Doug created a serverless API using API Gateway and Lambda to support a coffee review app. The API experienced errors during peak morning usage. Doug used CloudWatch metrics and logging to identify a bug causing excessive requests. He throttled the affected method to limit impact and deployed a fix. As the app grew popular, Doug enabled authentication and usage plans to allow third parties controlled access. He also implemented stages and deployment tools to formalize updates to the API.

1. Operating your Production API
Presenter: Paul Underwood, Solution Architect
Author: Bob Kinney, SDE – AWS Serverless
1/26/2017 - San Francisco

2. What to Expect from the Session
Brief review of API Gateway/Lambda
Monitoring Your API
Amazon CloudWatch Metrics/Alarms
Amazon CloudWatch Logs
Protecting Your API
Throttling
Authorization
Usage Plans
Managing Your API

3. Amazon API Gateway
Create a unified
API frontend for
multiple micro-
services
Authenticate and
authorize
requests to a
backend
DDoS protection
and throttling for
your backend
Throttle, meter,
and monetize API
usage by 3rd party
developers

4. API Gateway integrations
Internet
Mobile Apps
Websites
Services
AWS Lambda
functions
AWS
API Gateway
Cache
Endpoints on
Amazon EC2
All publicly
accessible endpoints
Amazon
CloudWatch
Monitoring
Amazon
CloudFront
Any other AWS
service

5. Cost-effective and
efficient
No Infrastructure to
manage
Pay only for what you use
Bring Your
Own Code
Productivity focused compute platform to build powerful, dynamic, modular
applications in the cloud
Run code in standard
languages
Focus on business logic
AWS Lambda
1 2 3

6. Meet Doug
• Doug loves coffee.
• Doug also writes apps.
• Doug built TAMPR – A service for
sharing reviews of coffee and coffee
shops.
• Doug built the TAMPR backend
serverless, with API Gateway and
AWS Lambda.

7. First Reviews of TAMPR
• “I want to love this app, but every
time I try to check-in with my
morning coffee, I get errors.”
• “The app works great if I’m getting
an afternoon coffee, but during the
mornings it’s almost unusable.”
• “Too many errors, it never seems to
work.”

8. Monitoring Your API:
Amazon CloudWatch Metrics

9. Amazon CloudWatch Metrics
• API Gateway Default metrics set
• Count – Total number of invokes received by API Gateway
• 4XXError – Number of invokes that generated a 4XX error
• (includes throttling)
• 5XXError – Number of invokes that generated a 5XX error
• Latency – Total time API Gateway took to fully process request
• IntegrationLatency – Time API Gateway took to call integration
• CacheHitCount – Number of successful cache fetches
• CacheMissCount – Number of unsuccessful cache fetches

10. Amazon CloudWatch Metrics
• Detailed metrics
• Same set of metrics at method level
• Can be enabled globally or only for specific methods
GET PUT DELETE

11. Amazon CloudWatch Metrics
• Default Metrics
• Included for free
• Broken down by API stage
• Detailed Metrics
• Standard CloudWatch pricing
• Broken down by method

12. Amazon CloudWatch Alarms
• Any metric can be tied to an alarm
• Alarm notifications can be sent to Amazon SNS topic
• SNS topic can then send to any number of destinations
– E-mail address
– SQS queue
– Lambda Function

13. CloudWatch Alarms - NEW
• Error and Cache metrics now support averages and percentiles
• Alarm on the rate of failures in your API, not just raw count!

14. Example:

15. Check in with Doug
Doug now has alarms to be alerted
when his customers get errors calling
his serverless API, but how does he
know why his customers get errors?

16. Monitoring Your API:
Amazon CloudWatch Logs

17. Amazon CloudWatch Logs
• API Gateway Logging
– 2 Levels of logging, ERROR and INFO
– Optionally log method request/body content
– Set globally in stage, or override per method
• Lambda Logging
– Logging directly from your code
– Basic request information included
• Log Pivots
– Build metrics based on log filters
– Jump to logs that generated metrics

18. Amazon CloudWatch Logs
• So many log streams…

19. CloudWatch Logs
• apilogs - https://github.com/rpgreen/apilogs
• Search and Stream your API Gateway logs (and Lambda)
• Basic syntax highlighting
• View API Gateway and Lambda logs together

20. APILogs Examples:
• Install:
– pip install apilogs
• tail –f for API Gateway/Lambda
– apilogs get --api-id xyz123 --stage prod –watch
• grep for API Gateway / Lambda
– apilogs get --api-id xyz123 --stage test2 --profile myprofile --aws-region us-
east-1 --start='2h ago' --end='1h ago' | grep "ERROR"

22. Check in with Doug
• Thanks to logging, Doug now knows
that his API is generating errors
during peak loads because there’s
spurious traffic hitting a particular
API method at a much higher than
expected rate due to a bug in the
mobile app.
• He now needs a way to to limit the
traffic from those devices to let other
traffic through.

23. Protecting Your API:
Throttling

24. API Gateway Throttling
• 3 levels of throttling for APIs
• API Key level throttling – Configurable in usage plan
• Method level throttling – Configurable in stage settings
• Account level throttling – Limits can be increased

25. API Gateway Throttling
• Token bucket algorithm
• Burst – the maximum size of the bucket
• Rate – the number of tokens added to the bucket

26. API Gateway Throttling - NEW
• Limits apply in order of most specific to least specific
– API Key, Method, Account
• Requests throttled for any reason will no longer be billed

27. Check in with Doug
• Thanks to throttling, Doug has
limited the impact from the buggy
version of the application to only
affecting the one method.
• He can ship updates to affected
customers to re-route traffic as
needed.

28. TAMPR Promotions
TAMPR has become popular and
coffee shops and roasters are
contacting Doug to discuss
possibilities of promotions through the
app.
Doug needs a way to allow these
shops to create accounts and create
and edit promotions on demand.

29. Protecting Your API:
Authentication/Authorization

30. Authentication Type Comparison
Feature AWS_IAM CUSTOM COGNITO
Authentication X X X
Authorization X X
Signature V4 X
Cognito User Pools X X
Third Party Authentication X
Additional Costs NONE Pay per authorizer
invoke
NONE

31. API Gateway Authorization - NEW
CUSTOM Authorizers support additional returned context
• Key/value dictionary
Requests that fail auth will no longer be billed

33. Check in with Doug
• TAMPR promotions have been a hit
and the app is more popular than
ever. Doug is now speaking with
other services, such as a new site
focused on brunch spots, on how
they can work together.
• Doug wants a way he can expose
portions of his API to these third
parties, but track their usage for
potential billing opportunities.

34. Protecting Your API:
Usage Plans

35. API Gateway Usage Plans
• API Key Throttling
• Rate/Burst per API Key
• API Key Usage
• Daily usage records
• API Key Quota
• Periodic limits per API Key

37. Check in with Doug
• TAMPR is continuing to grow and
Doug is now bringing in people to
help work on updates.
• He is looking for ways to formalize
the update process.

38. Managing Your API

39. API Stages
• Stages are named links to a deployed version of your API
• Recommended for managing API lifecycle
• dev/test/prod
• alpha/beta/gamma
• Support for parameterized values via stage variables

40. Lambda Versions
• Maintain multiple versions of your Lambda code and link an named alias.
• Works great in combination with API stages and stage variables.

41. Custom Domains
• Run your APIs within your own DNS zone
• Recommended for supporting multiple versions
• api.tampr.com/v1 -> restapi1
• api.tampr.com/v2 -> restapi2

42. Swagger
• Portable API definition (JSON/YAML)
• Import/Export your API
• Swagger extensions for API Gateway
• Recommended for tracking changes to your API

43. Deployment mechanisms
Chalice - https://github.com/awslabs/chalice
• Python microframework, includes deployment scripts
Serverless - https://github.com/serverless/serverless
• NodeJS, Python, Java and Scala
• Describe API and other resources
SAM - https://github.com/awslabs/serverless-application-model
• Serverless Application Model
• Extends CloudFormation
• Can integrate with CodePipeline for CI/CD solution

44. Be like Doug
• Monitor your APIs with metrics and
alarms to find problems.
• Use logging to diagnose problems with
your APIs.
• Make use of throttling and
authentication to limit blast radius and
protect critical API components.
• Make your API available to 3rd parties
via usage plans
• Manage your API with stages/versions
and deployment tools.

45. Have Questions?
• PopUp Loft!
• Forums
• https://forums.aws.amazon.com/
• StackOverflow
• http://stackoverflow.com/questions/tagged/aws-api-gateway

46. aws.amazon.com/activate
Everything and Anything Startups
Need to Get Started on AWS