AWS API Gateway

Recently, I had to setup AWS API Gateway in my org and learnt quite a bit in the process. This blog would hopefully help others in avoiding several gotchas and also serve as a reference for me in the future

What’s an API Gateway

So, an API Gateway is usually an API management tool that sits in front of your backend services and acts as a reverse proxy. It can perform a bunch of tasks like authentication, API metering, API throttling etc.

AWS API Gateway does provide some of these functionalities, but in many ways it’s more used as a way to provide a public endpoint to internal AWS services

Our use case

We had a unique situation where all our services resided on K8s, so Istio was serving our needs well enough in routing requests to our internal services. But, over time we had use cases where we wanted some of our API endpoints to be served by AWS Lambdas and eventually we started looking into AWS API Gateway.

Given that we already had a working setup with k8s/istio, we really needed API Gateway to play well with that

Setup

Since we were using k8s/istio, we had an istio ALB sitting in front of our services and API Gateway needed to route requests to this. But, API Gateway cannot directly send data to an ALB. So, we need to connect an NLB to API Gateway and make the NLB forward data to the ALB. So, the data flow will be as follows:

User → API Gateway → VPC Link → NLB → k8s ALB → Service deployed in k8s

VPC Link is an API Gateway feature used to setup an NLB connection

Get Hashken Distro’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

A good reference: https://aws.amazon.com/premiumsupport/knowledge-center/api-gateway-application-load-balancers/

API Gateway Configuration considerations

Rest vs Http

• AWS API Gateway offers 2 variants — Rest vs Http
• Http APIs are simpler and cheaper in terms of cost
• Rest APIs are more configurable
• Specifically, only Rest APIs offered the features which we were looking for — Edge optimized APIs, Rate limiting
• Reference: https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-vs-rest.html

Resource Definitions

• If we need to route all requests under a specific prefix, say /foo/, then there’s an option to define a greedy path matching variable like /foo/{proxy+} which matches all subrequests under /foo/
• But, /foo itself will not match with the above. We need create a separate Resource and method defns for /foo
• Surprisingly, /foo/still matches with the method we define for /foo
• The implication for this is that, currently there is no way to set up a redirect in API Gateway from /foo to /foo/

Endpoint URL

• In the Integration Request for a method; for proxy integrations, there is a config named Endpoint URL
• The value here is interpreted by API Gateway in multiple ways. For eg. take https://internal.com/foo/{proxy}
• https: Protocol used to connect
• internal.com: This will be set as the value for the Host header
• /foo/: This is added as a prefix to any request we make, before making it to the backend service
• For eg: If /test/{proxy} is the resource path and external.com is the externally configured domain for the API Gateway, then the request to https://example.com/test/bar.html will be proxied to https://internal.com/foo/bar.html
• Note that the NLB to which the requests are sent to is only determined by the VPC Link that is configured.

NLB

• The NLB that we configure needs to have listeners for all the protocols/ports that we wish to proxy to the k8s ALB