An API Gateway ApiKey.

An ApiKey can be distributed to API clients that are connecting to
WebSocket APIs that require API key authentication. The key is used
to authenticate WebSocket connections and associate them with usage plans
for throttling and quota management.

Permits the IAM principal all read operations through this key [disable-awslint:no-grants].

grantRead

Permits the IAM principal all read and write operations through this key [disable-awslint:no-grants].

grantReadWrite

Permits the IAM principal all write operations through this key [disable-awslint:no-grants].

grantWrite

ApiKey

An AWS Marketplace customer identifier to use when integrating with the AWS SaaS Marketplace.

customerId

Indicates whether the API key can be used by clients.

enabled

Specifies whether the key identifier is distinct from the created API key value.

generateDistinctId

A name for the API key.

If you don't specify a name, AWS CloudFormation generates a unique physical ID and uses that ID for the API key name.

apiKeyName

A description of the purpose of the API key.

description

The value of the API key.

Must be at least 20 characters long.

value

Create a new API mapping for API Gateway API endpoint.

ApiMapping

The Api to which this mapping is applied.

custom domain name of the mapping target.

domainName

Api mapping key.

The path where this stage should be mapped to on the domain

apiMappingKey

stage for the ApiMapping resource required for WebSocket API defaults to default stage of an HTTP API.

stage

addEndpoint

DomainName

The mutual TLS authentication configuration for a custom domain name.

mtls

The ACM certificate for this domain name.

Certificate can be both ACM issued or imported.

certificate

The user-friendly name of the certificate that will be used by the endpoint for this domain name.

certificateName

The type of endpoint for this DomainName.

endpointType

The IP address types that can invoke the API.

ipAddressType

A public certificate issued by ACM to validate that you own a custom domain.

This parameter is required
only when you configure mutual TLS authentication and you specify an ACM imported or private CA certificate
for `certificate`. The ownership certificate validates that you have permissions to use the domain name.

ownershipCertificate

The Transport Layer Security (TLS) version + cipher suite for this domain name.

securityPolicy

Create a new API Gateway HTTP API endpoint.

Add multiple routes that uses the same configuration.

The routes all go to the same path, but for different
methods.

addRoutes

addStage

addVpcLink

Get the "execute-api" ARN.

When 'ANY' is passed to the method, an ARN with the method set to '*' is obtained.

arnForExecuteApi

Return the given named metric for this Api Gateway.

metric

Metric for the number of client-side errors captured in a given period.

metricClientError

Metric for the total number API requests in a given period.

metricCount

Metric for the amount of data processed in bytes.

metricDataProcessed

Metric for the time between when API Gateway relays a request to the backend and when it receives a response from the backend.

metricIntegrationLatency

The time between when API Gateway receives a request from a client and when it returns a response to the client.

The latency includes the integration latency and other API Gateway overhead.

metricLatency

Metric for the number of server-side errors captured in a given period.

metricServerError

HttpApi

apiName

Specifies a CORS configuration for an API.

corsPreflight

Whether a default stage and deployment should be automatically created.

createDefaultStage

Default OIDC scopes attached to all routes in the gateway, unless explicitly configured on the route.

The scopes are used with a COGNITO_USER_POOLS authorizer to authorize the method invocation.

defaultAuthorizationScopes

Default Authorizer applied to all routes in the gateway.

defaultAuthorizer

Configure a custom domain with the API mapping resource to the HTTP API.

defaultDomainMapping

An integration that will be configured on the catch-all route ($default).

defaultIntegration

Specifies whether clients can invoke your API using the default endpoint.

By default, clients can invoke your API with the default
`https://{api_id}.execute-api.{region}.amazonaws.com` endpoint. Set this to
true if you would like clients to use your custom domain name.

disableExecuteApiEndpoint

Whether to set the default route selection expression for the API.

When enabled, "${request.method} ${request.path}" is set as the default route selection expression.

routeSelectionExpression

HttpAuthorizer

httpApi

The identity source for which authorization is requested.

identitySource

type

authorizerName

The authorizer's Uniform Resource Identifier (URI).

For REQUEST authorizers, this must be a well-formed Lambda function URI.

authorizerUri

Specifies whether a Lambda authorizer returns a response in a simple format.

If enabled, the Lambda authorizer can return a boolean value instead of an IAM policy.

enableSimpleResponses

A list of the intended recipients of the JWT.

A valid JWT must provide an aud that matches at least one entry in this list.

jwtAudience

The base domain of the identity provider that issues JWT.

jwtIssuer

Specifies the format of the payload sent to an HTTP API Lambda authorizer.

payloadFormatVersion

How long APIGateway should cache the results.

Max 1 hour.

resultsCacheTtl

The IAM role that the API Gateway service assumes while invoking the authorizer.

Supported only for REQUEST authorizers.

role

HttpIntegration

The HTTP API to which this integration should be bound.

integrationType

The ID of the VPC link for a private integration.

Supported only for HTTP APIs.

connectionId

The type of the network connection to the integration endpoint.

connectionType

The credentials with which to invoke the integration.

credentials

Integration subtype.

Used for AWS Service integrations, specifies the target of the integration.

integrationSubtype

Integration URI.

This will be the function ARN in the case of `HttpIntegrationType.AWS_PROXY`,
or HTTP URL in the case of `HttpIntegrationType.HTTP_PROXY`.

integrationUri

The HTTP method to use when calling the underlying HTTP proxy.

method

Specifies how to transform HTTP requests before sending them to the backend.

parameterMapping

Specifies the TLS configuration for a private integration.

secureServerName

The maximum amount of time an integration will run before it returns without a response.

Must be between 50 milliseconds and 29 seconds.

timeout

Route class that creates the Route for API Gateway HTTP API.

grantInvoke

HttpRoute

The key to this route.

This is a combination of an HTTP method and an HTTP path.

routeKey

The list of OIDC scopes to include in the authorization.

These scopes will be merged with the scopes from the attached authorizer

authorizationScopes

Authorizer for a WebSocket API or an HTTP API.

authorizer

The integration to be configured on this route.

integration

Represents a stage where an instance of the API is deployed.

addStageVariable

defaultAccessLogFormat

Return the given named metric for this HTTP Api Gateway Stage.

HttpStage

The HTTP API to which this stage is associated.

The name of the stage.

See `StageName` class for more details.

stageName

accessLogSettings

Whether updates to an API automatically trigger a new deployment.

autoDeploy

Specifies whether detailed metrics are enabled.

detailedMetricsEnabled

The options for custom domain and api mapping.

domainMapping

Stage variables for the stage. These are key-value pairs that you can define and use in your API routes.

The allowed characters for variable names and the required pattern for variable values are specified here: https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-apigateway-stage.html#cfn-apigateway-stage-variables

stageVariables

Throttle settings for the routes of this stage.

throttle

An API Gateway ApiKey, for which a rate limiting configuration can be specified.

RateLimitedApiKey

API Stages to be associated with the RateLimitedApiKey.

apiStages

Number of requests clients can make in a given time period.

quota

addApiKey

addApiStage

UsagePlan

API Stages to be associated with the usage plan.

usagePlanName

Define a new VPC Link Specifies an API Gateway VPC link for a HTTP API to access resources in an Amazon Virtual Private Cloud (VPC).

Adds the provided security groups to the vpc link.

addSecurityGroups

Adds the provided subnets to the vpc link.

addSubnets

VpcLink

The VPC in which the private resources reside.

A list of security groups for the VPC link.

securityGroups

subnets

The name used to label and identify the VPC link.

vpcLinkName

Create a new API Gateway WebSocket API endpoint.

addRoute

arnForExecuteApiV2

Grant access to the API Gateway management API for this WebSocket API to an IAM principal (Role/Group/User).

[disable-awslint:no-grants]

grantManageConnections

WebSocketApi

An API key selection expression.

Providing this option will require an API Key be provided to access the API.

apiKeySelectionExpression

connectRouteOptions

defaultRouteOptions

Avoid validating models when creating a deployment.

disableSchemaValidation

Options to configure a '$disconnect' route.

disconnectRouteOptions

The route selection expression for the API.

WebSocketAuthorizer

WebSocket Api to attach the authorizer to.

webSocketApi

WebSocketIntegration

The WebSocket API to which this integration should be bound.

Specifies how to handle response payload content type conversions.

contentHandling

Specifies the IAM role required for the integration.

Amazon API Gateway V2

L2 Constructs16

ApiKey

ApiMapping

DomainName

HttpApi

HttpAuthorizer

HttpIntegration

HttpRoute

HttpStage

RateLimitedApiKey

UsagePlan

VpcLink

WebSocketApi

WebSocketAuthorizer

WebSocketIntegration

WebSocketRoute

WebSocketStage

L1 Constructs14

CfnApi

CfnApiGatewayManagedOverrides

CfnApiMapping

CfnAuthorizer

CfnDeployment

CfnDomainName

CfnIntegration

CfnIntegrationResponse

CfnModel

CfnRoute

CfnRouteResponse

CfnRoutingRule

CfnStage

CfnVpcLink

Learn AWS the Practical Way

Quick Facts

Related Links

More Amazon API Gateway V2 deep dives