Build a REST API with API Gateway and Lambda Step by Step

By Ravindra Bagale, trainer · LinkedIn · Last updated: 23 October 2026

1. A story: notes API for a class app

Students' React app on https://notes.campus.test must list and create notes. The API will live at https://api.campus.test. Without CORS headers, the browser blocks the call even if curl works.

2. Lab: HTTP API + Lambda (GET and POST)

How to do it (step by step)

We use an HTTP API for the happy path (cheap, simple). A short REST section later shows API keys. Region ap-south-1.

1. Lambda function

1. Create function notes-api-lab, Python 3.12, basic execution role.
2. Paste:

import json, urllib.parse
NOTES = [{"id": "1", "text": "Buy milk"}]  # lab memory only
def lambda_handler(event, context):
    method = event.get("requestContext", {}).get("http", {}).get("method") or event.get("httpMethod")
    path = event.get("rawPath") or event.get("path") or "/"
    headers = {"content-type": "application/json", "access-control-allow-origin": "*"}
    if method == "GET" and path.endswith("/notes"):
        return {"statusCode": 200, "headers": headers, "body": json.dumps(NOTES)}
    if method == "GET" and "/notes/" in path:
        nid = path.rstrip("/").split("/")[-1]
        hit = next((n for n in NOTES if n["id"] == nid), None)
        return {"statusCode": 200 if hit else 404, "headers": headers, "body": json.dumps(hit or {"error": "missing"})}
    if method == "POST" and path.endswith("/notes"):
        body = json.loads(event.get("body") or "{}")
        item = {"id": str(len(NOTES) + 1), "text": body.get("text", "")}
        NOTES.append(item)
        return {"statusCode": 201, "headers": headers, "body": json.dumps(item)}
    return {"statusCode": 404, "headers": headers, "body": json.dumps({"error": "no route"})}

3. Deploy. Why access-control-allow-origin: *: so a browser on another origin can read the response in this lab. Lock it to your real domain in production.

2. HTTP API

1. API Gateway → Create API → HTTP API → Build. Name: notes-http.
2. Add integration → Lambda → select notes-api-lab.
3. Routes: Add GET /notes, POST /notes, GET /notes/{id}. Attach each to the Lambda integration.
4. Stages: keep $default with auto-deploy. Create.
5. Copy the Invoke URL, like https://abc123.execute-api.ap-south-1.amazonaws.com.

3. Test with curl

BASE=https://abc123.execute-api.ap-south-1.amazonaws.com
curl -s $BASE/notes
curl -s -X POST $BASE/notes -H 'content-type: application/json' -d '{"text":"Ship lab"}'
curl -s $BASE/notes/1

Expected: JSON list, then a 201 body with new id, then one note. Path param {id} lands in the path; query strings appear in event.queryStringParameters (try /notes?limit=1 after you add reading of that field).

3. CORS — why the browser blocks you

Why do we need this?

Browsers enforce the Same-Origin Policy. A page on https://app.example.com calling https://api.example.com is cross-origin. The browser hides the response unless the API says it is allowed.

What is it?

CORS is that permission, via response headers such as Access-Control-Allow-Origin. For requests with special headers or methods, the browser first sends an OPTIONS preflight. Your API must answer OPTIONS with allow headers.

How to do it (step by step)

1. In HTTP API → CORS → Configure. Allow origins: https://notes.campus.test (or * for lab). Allow methods: GET, POST, OPTIONS. Allow headers: content-type, authorization.
2. Also return the same headers from Lambda (as in the lab code) so non-preflight responses work.
3. Verify with browser DevTools → Network: failed calls show CORS errors; after fix, status 200.

4. API keys, usage plans and throttling (REST)

Why do we need this?

Partners should not share one open URL. You want a key per partner and a rate limit so one client cannot melt your Lambda bill.

What is it?

These features exist on REST APIs (not HTTP APIs). An API key is a secret string clients send in x-api-key. A usage plan ties keys to stages and sets throttle (requests/second) and quota (requests/day).

How to do it (step by step)

1. Create a REST API → resources /notes → methods GET/POST with Lambda proxy. Deploy to stage prod.
2. API Keys → Create → show and copy the value once.
3. Usage plans → Create → throttle e.g. 5 req/s, burst 10 → quota 1000/day → add stage prod → add the API key.
4. On each method: Method Request → API Key Required = true. Redeploy.
5. Call with curl -H "x-api-key: YOURKEY" https://.../prod/notes. Without the header: 403.

5. Custom domain + ACM (outline)

1. Request an ACM public certificate for api.yourdomain.com in the same region as the API (for Regional endpoints). Validate via DNS.
2. API Gateway → Custom domain names → Create → TLS 1.2 → attach certificate → map path `/` to your API stage.
3. Route 53 (or your DNS): alias/CNAME to the Gateway domain target shown in the console. Why: browsers need a name that resolves to Gateway.
4. Wait for Available, then call https://api.yourdomain.com/notes.

Cleanup

1. Delete HTTP/REST APIs, custom domains, Lambda notes-api-lab, unused API keys and usage plans.
2. Leave ACM cert only if other labs use it.

6. Interview questions

Revision, comparison and interview cards

Revise this lesson in a few minutes. Save the cards on your phone or download them as PNG files. The QR code on each card opens this lesson.

More cards: Ravi Sir's Cards.