AWS API Gateway

It's hard to find a website in 2022 that doesn't make extensive use of Application Programming Interfaces, or APIs, to provide the various functionalities of the website to end users in their browsers. APIs have become a ubiquitous and critical part of the modern technology stack. As a quick overview for those unfamiliar, this task will discuss the basics of an API.

Before explaining what an API is, it is helpful to define key components of an HTTP/HTTPS API:

API Components

Endpoint: This is the URL location of the API, e.g., the address where you can "call" an API and the resources it can access on your behalf.

Method: This specifies the type of request being made to the API, such as GET, POST, PUT, DELETE, etc.

Headers: These are a component of HTTP, but are used by APIs to contain additional information about the request, such as authentication details, content type, and other metadata.

Request body: This is the data sent to the API as part of the request. GET requests won't typically have a request body, but POST, PUT, and DELETE requests almost always do.

Response: This is the data that the API sends in response to the request. It may include a status code, headers, and a response body.

API Purpose

APIs provide a granular mechanism for developers to allow user access to (potentially) sensitive "back-end" resources. Not only do APIs expose these capabilities for end users, but they also allow third-parties to build reliable ecosystems around a product that exposes an API. Notably, this caused recent controversy as Twitter burned third-party client access (opens in new tab) to the Twitter API. This controversy only reiterates the significance of APIs for organizations using modern technology.

Furthermore, as mentioned, modern APIs often expose a number of sensitive "back-end" resources hosted on behalf of the API. These resources are often "micro-services" that proxy the user request as a direct database write or query to the various systems that may be supporting the API functionality. If security errors are made in the development of the API capabilities, they may be exposed to any user who can authenticate to the API or even to unauthenticated users who attempt to use the API. These characteristics make AWS API Gateway a prime target for attackers.