api-gateway_skill

Overview

This skill provides practical guidance and commands for managing AWS API Gateway (REST, HTTP, and WebSocket). It helps you create APIs, configure integrations and authorizers, manage stages and CORS, implement rate limiting, and troubleshoot common API issues. The focus is on actionable CLI patterns, deployment tips, and operational best practices.

How this skill works

The skill documents core API Gateway concepts (API types, resources, methods, integrations, and stages) and maps them to CLI and infrastructure-as-code examples. It includes step-by-step AWS CLI commands for creating HTTP and REST APIs, wiring Lambda integrations, enabling CORS, and setting up JWT authorizers. Troubleshooting sections explain common error causes and diagnostic CLI checks.

When to use it

• When creating a new public or internal HTTP/REST API backed by Lambda or HTTP endpoints.
• When configuring authorization (JWT, Lambda authorizers) and CORS for browser clients.
• When deploying stages, enabling canaries, or managing stage settings like throttling and caching.
• When implementing rate limiting, API keys, or WAF protections to secure and protect backends.
• When troubleshooting 403/502/504/CORS errors and validating integration responses and logs.

Best practices

• Prefer HTTP APIs for simple, low-latency workloads; use REST APIs when you need advanced transformations or features.
• Enable access logging, CloudWatch monitoring, and set appropriate throttling and caching to protect backends.
• Use JWT or other authorizers for authentication and API keys only for usage plans and rate limiting, not as auth.
• Use regional endpoints unless you require global distribution; enable HTTPS and WAF for public APIs.
• Adopt canary deployments and stage variables for safer updates and gradual rollouts.

Example use cases

• Create a low-cost HTTP API that proxies requests to a Lambda function for a microservice.
• Deploy a REST API with Lambda proxy integration and enable response transformations and caching.
• Add JWT authorization using Cognito or an external provider for authenticated mobile and web clients.
• Configure CORS and preflight OPTIONS for a single-page app calling your API from a browser.
• Troubleshoot a 502 error by validating the Lambda response format and checking CloudWatch logs.