Okay.
Hello loggers and welcome to this lecture and this lecture we're going to look at API gateway.
So what is API Gateway.
Well basically it's a fully managed service that makes it easy for developers to publish maintain monitor
and secure APIs at any scale.
And I want you to think of it basically as a it's basically a doorway into your E.W. s environment.
So within a few clicks of AWB s management console you can create an API that acts as a front door for
applications to access data or business logic or functionality from your backend services such as applications
running on easy to code running on a W.S. lambda or any web application.
So API Gateway is just a front doors sort of like sort of like a load balancer in some regards in that
it's going to distribute traffic across multiple sources but it's quite different in that you know you
don't need to see two instances behind it API Gateway is basically a doorway into your NWS environment.
And typically you'd use it to communicate to lambda functions.
You can use it to communicate to E2 and other things like dynamic DP etc..
So let's have a look at this in action.
So we've got our users and now users do a call to our API Gateway and our API Gateway is basically the
front end or the front door to our whole E.W. s environment and depending on that call that could then
be passed to Lambda it could be passed through to an easy to instance or it could be writing something
to dynamo D.B..
So that's how API Gateway works in terms of what it can do.
Well it can expose hasty G.P.S. endpoints to define a restful API.
It can serve closely.
That's a word connect to services like lambda and dynamo DP.
It can send each API endpoint to a different target so you can have different API endpoints pointing
to different things runs efficiently with very low cost.
It scales effortlessly we add a cloud guru use API Gateway we've been using it since its very inception.
So right now if you're watching this on the cloud platform your browser is literally communicating with
API Gateway and we don't.
In terms of scaling it just scales automatically we don't have to worry about auto scaling groups or
anything like that.
It literally just scales or automatically along with your traffic and then you can track and control
usage by using an API key you can throttle requests to prevent an attack.
So sometimes attackers could try and flood your API to try and cost you lots of money or to try and
take it down but you can actually just throttle requests to stop people from doing that as well.
And you can connect it to cloud watch to log requests for monitoring as well and then you can also maintain
multiple versions of your API so you could have a test and Dev API which is separate to your production
API in terms of how you configure it.
We are going to go and do this in the next section of the course.
But what what you have to do is just go in and define an API or a container and then you define the
resources and nested resources within it using you are old paths and for each resource you basically
select the supported each TTP method.
So this could be get or post or any of each TTP methods.
And again we're going to go and do this in the next section of the course.
You then set up your security and then you choose your targets.
So what if you're getting a get request to this particular API point where is it going to go is it going
to go to E2 to Lambda to dynamo D.B. etc. and again don't worry if this sounds a bit overwhelming the
best way to learn NWS is by getting your hands dirty.
So we will be doing this in the next section of the course.
And then you can set requests and response transformations as well.
So how do you deploy it or you basically deploy API gateway to a stage and it uses the API Gateway domain
by default so it's going to have its own domain name but you can also use a custom domain name as well
so you could use a cloud dot carrier or API to a cloud Docker and it also now supports AWB cert manager
for free SSL or Telus certificates you can use CBS with API Gateway and you get those certificates for
free if you've been using certificate manager to register your SSL certificates in terms of what you
need to understand for the exam.
The first thing is around API caching so API caching in API Gateway is a way to cache your endpoints
response with caching you can reduce the number of calls made to your endpoints and also improve the
latency of request to your API.
And when you enable caching for a stage API Gateway caches responses from your endpoints for a specified
time to leave or TTL period just like what we saw in cloud front.
And that's always going to be in seconds.
And then API Gateway then responds to the request by looking up the endpoint response from the cache
instead of making the request request to your endpoint.
So let's however look at how that works got our user user one makes a request to our API Gateway it
then affords that maybe it's a get request and it sends that on to Lambda Lambda goes ahead and gives
a response.
And then you've got your second user who does the exact same request and API Gateway has cash that now
so it doesn't go to your lambda function it just sits in the cash and returns the same response to the
user.
So another thing we need to talk about in terms of API Gateway is around cross origin resource sharing
and in order to understand cross origin resource sharing we need to first understand the same origin
policy.
And this is a really important concept in web application security model.
Basically under the policy a web browser permit scripts contained in a first web page to be able to
access data in a second web page but only if they both have the same origin.
In other words only if they have the same domain name.
So one page can talk to another page provided that first page has the same domain name.
And that's called same origin policy.
And this is basically done to stop other malicious websites from attacking other websites.
It's sometimes called cross site scripting.
Another thing to remember that this is enforced by web browsers however some tools like postmen and
curl do ignore it.
So all this is done to prevent cross site scripting.
However when we look at things like Amazon we are always using different domain names.
So when we're using S3 we're using the S3 domain name when we're using cloud front we're using the domain
name for our cloud from distribution when we're using API Gateway we're going to be using the API Gateway
domain name.
And this can be more of a hindrance than it is as a whole.
Now the way to turn this off or the way to allow our different NWS components to talk to each other
is using cores and cores stands for cross origin resource sharing and cause is one way that the server
at the other end not the client code in the browser can relax the same origin policy cross origin resource
sharing is a mechanism that allows restricted resources e.g. fonts for example on a Web page to be requested
from another domain outside the domain from which the first resource was served.
So causes a way of one to a Web page in one domain being able to talk to a Web page in another domain
and request resources from it.
That's all it is.
So let's have a look at how cause works.
So a browser makes a heap TDB options call for you RL and options is just a heap DDP method just like
get or put or post etc. and then the server returns a response that says these are the other domains
that are approved to get this U.R.L. and then you might get an error message and sometimes it would
say origin policy cannot be read at the remote resource and if you see that that error message.
This basically means you need to enable cause on your API gateway.
So this is critical going into your exam if you see something where it's talking about origin policy
cannot be read at the remote resource.
It means the cause is not enabled on your API Gateway API gateway essentially is not able to go and
request that that information from the other side.
So don't worry this is all overwhelming.
We're going to go into API gateway in the next section of the course we're going to start using it to
build service web sites.
I'm just remember in terms of API Gateway my exam tips so just remember what API gateway is at a high
level.
It's essentially a door to your NWS environment.
Remember that it has caching capabilities to increase performance so you can cache common requests their
cash for the length of the time to live that you specify.
And that's always going to be in seconds.
Remember the API Gateway is low cost and it scales automatically.
You don't have to worry about auto scaling groups or anything like that API gateway will always scale
depending on what settings that you put on it and if you are getting attacked you can throttle API gateway
so you can throttle API gateway to prevent attacks.
So it does scale automatically but you can throttle that scaling.
You can log all your results to cloud watch where they've API Gateway and then also if you're using
JavaScript or Ajax that uses multiple domain names with API Gateway just enable or ensure that you always
have enabled cores on the API gateways it causes cross origin resource sharing.
And just remember that cause is enforced by the client.
So it's enforced by your browser.
So that is it for this lecture everyone in the next lecture.
We're going to have a high level look at what assesses and the three different types of cancers we're
then going to go on and summarize everything we've learnt in the application section of the course and
then we're ready to move on to the last section of the course which is our service as part of the course
where we're going to build out some surplus Web sites if you've got the time please join me in the next
lecture.