🛎️ Amazon API Gateway शाळेच्या पद्धतीने शिका

# the 60-second wow — the front office, live:
git clone https://github.com/BaluRaut/learn-apigateway-school.git && cd learn-apigateway-school
python3 apigw/demo.py              # 12 lessons: every request and its answer
python3 apigw/test_apigw.py        # 12 checks across the lessons
python3 apigw/demo.py serve        # then: curl -i localhost:8080/students/7

तुम्हाला काय दिसायला हवे (छाटलेले — यश असे दिसते):

═══ why ═══
── one front office for every visitor: it checks, counts, remembers and forwards — the kitchen only cooks
   GET     /students/7              → 200 {'id': '7', 'name': 'Aishwarya', 'class': '8B'}  X-Cache: Miss
   GET     /teachers                → 404 {'message': 'Not Found'}
   without it, every service rebuilds auth, limits, logging and TLS on its own

═══ kinds ═══
── three kinds of API Gateway
   REST API       the full kit: API keys + usage plans, caching, request validation, mapping templates, WAF, private
   HTTP API       lean and cheaper: JWT authorizers built in, CORS in one setting, Lambda + HTTP proxy
   WebSocket API  a phone line that stays open: $connect, $disconnect, routes by a field in the message
   this lab models a REST API because it shows the most parts

═══ routes ═══
── the most specific route wins: a fixed word beats {id}, {proxy+} catches everything else
   GET     /students/9              → 200 {'id': '9', 'name': 'Katrina', 'class': '9A'}  X-Cache: Miss
   GET     /students/me             → 200 {'you': 'teacher-42'}
   GET     /files/term1/maths/paper.pdf → 200 {'file': 'term1/maths/paper.pdf'}
   DELETE  /students/9              → 405 {'message': 'Method Not Allowed'}
   integration = where the office forwards the visitor: Lambda, an HTTP backend, an AWS service, or a mock

═══ validate ═══
── the office rejects a bad form BEFORE the kitchen sees it (the backend is not called, not billed)
   POST    /marks                   → 400 {'message': 'Invalid request body', 'why': "missing required field 'mark'"}
   POST    /marks                   → 400 {'message': 'Invalid request body', 'why': "'mark' must be int"}
   POST    /marks                   → 201 {'saved': {'student': '7', 'subject': 'maths', 'mark': 91}, 'table': 'marks-prod'}
── response mapping: the kitchen returns the phone number, the office removes it on the way out
   kitchen: {'id': '7', 'name': 'Aishwarya', 'class': '8B', 'phone': '98xxxxxx12'}
   GET     /students/7              → 200 {'id': '7', 'name': 'Aishwarya', 'class': '8B'}  X-Cache: Miss

═══ stages ═══
── one API, many stages — each a snapshot (deployment) with its own variables, limits and cache
   stage dev   → 201 {'saved': {'student': '7', 'subject': 'maths', 'mark': 91}, 'table': 'marks-dev'}
   stage prod  → 201 {'saved': {'student': '7', 'subject': 'maths', 'mark': 91}, 'table': 'marks-prod'}
   stage test  → 403 {'message': 'Forbidden'}
   a change is live only after a new deployment to a stage · canary: send 10% of prod to the new deployment

═══ auth ═══
── who are you? JWT authorizer (Cognito or any OIDC issuer) — checks signature, issuer, audience, expiry
   no token             GET     /students/me             → 401 {'message': 'Unauthorized', 'why': 'no token'}
   forged               GET     /students/me             → 401 {'message': 'Unauthorized', 'why': 'bad signature'}
   expired              GET     /students/me             → 401 {'message': 'Unauthorized', 'why': 'expired'}
   other app's token    GET     /students/me             → 401 {'message': 'Unauthorized', 'why': 'wrong audience'}
   good                 GET     /students/me             → 200 {'you': 'teacher-42'}
── scope check: a read-only token may not write marks
   POST    /marks                   → 403 {'message': 'Forbidden', 'why': 'needs scope marks:write'}
── Lambda authorizer: your own code decides (here: a staff badge)
   GET     /staffroom               → 403 {'message': 'User is not authorized to access this resource'}
   GET     /staffroom               → 200 {'you': 'teacher-42'}
   IAM auth (SigV4) for callers inside AWS · API keys are NOT auth — they say which client, not who, and leak easily

═══ throttle ═══
── token bucket: holds `burst` tokens, refills `rate`/s — defaults 10,000 rps and 5,000 burst per account & Region
   stage dev: rate 5/s, burst 5 — 8 requests in the same instant:
   200 200 200 200 200 429 429 429
   one second later: 200 200 200 200 200 429
── usage plan 'partner-basic' (2 rps, burst 2) on the partner route, identified by x-api-key:
   200 200 429 429  · unknown key → 403
   429 means slow down and retry with backoff — it is the office protecting the kitchen

═══ cache ═══
── the notice board: stage cache TTL 300 s (default; 0–3600) — the kitchen is asked once
   +0   s  200 Miss   kitchen calls so far: 1
   +10  s  200 Hit   kitchen calls so far: 1
   +200 s  200 Hit   kitchen calls so far: 1
   +301 s  200 Miss   kitchen calls so far: 2
   the cache key is method + path (+ chosen headers / query strings) — never cache per-user answers under a shared key

═══ cors ═══
── a browser page on another site asks first (OPTIONS preflight); the office answers with Allow-* headers
   OPTIONS /students/7              → 204   Access-Control-Allow-Origin: https://school.example Access-Control-Allow-Methods: GET,POST,PUT,DELETE Access-Control-Allow-Headers: authorization,content-type,x-api-key Access-Control-Max-Age: 600
   OPTIONS /students/7              → 403 {'message': 'CORS origin not allowed'}
   GET     /students/7              → 200 {'id': '7', 'name': 'Aishwarya', 'class': '8B'}  X-Cache: Miss Access-Control-Allow-Origin: https://school.example
   CORS is enforced by BROWSERS — curl ignores it. It is not security for your API, it protects users' browsers

═══ domains ═══
── custom domain: api.school.example instead of abc123.execute-api.ap-south-1.amazonaws.com
   certificate        ACM — in us-east-1 for edge-optimized, in the API's Region for regional
   DNS                Route 53 alias (A/AAAA) → the gateway's domain name
   base path mapping  api.school.example/v1 → school-api prod · /v2 → school-api-v2 prod
   TLS                security policy TLS 1.2 minimum · mutual TLS for partners with client certificates
   endpoint types     edge-optimized (CloudFront in front) · regional · private (inside a VPC)

═══ monitor ═══
── CloudWatch metrics the office keeps:
   Count=6 · 4XXError=2 · 5XXError=2 · CacheHitCount=1 · CacheMissCount=2
── access log (one JSON line per request — you choose the fields):
   {'requestId': 'req-0001', 'stage': 'prod', 'httpMethod': 'GET', 'path': '/students/7', 'status': 200, 'principal': None, 'latencyMs': 42, 'integrationLatencyMs': 38}
   {'requestId': 'req-0002', 'stage': 'prod', 'httpMethod': 'GET', 'path': '/students/7', 'status': 200, 'principal': None, 'latencyMs': 4, 'integrationLatencyMs': 0}
   {'requestId': 'req-0003', 'stage': 'prod', 'httpMethod': 'GET', 'path': '/students/404', 'status': 404, 'principal': None, 'latencyMs': 42, 'integrationLatencyMs': 38}
   {'requestId': 'req-0004', 'stage': 'prod', 'httpMethod': 'GET', 'path': '/broken', 'status': 502, 'principal': None, 'latencyMs': 4, 'integrationLatencyMs': 0}
   {'requestId': 'req-0005', 'stage': 'prod', 'httpMethod': 'GET', 'path': '/report', 'status': 504, 'principal': None, 'latencyMs': 29004, 'integrationLatencyMs': 29000}
   {'requestId': 'req-0006', 'stage': 'prod', 'httpMethod': 'GET', 'path': '/teachers', 'status': 404, 'principal': None, 'latencyMs': 4, 'integrationLatencyMs': 0}
   Latency = whole trip; IntegrationLatency = the kitchen only; the gap is the office itself · X-Ray draws the path

═══ limits ═══
── hard edges: integration timeout 29 s (REST default), payload 10 MB
   GET     /report                  → 504 {'message': 'Endpoint request timed out'}
   GET     /broken                  → 502 {'message': 'Internal server error'}
   long jobs: accept → 202 + job id → poll or WebSocket/push · big files: pre-signed S3 URL, not through the API
── private API: reachable only through an interface VPC endpoint (execute-api) + a resource policy
── AWS WAF in front of REST APIs: SQL-injection rules, IP sets, rate-based rules
── cost (example, us-east-1): REST ~$3.50 per million requests, HTTP ~$1.00 per million — plus cache hours and data out

✅ done — the front office answered every lesson

🗺️ संपूर्ण चित्र — एक आकृती, पूर्ण कोर्स

संपूर्ण कोर्स एका कॅनव्हासवर. 4K आवृत्तीसाठी क्लिक करा.

🛎️ भाग 1 — front office (धडे 1–6)

एक git branch = एक कल्पना; branch 04 मध्ये धडे 01–04 आहेत. प्रत्येक उत्तर apigw/gateway.py मधून येते — AWS account लागत नाही.

🚦 भाग 2 — production मध्ये चालवणे (धडे 7–12)

खऱ्या API ला त्याच्या gateway कडून काय हवे: मर्यादा, caching, CORS, स्वतःचे domain, monitoring आणि कठोर मर्यादांची माहिती.

📐 धड्यांच्या आकृत्या — क्रमांक अनुसरा

प्रत्येक धडा एका क्रमांकित बॉक्स-आणि-बाण आकृतीत — स्वतंत्र पानावरही.