API Authentication and Authorization

Security in AWS

Security is the primary requirement for any meaningful application, especially for applications deployed in the cloud. Amazon’s API Gateway provides a range of features to help secure the APIs hosted in the AWS cloud.

Security consists of two components, namely authentication and authorization.

Authentication involves ensuring that the API client is indeed what it claims to be. Once we ascertain this, authorization ensures that the client should be allowed to do what they’re trying to do. Both are equally important when we work with API gateway. First, we must ensure that the client is genuine. The task doesn’t end there. We should also ensure that the client is authorized to do what they’re trying to do.

Consider an airport as an example. When someone wants to use the airport, security checks for the person's identity based on a national identity card and the tickets. The identity card only proves that they are who they claim to be. That alone doesn’t give the person the right to travel. For that, they need a booking ...