? (Select TWO.)

    • A. Set stage or method throttling on the reporting API so it cannot consume the whole account limit.
    • B. Increase the memory size of the backend Lambda function.
    • C. Enable API caching on the reporting API's POST methods.
    • D. Change the API to an edge-optimized endpoint.
    • E. Request a higher account-level throttle quota for the Region in Service Quotas.
Answers
  1. D. Usage plans give each tier its own throttle and daily quota, enforced per API key with no code. A needs custom code and a table; B applies one limit to everyone; C does not scale and runs into the stages-per-API quota.
  2. A, E. Capping the reporting API protects the shared pool, and a higher Regional quota adds headroom. B targets a backend that is idle; C does not stop throttling and POST responses are not cached by default; D does not change account limits.

8. IAM authorization and resource policies

Concept

Exam facts

Developer angle

# Require SigV4 on a REST method (redeploy afterwards)
aws apigateway update-method --rest-api-id a1b2c3d4e5 --resource-id k9l8m7 \
  --http-method GET --patch-operations op=replace,path=/authorizationType,value=AWS_IAM

# Create an API with a resource policy read from a file
aws apigateway create-rest-api --name partner-api \
  --endpoint-configuration types=REGIONAL --policy file://resource-policy.json

Identity policy for a caller that may read orders in prod only:

{"Version": "2012-10-17", "Statement": [{"Effect": "Allow", "Action": "execute-api:Invoke",
  "Resource": "arn:aws:execute-api:eu-west-1:111122223333:a1b2c3d4e5/prod/GET/orders/*"}]}

resource-policy.json: a partner account's role may read orders, but only from the partner's network range:

{"Version": "2012-10-17", "Statement": [
  {"Effect": "Allow", "Principal": {"AWS": "arn:aws:iam::444455556666:role/partner-integration"},
   "Action": "execute-api:Invoke", "Resource": "execute-api:/prod/GET/orders/*"},
  {"Effect": "Deny", "Principal": "*", "Action": "execute-api:Invoke", "Resource": "execute-api:/*",
   "Condition": {"NotIpAddress": {"aws:SourceIp": ["198.51.100.0/24"]}}}]}

Callers sign with their SDK's SigV4 signer (service name execute-api), or test with a signing client such as awscurl --service execute-api https://a1b2c3d4e5.execute-api.eu-west-1.amazonaws.com/prod/orders/123.

Traps

Practice questions

  1. Account A hosts a REST API whose methods use AWS_IAM authorization. A Lambda function in account B, running as role ingest-role, must call it. Account A's resource policy already allows ingest-role, yet the calls return 403. What else is required?

    • A. Replace AWS_IAM with a Cognito user pool authorizer on each method of the API.
    • B. Allow execute-api:Invoke in an identity policy attached to ingest-role.
    • C. Associate account B with a usage plan and give it an API key.
    • D. Enable CORS on the API for the origin of the Lambda function in account B.

  2. A REST API must accept calls only from a corporate IP range and must block common SQL injection patterns with managed rules, with minimal custom code. Which TWO actions should the developer take? (Select TWO.)

    • A. Add a resource policy that allows execute-api:Invoke and denies it when aws:SourceIp is outside the corporate range.
    • B. Add a Lambda authorizer that scans the request body for SQL keywords.
    • C. Associate an AWS WAF web ACL with managed SQL injection rules to the API stage.
    • D. Add an aws:SourceVpce condition that names the corporate network.
    • E. Create a usage plan with a low quota for unknown callers.
Answers
  1. B. Cross-account IAM access needs an allow on both sides: the resource policy in A and an identity policy in B. A expects user pool tokens, not role credentials; C does not grant access; D only matters to browsers.
  2. A, C. A resource policy that allows calls but denies other source IPs, plus a WAF web ACL with managed rules, covers both needs without code. B is custom code, and authorizers never see the body; D only works on private APIs; E limits volume, not attacks.

9. Cognito JWT and Lambda authorizers

Concept

Exam facts

Developer angle

# REST: Cognito user pool authorizer, then require a scope on a method (access tokens)
aws apigateway create-authorizer --rest-api-id a1b2c3d4e5 --name orders-users --type COGNITO_USER_POOLS \
  --provider-arns arn:aws:cognito-idp:eu-west-1:111122223333:userpool/eu-west-1_AbCdEf123 \
  --identity-source method.request.header.Authorization
aws apigateway update-method --rest-api-id a1b2c3d4e5 --resource-id k9l8m7 --http-method GET --patch-operations \
  op=replace,path=/authorizationType,value=COGNITO_USER_POOLS op=replace,path=/authorizerId,value=c0gn1t \
  op=add,path=/authorizationScopes,value=orders/read

# REST: REQUEST Lambda authorizer, decisions cached 5 minutes per (Authorization header, tenant)
aws apigateway create-authorizer --rest-api-id a1b2c3d4e5 --name tenant-check --type REQUEST \
  --authorizer-uri arn:aws:apigateway:eu-west-1:lambda:path/2015-03-31/functions/arn:aws:lambda:eu-west-1:111122223333:function:tenant-authorizer/invocations \
  --identity-source 'method.request.header.Authorization,method.request.querystring.tenant' --authorizer-result-ttl-in-seconds 300

# HTTP API: JWT authorizer for a Cognito user pool, attached to a route with a scope
aws apigatewayv2 create-authorizer --api-id x1y2z3 --name cognito-jwt --authorizer-type JWT \
  --identity-source '$request.header.Authorization' \
  --jwt-configuration Audience=4exampleclientid,Issuer=https://cognito-idp.eu-west-1.amazonaws.com/eu-west-1_AbCdEf123
aws apigatewayv2 update-route --api-id x1y2z3 --route-id r0ut31 --authorization-type JWT --authorizer-id j1w2t3 --authorization-scopes orders/read

A REST REQUEST authorizer in Python whose policy covers the whole stage, so a cached decision fits every method:

def handler(event, context):
    token = (event.get("headers") or {}).get("Authorization", "")
    tenant = (event.get("queryStringParameters") or {}).get("tenant", "")
    api_arn, stage = event["methodArn"].split("/")[0:2]  # arn:...:{api-id} and {stage}
    allowed = token.startswith("Bearer ") and tenant != ""  # placeholder for real token checks
    statement = {"Action": "execute-api:Invoke", "Effect": "Allow" if allowed else "Deny",
                 "Resource": f"{api_arn}/{stage}/*"}
    return {"principalId": tenant or "anonymous",
            "policyDocument": {"Version": "2012-10-17", "Statement": [statement]},
            "context": {"tenant": tenant, "plan": "gold"}}

Traps

Practice questions

  1. A REST API must accept OAuth 2.0 access tokens issued by a third-party identity provider and allow access only when the token's tenant claim matches the tenant segment of the request path. Decisions must be cached per token and path. Which authorizer should the developer use?

    • A. A REQUEST Lambda authorizer with the Authorization header and $context.path as identity sources
    • B. A Cognito user pool authorizer with the provider configured as a federated identity provider
    • C. AWS_IAM authorization with a resource policy condition on the tenant
    • D. A Lambda authorizer of type TOKEN that reads the Authorization header

  2. A REST API uses a Lambda authorizer with a 300-second result cache. After a successful GET /orders, users receive 403 on GET /invoices for a few minutes, although they are entitled to both. Which TWO changes fix this? (Select TWO.)

    • A. Raise the authorizer result TTL to 3,600 seconds.
    • B. Change the authorizer type from REQUEST to TOKEN.
    • C. Return a policy whose Resource covers every method the user is entitled to call.
    • D. Set the authorizer result TTL to 0 so each request is authorized on its own.
    • E. Enable API caching on both methods.
Answers
  1. A. A REQUEST authorizer receives the token and the path, and with both as identity sources its cache key covers both. B cannot compare a claim with a path parameter, and federation still issues Cognito tokens rather than accepting the provider's; C requires AWS credentials the callers do not have; D caches on the token alone, so one tenant's decision would be reused for another tenant's path.
  2. C, D. Either make the cached policy cover all entitled methods, or stop caching. A keeps the wrong decision longer; B caches on the token alone, with the same problem; E caches responses, not authorization.

10. CORS

Concept

Exam facts

Developer angle

Lambda proxy function that answers both the preflight and the real request:

import json

CORS_HEADERS = {"Access-Control-Allow-Origin": "https://app.example.com",
                "Access-Control-Allow-Methods": "GET,POST,OPTIONS",
                "Access-Control-Allow-Headers": "Content-Type,Authorization"}

def handler(event, context):
    if event["httpMethod"] == "OPTIONS":
        return {"statusCode": 204, "headers": CORS_HEADERS, "body": ""}
    return {"statusCode": 200, "headers": CORS_HEADERS, "body": json.dumps({"ok": True})}

Gateway responses that keep CORS headers on API Gateway's own errors (OpenAPI extension at the API root):

{"x-amazon-apigateway-gateway-responses": {
  "DEFAULT_4XX": {"responseParameters": {"gatewayresponse.header.Access-Control-Allow-Origin": "'https://app.example.com'"}},
  "DEFAULT_5XX": {"responseParameters": {"gatewayresponse.header.Access-Control-Allow-Origin": "'https://app.example.com'"}}}}

HTTP API CORS configuration and a preflight check with curl:

aws apigatewayv2 update-api --api-id x1y2z3 --cors-configuration \
  '{"AllowOrigins": ["https://app.example.com"], "AllowMethods": ["GET", "POST"], "AllowHeaders": ["authorization", "content-type"], "MaxAge": 300}'

curl -i -X OPTIONS https://x1y2z3.execute-api.eu-west-1.amazonaws.com/orders \
  -H 'Origin: https://app.example.com' -H 'Access-Control-Request-Method: POST'

Traps

Practice questions

  1. A single-page app on https://shop.example.com calls a REST API that uses a Lambda proxy integration. The developer enabled CORS in the console and redeployed, but the browser still reports a missing Access-Control-Allow-Origin header on POST /cart responses. What should the developer do?

    • A. Change the method to an HTTP proxy integration and redeploy the API.
    • B. Add Access-Control-Allow-Origin to the DEFAULT_5XX gateway response of the API.
    • C. Return the Access-Control-Allow-Origin header from the Lambda function.
    • D. Allow the https://shop.example.com origin in the API's resource policy.

  2. A web app calls an HTTP API with an Authorization header. Preflight requests fail with 401 because a JWT authorizer protects the $default route. Which TWO actions resolve this with the LEAST effort? (Select TWO.)

    • A. Set corsConfiguration on the API with the app's origin, its methods and the authorization header.
    • B. Add an OPTIONS /{proxy+} route with an integration and no authorizer.
    • C. Return CORS headers from the backend Lambda function on every route.
    • D. Remove the JWT authorizer and validate tokens in the function.
    • E. Rebuild the API as a REST API with a MOCK OPTIONS method.
Answers
  1. C. With a proxy integration the function's response is what the browser receives, so the function must add the header. A keeps the same responsibility on the backend; B only covers error responses; D is about authorization, not CORS.
  2. A, B. API Gateway answers preflights from corsConfiguration, and an unauthenticated OPTIONS /{proxy+} route keeps the authorizer away from them. C does not help because configured CORS ignores backend headers, and the preflight is rejected before the backend; D weakens security and adds code; E is a migration.

11. Error codes timeouts and payload limits

Concept

Exam facts

Status Typical gateway response or cause First thing to check
400 BAD_REQUEST_BODY, BAD_REQUEST_PARAMETERS Request validator and model
401 UNAUTHORIZED: Cognito or Lambda authorizer rejected the caller, or an identity source is missing Token present, right header, scopes
403 ACCESS_DENIED (authorizer or IAM deny), INVALID_API_KEY, MISSING_AUTHENTICATION_TOKEN (also an unknown path, method or stage), INVALID_SIGNATURE, EXPIRED_TOKEN, WAF_FILTERED, disabled default endpoint URL path and stage, authorization type, API key, WAF logs
404 RESOURCE_NOT_FOUND after authentication and authorization passed Resource exists in the deployed snapshot
413 REQUEST_TOO_LARGE: body over 10 MB Upload to S3 with a presigned URL
414 Method ARN over 1,600 bytes (very long path parameters) Move long values to headers or the body
415 UNSUPPORTED_MEDIA_TYPE: passthrough NEVER or WHEN_NO_TEMPLATES Content-Type and mapping templates
429 THROTTLED (account, stage, method or plan), QUOTA_EXCEEDED (usage plan) Throttle settings; retry with backoff
500 API_CONFIGURATION_ERROR, AUTHORIZER_FAILURE, AUTHORIZER_CONFIGURATION_ERROR; Lambda refused the invocation (missing invoke permission, Lambda throttling) Lambda resource policy, authorizer output, response mappings
502 Lambda proxy: the function failed or returned malformed output Function errors in its logs; statusCode and a string body
503 No REST gateway response type defaults to 503: it usually comes from the backend, passed through a proxy integration or mapped by an integration response Backend health; retry with backoff
504 INTEGRATION_TIMEOUT or INTEGRATION_FAILURE: no backend answer in time Backend latency vs timeoutInMillis

Developer angle

# Customize a gateway response: a clearer 429 body (redeploy afterwards)
aws apigateway put-gateway-response --rest-api-id a1b2c3d4e5 --response-type THROTTLED \
  --response-templates '{"application/json": "{\"message\": \"Too many requests, retry with backoff\", \"requestId\": \"$context.requestId\"}"}'

# Per-integration timeout (above 29000 ms only after the quota increase, Regional or private APIs)
aws apigateway update-integration --rest-api-id a1b2c3d4e5 --resource-id k9l8m7 \
  --http-method POST --patch-operations op=replace,path=/timeoutInMillis,value=25000

# Stream a Lambda response (REST): STREAM mode plus the response-streaming invocation URI, then redeploy
aws apigateway update-integration --rest-api-id a1b2c3d4e5 --resource-id k9l8m7 --http-method GET \
  --patch-operations op=replace,path=/responseTransferMode,value=STREAM \
    'op=replace,path=/uri,value=arn:aws:apigateway:eu-west-1:lambda:path/2021-11-15/functions/arn:aws:lambda:eu-west-1:111122223333:function:report-stream/response-streaming-invocations'

Access log format (JSON) that separates gateway errors from backend errors:

{"requestId": "$context.requestId", "status": "$context.status",
 "errorType": "$context.error.responseType", "errorMessage": "$context.error.message",
 "integrationStatus": "$context.integration.status", "integrationError": "$context.integration.error",
 "integrationLatency": "$context.integrationLatency", "responseLatency": "$context.responseLatency"}

Traps

Practice questions

  1. A report endpoint on a Regional REST API calls a Lambda function that runs for 40–50 seconds. Clients receive 504 after 29 seconds, while the function's logs show it succeeds. The team wants the smallest change that returns the report in the same request. What should the developer do?

    • A. Increase the Lambda function timeout to 60 seconds and redeploy the API.
    • B. Move the API to an edge-optimized endpoint with a longer timeout.
    • C. Enable a 300-second API cache on the report method.
    • D. Raise the integration timeout after a Service Quotas increase.

  2. A browser client uploads files of up to 50 MB through a REST API to a Lambda function and receives 413 errors. Which TWO changes are appropriate? (Select TWO.)

    • A. Request a payload quota increase for the API in Service Quotas.
    • B. Have the API return an S3 presigned URL so the client uploads directly to S3.
    • C. Enable response streaming on the upload method.
    • D. Move to an HTTP API, which accepts larger payloads.
    • E. Process each file asynchronously when it lands in S3, for example from an S3 event notification.
Answers
  1. D. Regional REST APIs can raise the integration timeout above 29 s once the quota is increased. A does not change API Gateway's limit; B moves to the one REST endpoint type that cannot exceed 29 s; C does not make the first, uncached call faster.
  2. B, E. Bypass API Gateway's 10 MB limit by uploading to S3 and processing the object asynchronously. A is impossible because the 10 MB limit is fixed; C applies to responses only; D has the same 10 MB limit.

12. Logging metrics and tracing

Concept

Exam facts

Developer angle

# Once per Region: the role API Gateway uses to write logs
aws apigateway update-account --patch-operations \
  op=replace,path=/cloudwatchRoleArn,value=arn:aws:iam::111122223333:role/apigw-cloudwatch-logs

# Stage logging, metrics, tracing and access logs from a JSON patch file
aws apigateway update-stage --rest-api-id a1b2c3d4e5 --stage-name prod \
  --patch-operations file://stage-logging.json

# Alarm when more than 5 % of prod requests fail with 5XX for 5 minutes
aws cloudwatch put-metric-alarm --alarm-name orders-api-5xx-rate --namespace AWS/ApiGateway --metric-name 5XXError \
  --dimensions Name=ApiName,Value=orders-api Name=Stage,Value=prod --statistic Average --period 60 \
  --evaluation-periods 5 --threshold 0.05 --comparison-operator GreaterThanThreshold

stage-logging.json:

[{"op": "replace", "path": "/*/*/logging/loglevel", "value": "INFO"}, {"op": "replace", "path": "/*/*/logging/dataTrace", "value": "false"},
 {"op": "replace", "path": "/*/*/metrics/enabled", "value": "true"}, {"op": "replace", "path": "/tracingEnabled", "value": "true"},
 {"op": "replace", "path": "/accessLogSettings/destinationArn", "value": "arn:aws:logs:eu-west-1:111122223333:log-group:orders-api-access"},
 {"op": "replace", "path": "/accessLogSettings/format", "value": "{\"requestId\":\"$context.requestId\",\"status\":\"$context.status\",\"latency\":\"$context.responseLatency\"}"}]

Traps

Practice questions

  1. Users report that a REST API is slow. CloudWatch shows Latency averaging 900 ms while IntegrationLatency averages 80 ms for the same method. Where should the developer look first?

    • A. The memory size and code of the backend Lambda function
    • B. Work done inside API Gateway, such as the authorizer and mapping templates
    • C. The read capacity and indexes of the DynamoDB table that the function queries
    • D. The client's network path to the Regional endpoint

  2. A developer turns on execution logging for a REST API stage, but no log group appears and the console reports a problem with the CloudWatch Logs role. Which TWO actions are needed? (Select TWO.)

    • A. Create an IAM role that apigateway.amazonaws.com can assume, with the AmazonAPIGatewayPushToCloudWatchLogs managed policy.
    • B. Add logs:CreateLogGroup to the backend Lambda function's execution role.
    • C. Redeploy the API to the stage after enabling logging.
    • D. Set that role as cloudwatchRoleArn in the API Gateway account settings for the Region.
    • E. Enable detailed CloudWatch metrics on the stage.
Answers
  1. B. About 820 ms is spent inside API Gateway, outside the integration, so authorizers and mapping are the first suspects. A and C are part of IntegrationLatency, which is low; D is outside both metrics, which measure from when API Gateway receives the request.
  2. A, D. API Gateway writes logs through an account-level role per Region. B concerns the function's own logs; C is unnecessary because stage settings apply without a redeploy; E adds metrics, not logs.

13. WebSocket APIs

Concept

Exam facts

Developer angle

aws apigatewayv2 create-api --name chat-ws --protocol-type WEBSOCKET --route-selection-expression '$request.body.action'
aws apigatewayv2 create-route --api-id w1s2k3 --route-key sendMessage --target integrations/i4n5t6

Broadcast handler: reads connection IDs from DynamoDB and deletes the ones that are gone.

import json, os
import boto3

table = boto3.resource("dynamodb").Table(os.environ["CONNECTIONS_TABLE"])

def handler(event, context):
    ctx = event["requestContext"]
    client = boto3.client("apigatewaymanagementapi", endpoint_url=f"https://{ctx['domainName']}/{ctx['stage']}")
    text = json.loads(event.get("body") or "{}").get("text", "")
    for item in table.scan(ProjectionExpression="connectionId")["Items"]:
        try:
            client.post_to_connection(ConnectionId=item["connectionId"], Data=text.encode("utf-8"))
        except client.exceptions.GoneException:
            table.delete_item(Key={"connectionId": item["connectionId"]})
    return {"statusCode": 200}

Execution-role statement that allows the callbacks:

{"Version": "2012-10-17", "Statement": [{"Effect": "Allow", "Action": "execute-api:ManageConnections",
  "Resource": "arn:aws:execute-api:eu-west-1:111122223333:w1s2k3/prod/POST/@connections/*"}]}

Traps

Practice questions

  1. A chat backend keeps WebSocket connection IDs in DynamoDB. During broadcasts some PostToConnection calls fail with GoneException, and the table keeps growing. What should the developer do?

    • A. Increase the WebSocket idle timeout to 2 hours.
    • B. Retry each failed PostToConnection call with exponential backoff and jitter until it succeeds.
    • C. Delete the stored connection ID when PostToConnection raises GoneException.
    • D. Move the authorization logic from $connect to the custom routes.

  2. Clients of a WebSocket API send {"action": "subscribe", "symbol": "ACME"}, and a Lambda function later pushes price updates to subscribed clients. Which TWO configurations are required? (Select TWO.)

    • A. Set the route selection expression to $request.body.action and create a subscribe route.
    • B. Enable API caching on the subscribe route.
    • C. Put the pushing function on a usage plan so it may call clients.
    • D. Attach a JWT authorizer to the subscribe route.
    • E. Allow the pushing function's role execute-api:ManageConnections and call the @connections endpoint for each connection.
Answers
  1. C. A gone connection never comes back, so its record should be deleted. A is impossible because the idle timeout is fixed at 10 minutes; B retries calls that cannot succeed; D does not affect stale connections.
  2. A, E. The route selection expression sends subscribe messages to their route, and the function pushes updates through @connections with ManageConnections. B: WebSocket APIs have no cache; C: usage plans don't grant callback rights; D: JWT authorizers belong to HTTP APIs, and WebSocket authorization runs on $connect.

14. OpenAPI import export and SDK generation

Concept

Exam facts

Developer angle

OpenAPI 3.0 definition (YAML) with a Lambda proxy integration, a Cognito authorizer and a body validator:

openapi: "3.0.1"
info: {title: orders-api, version: "1.4.0"}
x-amazon-apigateway-request-validators:
  body-only: {validateRequestBody: true, validateRequestParameters: false}
paths:
  /orders:
    post:
      security: [{OrdersUsers: []}]
      x-amazon-apigateway-request-validator: body-only
      requestBody:
        required: true
        content: {application/json: {schema: {$ref: "#/components/schemas/Order"}}}
      responses: {"200": {description: Order accepted}}
      x-amazon-apigateway-integration:
        type: aws_proxy
        httpMethod: POST
        uri: arn:aws:apigateway:eu-west-1:lambda:path/2015-03-31/functions/arn:aws:lambda:eu-west-1:111122223333:function:orders-api/invocations
components:
  schemas:
    Order: {type: object, required: [sku, quantity], properties: {sku: {type: string}, quantity: {type: integer, minimum: 1}}}
  securitySchemes:
    OrdersUsers:
      {type: apiKey, name: Authorization, in: header, x-amazon-apigateway-authtype: cognito_user_pools,
       x-amazon-apigateway-authorizer: {type: cognito_user_pools, providerARNs: ["arn:aws:cognito-idp:eu-west-1:111122223333:userpool/eu-west-1_AbCdEf123"]}}

# Create the API from a file, later merge an updated file, then deploy
aws apigateway import-rest-api --parameters endpointConfigurationTypes=REGIONAL --fail-on-warnings --body fileb://orders-api.yaml
aws apigateway put-rest-api --rest-api-id a1b2c3d4e5 --mode merge --body fileb://orders-api.yaml
aws apigateway create-deployment --rest-api-id a1b2c3d4e5 --stage-name prod

# Export the prod stage as OpenAPI 3.0 YAML with integration extensions, and generate a JavaScript SDK
aws apigateway get-export --rest-api-id a1b2c3d4e5 --stage-name prod --export-type oas30 \
  --parameters extensions='integrations' --accepts application/yaml orders-api-prod.yaml
aws apigateway get-sdk --rest-api-id a1b2c3d4e5 --stage-name prod --sdk-type javascript orders-api-js-sdk.zip

# HTTP API: import a definition, export a stage
aws apigatewayv2 import-api --body file://orders-http.yaml
aws apigatewayv2 export-api --api-id x1y2z3 --specification OAS30 --output-type YAML --stage-name prod orders-http-prod.yaml

Traps

Practice questions

  1. Two teams maintain separate OpenAPI files for different paths of one REST API and release on different days. A developer must apply team B's file without removing the paths defined only in team A's file. Which command should the developer run before deploying?

    • A. aws apigateway put-rest-api --mode merge with team B's file
    • B. aws apigateway put-rest-api --mode overwrite with team B's file
    • C. aws apigateway import-rest-api with team B's file
    • D. aws apigatewayv2 reimport-api with team B's file

  2. A company wants to keep an existing REST API's definition in source control and recreate the API, with all its Lambda integrations, in another account. Which TWO steps support this? (Select TWO.)

    • A. Generate a JavaScript SDK with get-sdk and commit it.
    • B. Export the stage with get-export using the integrations (or apigateway) extensions.
    • C. Export the stage with get-export without extensions so the file stays portable.
    • D. Import the file in the target account with import-rest-api, adjust the account-specific ARNs and create a deployment.
    • E. Copy the stage's deployment ID into a stage in the target account.
Answers
  1. A. Merge applies team B's definitions and leaves team A's paths in place. B deletes what the file does not define; C creates a separate API; D is the HTTP API command.
  2. B, D. Exporting with extensions keeps the integrations, and importing plus deploying recreates the API. A produces a client library, not the API definition; C drops the integrations; E fails because deployment IDs belong to one API.

Quick decision rules

API types, endpoints and integrations (§1–§4)

Deployment, caching and throttling (§5–§7, §14)

Security (§8–§10)

Errors, limits and monitoring (§11–§13)

Changed vs older material

Learn the Current column; older practice material may still show the Course / older material value. After you confirm them, the same rows go into notes/current-facts.md with their verification dates.

Topic Course / older material Current (verified 2026-10-12) Source
§11 · REST integration timeout 29 s maximum, hard limit for every API REST 50 ms–29 s by default; Regional and private REST APIs can exceed 29 s through Service Quotas (L-E5AE38E3, since 2024-06-04), possibly lowering the account throttle quota; edge-optimized stays at 29 s; HTTP APIs 30 s fixed; WebSocket 29 s AWS docs
§11 · REST response streaming Not available: the full response is always buffered, so the 29 s and 10 MB caps always apply Since 2025-11-19 on all REST endpoint types: responseTransferMode STREAM (default BUFFERED) on HTTP_PROXY/AWS_PROXY; up to 15 min; over 10 MB (2 MB/s after the first 10 MB); idle timeout 5 min (Regional/private) or 30 s (edge); no caching, VTL response transformation or content encoding; requests stay capped at 10 MB AWS docs
§7 · Account-level throttle 10,000 requests per second across all APIs (soft limit) 10,000 rps with a 5,000 burst per account per Region, shared by REST, HTTP and WebSocket APIs; 13 newer Regions default to 2,500 rps with a 1,250 burst; the rate is adjustable (L-8A5B8E43), the burst is set by AWS AWS docs
§12 · Execution log levels ERROR, DEBUG, INFO OFF, ERROR, INFO, plus a separate data-tracing switch for full payloads AWS docs
§5 · Stage variables reaching Lambda Passed to the Lambda "context" object In the request event: event['stageVariables'] with Lambda proxy; via the mapping template ($stageVariables) with a custom integration AWS docs
§13 · WebSocket callback URL wss://{api-id}.execute-api.{region}.amazonaws.com/{stage}/@connections/{connectionId} https://{api-id}.execute-api.{region}.amazonaws.com/{stage}/@connections/{connectionId}, SigV4-signed, execute-api:ManageConnections AWS docs
§4 · HTTP API data mapping HTTP APIs have no data mapping Parameter mapping: request headers and query strings (append, overwrite, remove), the path (overwrite), response headers and the status code; no body transformation (VTL) and no request validation AWS docs
§10 · Where the CORS headers go The OPTIONS preflight request must contain Access-Control-Allow-Methods, -Headers and -Origin They are returned in the response to the preflight (the OPTIONS method's 200 response); the browser's preflight carries Origin and Access-Control-Request-Method AWS docs
§3 · REST private integrations A REST API reaches private resources only through an NLB (VPC link) VPC link V2 to an Application Load Balancer or a Network Load Balancer (HTTP_PROXY, connectionType VPC_LINK); VPC link V1 integrations can be switched to V2 AWS docs
§9 · Lambda authorizer output Every Lambda authorizer returns an IAM policy REST: principalId + IAM policy; HTTP API payload 2.0 with simple responses: {"isAuthorized": true} or false AWS docs