API Gateway Security
Compute & ServerlessAPI Gateway Security involves protecting your APIs from unauthorized access, abuse, and attacks. Amazon API Gateway provides multiple layers of security controls.
Authentication & Authorization
- IAM Authorization: callers sign requests with SigV4; best for service-to-service
- Cognito Authorizer: validate JWT tokens from Cognito user pools
- Lambda Authorizer: custom auth logic (token-based or request-based)
- API Keys: for usage tracking and throttling, not security (keys are not secrets)
- Mutual TLS (mTLS): client certificate authentication for zero-trust API access
Protection Controls
- Throttling: rate limits per stage, per method, per API key to prevent abuse
- WAF Integration: attach AWS WAF rules for SQL injection, XSS, bot protection
- Resource Policies: IP whitelisting, VPC endpoint restrictions, cross-account access control
- Request Validation: validate request body, query strings, headers before reaching backend
Related AWS Services
Related Content
Related Terms
A firewall that filters HTTP/HTTPS traffic to web applications, blocking common attacks like SQL injection, XSS, and bot traffic using customizable rules.
A security model where no user, device, or network is trusted by default - every access request is verified regardless of location, using identity-based policies and continuous validation.
A digital certificate that enables HTTPS by establishing encrypted connections between clients and servers, managed in AWS through ACM.
A JSON document that defines permissions - which actions are allowed or denied on which AWS resources, and under what conditions.
Toc Consulting: AWS Security & Cloud Architecture
Securing your AWS estate?
Our team helps engineering teams secure and architect AWS the right way: assessment in week one, a prioritized action plan in week two.