Protect AWS API Gateway Endpoints using API Keys

Overview

AWS API Gateway offers various ways to protect API endpoints, most recently AWS announced Private Endpoints which are only accessible from VPC. In addition to that, you can protect APIs using the following methods

Custom Authorizers
API Keys
Client Certificates
Or a combination of these

In this post, we will cover the API keys method only. Using API keys you can also create Usage Plans which allows you to enable Throttling and Quota on the APIs.

API Keys

Example

In this example, we have an AWS lambda function which is exposed using the AWS API Gateway endpoint, we will protect the endpoint using API keys and test it using Postman tool. The API is called My API with a resource called hello and a GET method calling Lambda function hello-lambda as shown on the slide.

[File:]

Before API key protection you can call the API using the browser or Postman

Create API Keys

The first step is to create API Keys, the steps are simple

Log in to AWS Console and AWS API Gateway
Click on API Keys then from the Actions drop-down list select Create API key
Enter required API key name and description

Enable API Key on Method

Next is to enable your method to accept API Keys

Click on the API then Resources and click on the method you want to enable API keys, in our case it is hello/Get method

Click Method Request and select true from the API Key Required drop-down list

Create Usage Plan

Next step is to create a Usage Plan

Click on Usage Plan in AWS API Gateway Console then click Create

Enter Name of the plan, Throttling, and Quota info as per your requirement.

Practical Tip: You can create multiple usage plans and assign to different APIs, the plan will be enforced based on the API key, for example, you can have different membership levels such as Free, Basic and Pro plans and limit the quote and throttling accordingly.