Amazon API Gateway offers a smart solution to throttle and rate-limit API clients that do not send API keys in the request header — Throttling and rate-limiting API requests with Amazon API Gateway happens to be very straightforward. The API provider shares a unique API key with the API client and the client is expected to send that key in the x-api-key HTTP header, along with the request. At the API Gateway level, this…

An opinionated solution to delayed processing of API requests — Problem statement Let us assume a scenario where we have to process events initiated by API calls that will have to be triggered only once at a specific time in the future. Moreover, the ‘future timestamp’ is supplied along with the request. Essentially, this means that the API call will still carry…

Simple yet powerful API authorization scheme leveraging transport layer trust X.509 certificates are at the core of Mutual TLS (MTLS) based authentication. Essentially a certificate represents the identity of clients/partners and is used to authenticate a trusted party. This post will attempt to describe an API authorization scheme that leverages…

On-boarding trusted clients and partners on Amazon API Gateway gets more secure with Mutual TLS Mutual TLS or MTLS is the de-facto transport layer security standard used in critical Business-to-Business (B2B) and Internet of Things (IoT) integrations. Essentially Mutual TLS establishes a two-way trust in a client-server communication channel. So…

Simple yet elegant batch processing with S3, Lambda, DynamoDB and SNS — An interesting way to process a batch of records in the AWS Serverless world is to leverage the event triggering capabilities of S3, the power of Lambda, backed by a database service like DynamoDB and finally SNS for notifications. For simple batch processing scenarios, this solution could be very effective…

“The only secrets are the secrets that keep themselves”- George Bernard Shaw Leveraging a service like AWS Secrets Manager, to outsource secured storage and life-cycle management of secrets (like passwords, API keys, tokens, encryption keys, etc.) is becoming quite commonplace. Essentially, this practice keeps the application code clean and devoid…

In this post, we will go through the steps to expose a SOAP service as a RESTful API using AWS API Gateway and Lambda. The primary driver for such a solution is often incompatibilities of systems involved in the integration. …

If you are a Kubernetes enthusiast but have not yet experimented with MicroK8s, then this post is for you. MicroK8s is CNCF certified upstream Kubernetes deployment that can run on your laptop, workstation or on edge devices. It runs all the Kubernetes services natively and unlike Minikube, doesn’t require a…

Use Lambda context to perform more than just authorization — Lambda authorizers are used to control access to APIs published in AWS API Gateway. They help to implement custom authorization schemes that either use token based authentication strategies (like OIDC, SAML, etc.), or use one or more request parameters to establish the API caller’s identity. There are essentially two types…