API Gateway · HTTP and REST APIs

Outcome

• HTTP APIsYour First HTTP API
  • Explain the difference between execution role (what Lambda can do) and resource policy (who can invoke Lambda)
  • Manually add a Lambda resource policy via CLI for an API Gateway integration
  • Explain why a missing resource policy causes a silent 500/502 with no Lambda logs
  • Explain why missing AWSLambdaBasicExecutionRole makes Lambda run silently without logs
• HTTP APIsAuthentication: Three Patterns
  • Create an HTTP API with routes, Lambda proxy integration, and auto-deploy stage via CLI
  • Explain the HTTP API v2.0 event structure (pathParameters, queryStringParameters, body as string)
  • Explain the required Lambda response structure (statusCode, headers, body as string)
  • Explain why returning body as an object (not string) causes a 502
  • Explain the $default catch-all route and why it suppresses 404s
• HTTP APIsRequest Validation and Error Handling
  • Create a Lambda authoriser with simple response format
  • Explain the difference between 401 (missing identity), 403 (denied), and 500 (authoriser bug)
  • Configure authoriser caching TTL and explain the stale permissions tradeoff
  • Explain why IAM auth is appropriate for service-to-service but not for browser clients
• HTTP APIsThrottling and Rate Limiting
  • Create a REST API with a JSON Schema model and request validator
  • Verify that invalid requests are rejected before Lambda is invoked (no Lambda logs for bad requests)
  • Explain the 504 timeout: API Gateway times out, Lambda keeps running, client got an error but work may have completed
  • Implement the async pattern: POST returns 202 immediately, job queued in SQS, worker processes separately
• HTTP APIsCustom Domains, CORS, and Production Patterns
  • Configure stage-level and route-level throttling on an HTTP API
  • Verify throttled requests don't appear in Lambda metrics (they never reach Lambda)
  • Explain why 429 (throttle) and 403 (auth denied) look similar and how to distinguish them
  • Explain the token bucket model (rate = refill rate, burst = bucket size)
• HTTP APIs
  • Configure CORS on an HTTP API at the API level (not in Lambda)
  • Explain why a Lambda error without CORS headers causes a browser CORS error instead of the real error
  • Create multiple stages with stage variables
  • Explain the four steps to configure a custom domain (ACM → custom domain → API mapping → Route 53)
  • Explain why a stage variable typo is a runtime error, not a deployment error