Managing API traffic through API Gateway with rate limiting

Question

Pulumi · Accepted Answer

To manage API traffic with rate limiting in Amazon API Gateway, you can define usage plans that specify who can access your APIs at particular rates and quotas. The rate limit and quota apply to each individual API key added to the usage plan.

Below is a Pulumi program written in TypeScript that demonstrates how to:

1. Create a REST API with Amazon API Gateway.
2. Establish an API method that invokes a Lambda function for an HTTP GET request.
3. Set up a usage plan with specified rate limit and quota.
4. Create an API key and associate it with the usage plan.

Before running this code, ensure you have AWS configured for Pulumi, either by having the AWS CLI configured or by setting the appropriate environment variables (`AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, and `AWS_REGION`).

Here's the program:

```typescript
import * as aws from "@pulumi/aws";

// Create a new Lambda function to be invoked when the API is called
const myLambdaFunction = new aws.lambda.Function("myLambdaFunction", {
    // Define the AWS Lambda function configuration
    code: new pulumi.asset.AssetArchive({
        ".": new pulumi.asset.FileArchive("./lambda"), // Specify the path to your Lambda code
    }),
    runtime: aws.lambda.Runtime.NodeJS12dX, // Choose the runtime environment
    handler: "index.handler", // The entrypoint function inside your Lambda code
    role: myLambdaRole.arn, // You need to define a role with appropriate permissions for Lambda
});

// Create a new REST API
const myApi = new aws.apigateway.RestApi("myApi", {
    // Set the parameters for the REST API
    description: "This is my API for demonstration purposes",
});

// Create a new resource in the REST API
const myResource = new aws.apigateway.Resource("myResource", {
    // Associate this resource with our created API and define its path
    restApi: myApi.id,
    parentId: myApi.rootResourceId,
    pathPart: "myResource",
});

// Create a new method for the resource
const myMethod = new aws.apigateway.Method("myMethod", {
    // Set up the HTTP method, resource, and backend Lambda invocation
    httpMethod: "GET",
    authorization: "NONE",
    resourceId: myResource.id,
    restApi: myApi.id,
    integration: {
        // Define the backend integration with the Lambda function
        type: "AWS_PROXY",
        httpMethod: "POST",
        uri: myLambdaFunction.invokeArn,
        integrationHttpMethod: "POST",
    },
});

// Create a new usage plan to associate with our API key and API stage
const myUsagePlan = new aws.apigateway.UsagePlan("myUsagePlan", {
    // Set the rate limit and the quota for the usage plan
    name: "MyUsagePlan",
    description: "Usage plan with rate limiting",
    apiStages: [{
        apiId: myApi.id,
        stage: "default", // Default stage name created by API Gateway
    }],
    throttle: {
        // Define the rate limit
        rateLimit: 1, // Number of requests per second
        burstLimit: 2, // Maximum number of requests that can be made in a burst
    },
    quota: {
        // Define the quota
        limit: 1000, // Maximum number of requests in a given time period
        period: "DAY", // The time period in which the quota resets
    },
});

// Create an API key
const myApiKey = new aws.apigateway.ApiKey("myApiKey", {
    // Set the parameters for the API key
    description: "My API Key",
    enabled: true,
});

// Associate the API key with the usage plan
const keyAssociation = new aws.apigateway.UsagePlanKey("keyAssociation", {
    // Create the usage plan key resource
    keyId: myApiKey.id,
    keyType: "API_KEY",
    usagePlanId: myUsagePlan.id,
});

// Export the invoke URL of the API
export const invokeUrl = myApi.executionArn.apply(arn => `https://${arn}.execute-api.${aws.config.region}.amazonaws.com/prod/myResource`);

```

This Pulumi program will set up an Amazon API Gateway with a single resource and a GET method linked to a Lambda function. It includes an API key and a usage plan to manage the rate limiting of incoming requests. The `throttle` and `quota` properties of the `UsagePlan` resource are crucial for limiting the traffic according to your specific needs.

Keep in mind that you should replace the `./lambda` path with the actual location of your Lambda code and set the `role` property to the ARN of an IAM role that has permissions to execute Lambda functions.