How to use or not use the AWS API Gateway for Microservices

Transcription

1 How to use or not use the AWS API Gateway for Microservices Presented by Dr. Martin Merck Wednesday 26 September 2018

2 What is an API Gateway Traits AWS API Gateway Features of API gateway OAuth2.0 Agenda Securiting Microservices Demo Conclusions Is AWS API-Gateway a good fit for you AWS Community Days

3 How to use or not use the AWS API Gateway for Microservices What is an API Gateway AWS Community Days

4 What is an API Gateway Traits of API Gateways API Creation Modelling Mocking and Testing Easy API deployment API portal for developers API security API monitoring and metering AWS Community Days

5 API Creation and Usage Create APIs interactively (not recommended) Import / Export of APIs (Swagger) Document APIs Integration flows Integrate other protocols (SOAP 2 REST) Map request / response parameters API evolution Mocking / Testing Provide sample responses Deployment and use for different stages (dev/prod) Canary releases Developer portals Discover APIs Signup for self service usage (get API keys etc.) 5

6 API Security Secure access to APIs API keys Token Access Authorization Be a OAuth 2.0 Authorization server Be a OAuth 2.0 Resource server ACLs Integration with IdM solutions Threat detection API Governance Blocking consumers Blocking devices 6

7 API Monitoring and Metering Insides in API metrics Calls/s Response times Error rates Throttling Prevent DDoS attacks Limit consumer usage Protect backend resources Metering Monetization 7

8 How to use or not use the AWS API Gateway for Microservices AWS API Gateway AWS Community Days

9 API Creation and Usage Create APIs interactively (not recommended) Import / Export of APIs (Swagger) Document APIs Integration flows Integrate with AWS Services (AWS, Lambda) Map request / response parameters (Custom Integrations) API evolution Mocking / Testing Mock integrations Deployment and use for different stages (dev/prod) Can create lots of stages Stage variables to adapt integrations Canary releases at the stage level (with promotions) No developer portals But can create SDKs from deployed stages 9

10 API Monitoring and Metering Cloudwatch logging and monitoring (by API, by Stage, by Method) Count 4xx Errors 5xx Errors Latency Integration Latency Cache Hits Cache Misses X-Ray New, integration in tracing flows 10

11 How to use or not use the AWS API Gateway for Microservices OAuth2.0 AWS Community Days

12 API Security API Keys Used mainly for throttling / usage palns AWS security concept (IAM) Access to APIs managed via permissions API invocations using URL signatures Map to IAM Roles with permissions OAuth 2.0 Designed for authorization delegation Used for token based access to REST services OpenID Connect User authentication using OAuth 2.0 Returns IDToken (intended for client to get used information from claims) Access token to access/manage user profile information (with special scopes) 12

13 API Security AWS IAM Can be used to authorize API invocation Cognito Identity Pools Can be used to exchange Tokens for temporary AWS credentials Cognito User Pools Manage user profile for your application but can integrate with social / federated login Implement OAuth 2.0 Implement OpenID Connect API gateway request integration can propagate user claim information from the token to the context Custom Authorizers Use a Lambda function to verify request credentials form other sources (For example form other OpenID Connect / OAuth services) Creates a IAM policy for the request on the fly (returned by authorizer lambda) 13

14 OAuth

15 OpenID Connect 15

16 API Gateway Lambda Authorizers 16

17 Cognito User Pools IdP managed service from AWS Historically overlooked as positioned mainly for mobile apps Implements OpenID Connect Manages users in own database Exposes Login, Authorization, Token and UserInfo endpoints Can use social federated logins Will create a own profile however and user changes will not propagate to the federated services OAuth 2.0 scopes Access tokens can be used to get info from UserInfo endpoint Scopes Openid, , profile,... Can define resource server and expose rthe scopes for OAuth

18 How to use or not use the AWS API Gateway for Microservices Demo AWS Community Days

19 How to use or not use the AWS API Gateway for Microservices Conclusions AWS Community Days

20 Unique features of AWS API Gateway API Gateway API Gateway + Cognito User Pools + Cloudwatch = API Gateway API Gateway Integration in Cloudfront and API response caching Can help lower latency for users far away from the deployment region Reduces pressure on backend services (if responses can be cached) Integration into AWS marketplace AWS proxy integrations (SNS, Kinesis, S3) Microservices If using IAM or Cognito User Pool authentication Not ideal to RESTify legacy SOAP services Using Velocity Templates and JSONpath (programmatic integrations) Management Deployment as Infrastructure as Code IaC (Console very clumsy) 20

21 When to use AWS API Gateway Serverless architectures Create HTTP triggers for Lambdas Integrate with native AWS authentication Access to REST API s from users around the globe AWS Services AWS proxy integrations (SNS, Kinesis, S3) Microservices If using IAM or Cognito User Pool authentication Not ideal to RESTify legacy SOAP services Using Velocity Templates and JSONpath (programmatic integrations) Management Deployment as Infrastructure as Code IaC (Console very clumsy) Want to sell API usage plans over AWS Marketplace 21

22 When not to use AWS API Gateway Legacy integrations Integrate SOAP, no-rest APIs When you need advanced routing Not easy to route based on request properties (IP, etc.) to different backends Other security schemes When you need to translate from opaque bearer tokens to JWT in the gateway Latency concerns Don t expect too low latency < 100ms Costs? With extreme rates of traffic (internal intra Microservice communications) Consider a service mesh instead You need a developer portal Most of the time the OotB portals will anyhow not be good enough. If you like to develop integrations in a GUI 22

23 AWS API Gateway Gotchas Account limits A default account is throttled to 1000 req/s (can be increased) Cloudwatch not recommended for monetization You may need to implement your own metering if not using the Marketplace Understand how API Gateway handles errors 23

24 Questions? 24