API Gateway is a managed service by AWS that sits in front of applications and provides resource and method level control over HTTP and RESTful APIs. It can authorize access, rate limit requests, and integrate with services like Lambda and Cognito. API Gateway helps standardize API URIs, monitor usage with dashboards, and provide a single entrance point to multiple backends for microservices. However, managing API Gateway requires considerations around infrastructure as code, debugging, and continuous delivery challenges. Key requirements of an API gateway include single entry point, authentication, traffic control, formatting transformations, security, networking, developer portals, and operational aspects like deployments, logging, and monitoring.

1. API GATEWAY
David

2. - AWS Managed Service
- In Front of Your Applications
- Serverless
- Resource / Method Level Control
- HTTP / RESTful / WebSocket API
- Authorize
- Rate Limit / Throttle

5. IMAGE: https://dashbird.io/knowledge-base/api-gateway/what-is-an-api-gateway/

8. WHY
•Legacy API
- Complicated Authorization Mechanism
- Resource / Method Legacy Design
- Complicated Payload
- Performance
- From JSON Input Transform To XML
•Microservice
- Don’t wanna publish all API
- Monitoring
- Easy To Collect API Logs
•Serverless
- This Is A Serverless Architecture,
Which Means Scalability And Reliability Could be AWS’s Responsibility
- Integrate With Lambda or Fargate

9. Solution
- DDOS Defense ( By Rate-Limit )
- Throttle API Requests (429 Too Many Requests)
- Authorization Management
- IAM Permission
- Lambda
- Cognito
- Some APIs Shouldn’t Public
- Handle CORS
- Handle API Key
Security & Authorization

10. Solution
- Standardization API URI
- xxxxx.com/v1.0/ec2
- xxxxx.com/v1.1/vpc
- Dashboard to Monitor API Usage
- Do Not Modify/Refactor Backend Codebase As Possible As We Can
- New/Old Version Could be Online In Parallel
- Could be Combined With Developer Portal
- One APIGW, Multiple-Backends but also Single Entrance
Microservice

11. BUT
- Who Should Manage The APIGW?
- Normally Developer Should Responsible For Their Own API
- When You’re Modifying The API, You’ll Have To Do Twice
- IaC Integration & IaC CI/CD & CodeReview
- Flexible & Easy-Using IaC Modules
- Learning Curve
- Single Point of Failure
- Debugging Could be Harder
- CI/CD and Deployment Challenges

12. IMAGE: https://divante.com/blog/10-companies-that-implemented-the-microservice-architecture-and-paved-the-way-for-others/

13. What Do We Want
•Key Requirements
- Single Entry Point
- Auth
- URL Route Standardization
- Traffic Control & Rate Limit
- Formatting Transformation
•Security & Networking
- ACL / SSL / WAF / Token Management
- HA / LoadBalancing
- Scalability
- CDN
•Development
- Developer Portal & Swagger
•Operation
- Canary / A-B / Blue-Green Deployment
- API Key Management
- Logging / Monitoring / Alert