Securing an API

Security of the resources you are trying to protect is an important topic, and that's why we are covering it before getting into explaining how to build and deploy APIs. API Gateway is often used as a security appliance as a front door for client connections. This is a good idea, so it pays to familiarize ourselves with our options.

In this section, we will cover IAM permissions, authentication with Amazon Cognito, Lambda authorizers, and certificate management.

IAM permissions and policies

The first option to cover is the IAM authentication method for securing APIs. To clarify, there are two main ways to use IAM:

• The first is to provide administrative access to create, update, maintain, and delete APIs...