Securing API Gateway

The API Gateway service is a managed solution and is designed to be scalable to extreme capacity and receive any amount of traffic that is sent to it. But how does that work when the traffic coming into API Gateway is not legitimate? For example, how can we secure our API Gateway from a malicious attacker sending bogus requests and racking up our connection attempts and our AWS bill? We will try and answer all of the questions about the security of the API Gateway service in this section.

Authentication and authorization

To secure API Gateway, we can control the authentication, authorization, and control of access for any users accessing API Gateway. We have several mechanisms that will allow for controlling...