Chapter 8 – Managing and Securing API Gateways

1. REST and WebSocket.
2. Any application running in AWS or outside AWS, any AWS HTTP addressable service like S3, DynamoDB, and so on.
3. Create a resource policy and allow only traffic from any development IP or endpoint.
4. Use federation with IAM or Cognito if it's supported by a third party. If federation is not supported by the third party, you can also implement a Lambda authorizer that can check the authentication data in the API request.
5. Use ACM for API Gateway and ELB and use a self-signed certificate, a private CA, or a public CA for the EC2 instances.
6. Yes, this kind of behavior is supported by WebSocket.
7. Connect the clients to the API Gateway. Use API keys for requests from the mobile clients and then send the backend request directly to DynamoDB. To prevent over-use of DynamoDB, you can implement a usage plan that...