Ravindra BagaleCourses & study guides मराठी Track your progress

AWS CLI API Gateway Commands: Create a REST and HTTP API

By , trainer LinkedIn Last updated:

We put a front door on our code: an HTTP API for Lambda in one command, then routes, stages and a classic REST API step by step.

What you'll learn in this chapter

  • Quick-create an HTTP API
  • Add routes and integrations
  • Use stages
  • Build a REST API with resources
  • Test and clean up

1. The big picture: a reception desk

Why do we need this?

An office reception takes every visitor, checks them and sends them to the right cabin. API Gateway takes every HTTP request and sends it to the right Lambda or URL.

What is it?

HTTP APIs use aws apigatewayv2 (cheap and simple). REST APIs use aws apigateway (more features: API keys, usage plans, request validation).

How to do it (step by step)

API workflowLambda function readycreate-api with --targetadd-permission for apigatewaycurl the endpointadd routes / stages
Without add-permission you get a 500 error.

2. Quick-create an HTTP API

Why do we need this?

You have a Lambda and want a public URL for it in one minute.

What is it?

create-api with --target makes the API, a default route, an integration and a $default stage together.

How to do it (step by step)

  1. Create the API for a function.
FN=arn:aws:lambda:ap-south-1:111122223333:function:cli-hello
API=$(aws apigatewayv2 create-api --name cli-http --protocol-type HTTP --target $FN --query ApiId --output text)
echo $API

Expected output:

a1b2c3d4e5
  1. Allow API Gateway to invoke.
aws lambda add-permission --function-name cli-hello --statement-id apigw --action lambda:InvokeFunction --principal apigateway.amazonaws.com --source-arn "arn:aws:execute-api:ap-south-1:111122223333:$API/*" --query Statement --output text

Expected output:

{"Sid":"apigw","Effect":"Allow",...}
  1. Call it.
curl -s https://$API.execute-api.ap-south-1.amazonaws.com/

Expected output:

{"msg": "hello world"}

3. Routes and integrations

Why do we need this?

Different paths should go to different code, like GET /users and POST /orders.

What is it?

An integration says where to send. A route key like "GET /users" points to an integration.

How to do it (step by step)

  1. Create an integration.
INT=$(aws apigatewayv2 create-integration --api-id $API --integration-type AWS_PROXY --integration-uri $FN --payload-format-version 2.0 --query IntegrationId --output text)
echo $INT

Expected output:

x9y8z7
  1. Add a route.
aws apigatewayv2 create-route --api-id $API --route-key "GET /users" --target integrations/$INT --query RouteKey --output text

Expected output:

GET /users
  1. List routes.
aws apigatewayv2 get-routes --api-id $API --query "Items[].RouteKey" --output text

Expected output:

$default  GET /users

4. Stages

Why do we need this?

You want dev and prod URLs separately with their own settings.

What is it?

A stage is a named snapshot of the API. auto-deploy pushes every change to it.

How to do it (step by step)

  1. Create a dev stage.
aws apigatewayv2 create-stage --api-id $API --stage-name dev --auto-deploy --query StageName --output text

Expected output:

dev
  1. Call the stage URL.
curl -s https://$API.execute-api.ap-south-1.amazonaws.com/dev/users

Expected output:

{"msg": "hello world"}

5. A classic REST API

Why do we need this?

You need API keys, usage plans or request validation that only REST APIs have.

What is it?

Steps: create-rest-api, create-resource, put-method, put-integration, then create-deployment to a stage.

How to do it (step by step)

  1. Create the API and find the root.
R=$(aws apigateway create-rest-api --name cli-rest --query id --output text)
ROOT=$(aws apigateway get-resources --rest-api-id $R --query "items[?path=='/'].id" --output text)
echo $R $ROOT

Expected output:

k1l2m3n4o5 p6q7r8
  1. Add /hello with GET to Lambda.
RES=$(aws apigateway create-resource --rest-api-id $R --parent-id $ROOT --path-part hello --query id --output text)
aws apigateway put-method --rest-api-id $R --resource-id $RES --http-method GET --authorization-type NONE
aws apigateway put-integration --rest-api-id $R --resource-id $RES --http-method GET --type AWS_PROXY --integration-http-method POST --uri arn:aws:apigateway:ap-south-1:lambda:path/2015-03-31/functions/$FN/invocations --query type --output text

Expected output:

AWS_PROXY
  1. Deploy and test.
aws apigateway create-deployment --rest-api-id $R --stage-name prod --query id --output text
aws apigateway test-invoke-method --rest-api-id $R --resource-id $RES --http-method GET --query status

Expected output:

abc123
200

6. Same action in Python, Node.js, Java, Go, .NET and PHP

Why do we need this?

Scripts start in the CLI. Apps call the same API through an SDK. Knowing both helps you move a tested command into real code.

What is it?

Each CLI command maps to one API call. For example aws apigatewayv2 create-api --name cli-http --protocol-type HTTP maps to the Create HTTP API API.

How to do it (step by step)

Same action (Create HTTP API) from code. Every SDK reads the same profile, region and credentials as the CLI.

StackCode
Python (boto3)boto3.client("apigatewayv2").create_api(Name="cli-http",ProtocolType="HTTP")
Node.js (v3)await gw.send(new CreateApiCommand({Name:"cli-http",ProtocolType:"HTTP"}));
Java (v2)gw.createApi(r -> r.name("cli-http").protocolType(ProtocolType.HTTP));
Go (v2)c.CreateApi(ctx, &apigatewayv2.CreateApiInput{Name: aws.String("cli-http"), ProtocolType: types.ProtocolTypeHttp})
.NETawait gw.CreateApiAsync(new CreateApiRequest{Name="cli-http",ProtocolType=ProtocolType.HTTP});
PHP$gw->createApi(["Name"=>"cli-http","ProtocolType"=>"HTTP"]);

7. Clean up so nothing keeps costing

Why do we need this?

Lab resources left running cost money and can be a security risk.

What is it?

Delete in reverse order: children first, then parents.

How to do it (step by step)

  1. Delete the HTTP API.
aws apigatewayv2 delete-api --api-id $API

Expected output:

(no output means success)
  1. Delete the REST API.
aws apigateway delete-rest-api --rest-api-id $R

Expected output:

(no output means success)
  1. Remove the permission.
aws lambda remove-permission --function-name cli-hello --statement-id apigw

Expected output:

(no output means success)
  1. Verify.
aws apigatewayv2 get-apis --query "Items[?Name=='cli-http']"

Expected output:

[]

Ravindra Bagale's Tip

A 500 "Internal server error" right after create usually means the Lambda permission is missing. Check the source-arn has your API id.

8. Interview questions and answers

Q. HTTP API vs REST API?

HTTP API is cheaper and faster with fewer features. REST API has API keys, usage plans and validation.

Q. What is a stage?

A named, deployed version of the API like dev or prod.

Q. What is AWS_PROXY?

Lambda proxy integration: the whole request goes to Lambda and its response goes back as-is.

Q. Why add-permission?

API Gateway needs a resource policy on the function to invoke it.

Q. Why create-deployment in REST?

REST changes are not live until deployed to a stage.

Try at home

  1. Create an HTTP API with GET /users and POST /users to the same Lambda.
  2. Make dev and prod stages and call both URLs.

In short

  1. apigatewayv2 = HTTP API.
  2. --target quick-create.
  3. add-permission or 500.
  4. Routes → integrations.
  5. REST needs create-deployment.

Practice Tasks

About this scenario

Dubai Gold Souk is a jewellery business in Dubai. Fatima Al Mansoori looks after its IT and cloud work. They count money in AED and run their AWS resources in the me-central-1 Region. In the tasks below you do real jobs for them using what this lesson teaches. All names, account IDs, IP addresses and numbers are made up for practice.

0 / 12

Easy Invoke one function

Why: A caller should invoke only the function it needs.

What to do: Allow lambda:InvokeFunction on arn:aws:lambda:me-central-1:112884599412:function:dubaigold-orders-fn only.

How:
  1. Start with { "Version": "2012-10-17", "Statement": [ ... ] }.
  2. In each statement write Effect, Action and Resource.
  3. Give only what the task needs (least privilege).
  4. Use double quotes and commas correctly. Click Check answer.

Easy List functions

Why: See which functions exist in this Region.

What to do: List the Lambda functions in me-central-1.

How:
  1. Read the task and decide which AWS service it is about.
  2. Write aws, then the service name, then the operation (the action word).
  3. Add each needed flag (--name) followed by its value from the task.
  4. Flags can be in any order. Click Check answer.

Medium Create a REST API

Why: REST APIs give API keys, usage plans and request validation.

What to do: Create a REST API named dubaigold-rest.

How:
  1. Read the task and decide which AWS service it is about.
  2. Write aws, then the service name, then the operation (the action word).
  3. Add each needed flag (--name) followed by its value from the task.
  4. Flags can be in any order. Click Check answer.

Medium Deploy a REST API to a stage

Why: Changes to a REST API go live only after a deployment to a stage.

What to do: Deploy REST API a1b2c3d4e5 to the stage prod.

How:
  1. Read the task and decide which AWS service it is about.
  2. Write aws, then the service name, then the operation (the action word).
  3. Add each needed flag (--name) followed by its value from the task.
  4. Flags can be in any order. Click Check answer.

Medium Change timeout and memory

Why: More memory also gives more CPU; timeout stops runaway runs.

What to do: Set dubaigold-orders-fn to timeout 30 seconds and memory 512 MB.

How:
  1. Read the task and decide which AWS service it is about.
  2. Write aws, then the service name, then the operation (the action word).
  3. Add each needed flag (--name) followed by its value from the task.
  4. Flags can be in any order. Click Check answer.

Medium Invoke a function

Why: Invoke runs the function now and saves its answer in a file.

What to do: Invoke dubaigold-orders-fn and save the response to out.json.

How:
  1. Read the task and decide which AWS service it is about.
  2. Write aws, then the service name, then the operation (the action word).
  3. Add each needed flag (--name) followed by its value from the task.
  4. Flags can be in any order. Click Check answer.

Medium Let a function write logs

Why: Without these actions, Lambda logs never appear in CloudWatch.

What to do: Allow logs:CreateLogGroup, logs:CreateLogStream, logs:PutLogEvents on arn:aws:logs:*:*:* only.

How:
  1. Start with { "Version": "2012-10-17", "Statement": [ ... ] }.
  2. In each statement write Effect, Action and Resource.
  3. Give only what the task needs (least privilege).
  4. Use double quotes and commas correctly. Click Check answer.

Hard Quick-create an HTTP API for Lambda

Why: Quick create builds an HTTP API, a default route and stage pointing at your function.

What to do: Create an HTTP API named dubaigold-api whose target is arn:aws:lambda:me-central-1:112884599412:function:dubaigold-orders-fn.

How:
  1. Read the task and decide which AWS service it is about.
  2. Write aws, then the service name, then the operation (the action word).
  3. Add each needed flag (--name) followed by its value from the task.
  4. Flags can be in any order. Click Check answer.

Hard Let S3 call your function

Why: A resource-based permission is needed before S3 can invoke the function.

What to do: Add permission statement s3invoke to dubaigold-orders-fn so s3.amazonaws.com can call lambda:InvokeFunction from bucket arn:aws:s3:::dubaigold-uploads.

How:
  1. Read the task and decide which AWS service it is about.
  2. Write aws, then the service name, then the operation (the action word).
  3. Add each needed flag (--name) followed by its value from the task.
  4. Flags can be in any order. Click Check answer.

Hard Lambda GB-seconds

Why: Lambda bills memory × time.

What to do: 1,000,000 invocations, 512 MB memory, 200 ms each. How many GB-seconds?

How:
  1. Write down the numbers the task gives you.
  2. Work it out step by step on paper.
  3. Type only the final answer in the box.
  4. Click Check answer.

Hard Create a Lambda function

Why: Lambda needs the code zip, a runtime, a handler name and an execution role.

What to do: Create function dubaigold-orders-fn: runtime python3.12, handler app.handler, role arn:aws:iam::112884599412:role/lambda-basic, code in function.zip.

How:
  1. Read the task and decide which AWS service it is about.
  2. Write aws, then the service name, then the operation (the action word).
  3. Add each needed flag (--name) followed by its value from the task.
  4. Flags can be in any order. Click Check answer.

Hard Set environment variables

Why: Keep settings like table names out of the code.

What to do: Set the environment variable TABLE=dubaigold-orders on dubaigold-orders-fn.

How:
  1. Read the task and decide which AWS service it is about.
  2. Write aws, then the service name, then the operation (the action word).
  3. Add each needed flag (--name) followed by its value from the task.
  4. Flags can be in any order. Click Check answer.

See all practice tasks in the Task Hub →

Revision, comparison and interview cards

Revise this lesson in a few minutes. Save the cards on your phone or download them as PNG files. The QR code on each card opens this lesson.

Quick HTTP API. You have a Lambda and want a public URL in a minute. create-api --target makes route, integration and stage. Then add-permission for apigateway.amazonaws.com. Verify: curl the execute-api URL.
Revision card: Quick HTTP API · Download PNG · Open card page
REST API deploy. You need API keys or usage plans. create-resource, put-method, put-integration. Nothing is live until create-deployment. Test with test-invoke-method.
Revision card: REST API deploy · Download PNG · Open card page
HTTP API vs REST API. Cheaper, lower latency. / Costs more, more features.
Comparison: HTTP API vs REST API · Download PNG · Open card page
Why 500 after create-api?. Usually the Lambda permission is missing. add-permission with principal apigateway.amazonaws.com. Check source-arn has your API id.
Interview card: Why 500 after create-api? · Download PNG · Open card page

More cards: Ravi Sir's Cards.