API keys and usage plans in AWS - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

How does API Gateway enforce usage limits with usage plans?

API Gateway allows you to create usage plans to control how clients use your APIs. What happens when a client exceeds the quota or rate limits defined in a usage plan?

A API Gateway automatically increases the quota and rate limits to allow more requests.

B API Gateway blocks further requests from the client until the quota resets or the rate limit window passes.

C API Gateway queues the extra requests and processes them after the quota resets.

D API Gateway ignores the usage plan limits and allows all requests to pass.

💡 Hint

Think about how limits protect your API from overuse.

When a client exceeds the quota or rate limits in a usage plan, API Gateway blocks further requests until the limits reset. This prevents abuse and controls costs.

❓ Configuration

intermediate

Which AWS CLI command creates an API key linked to a usage plan?

You want to create an API key and associate it with an existing usage plan using AWS CLI. Which command correctly does this?

A aws apigateway create-api-key --name MyKey --enabled --usage-plan-id xyz789

B aws apigateway create-api-key --name MyKey --enabled --stage-keys restApiId=abc123,stage=prod --usage-plan-id xyz789

C aws apigateway create-api-key --name MyKey --enabled && aws apigateway create-usage-plan-key --key-id <key-id> --usage-plan-id xyz789

D aws apigateway create-usage-plan-key --name MyKey --enabled --usage-plan-id xyz789

💡 Hint

Creating an API key and linking it to a usage plan are two separate steps.

First, create the API key with create-api-key. Then, link it to a usage plan with create-usage-plan-key using the key ID and usage plan ID.

❓ Architecture

advanced

Designing API key usage for multiple clients with different limits

You have an API used by two clients: Client A needs 1000 requests/day, Client B needs 5000 requests/day. How should you configure usage plans and API keys to enforce these limits?

A Create one usage plan with a 5000 requests/day quota and assign both clients the same API key.

B Create one usage plan with a 6000 requests/day quota and assign each client a unique API key.

C Create two API keys with no usage plans; rely on client-side throttling.

D Create two usage plans with different quotas (1000 and 5000 requests/day) and assign each client a unique API key linked to their respective usage plan.

💡 Hint

Think about how usage plans control limits per API key.

Usage plans define quotas and rate limits. Assigning unique API keys linked to different usage plans allows enforcing different limits per client.

❓ security

advanced

What is a security risk of using API keys without usage plans?

If you deploy an API with API keys enabled but do not attach usage plans, what security risk arises?

A Clients can use unlimited requests, potentially causing denial of service or unexpected costs.

B API keys become invalid immediately after creation.

C API Gateway automatically disables the API keys after 24 hours.

D Clients cannot authenticate and will be blocked from accessing the API.

💡 Hint

Consider what usage plans control besides authentication.

Without usage plans, API keys only identify clients but do not limit their usage. This can lead to abuse or high costs.

✅ Best Practice

expert

How to rotate API keys securely without downtime?

You want to rotate API keys used by clients without causing service interruption. Which approach follows best practices?

A Create a new API key, associate it with the usage plan, update clients to use the new key, then delete the old key after confirmation.

B Use the same API key indefinitely to avoid rotation complexity.

C Update the usage plan to disable API keys temporarily during rotation.

D Delete the old API key first, then create a new one and update clients immediately.

💡 Hint

Think about minimizing downtime and ensuring clients can switch keys smoothly.

Creating a new key and associating it before removing the old key allows clients to switch without losing access, avoiding downtime.

Practice

1. What is the main purpose of an API key in AWS API Gateway?

easy

A. To monitor server CPU usage

B. To store user data securely

C. To encrypt API responses

D. To identify and control who can access the API

Solution

1. Step 1: Understand API key role

   An API key is used to identify the client calling the API.

2. Step 2: Identify purpose in AWS API Gateway

   It helps control and track who can access the API, not data storage or encryption.

3. Final Answer:

   To identify and control who can access the API -> Option D

4. Quick Check:

   API key = identify and control access [OK]

Hint: API keys identify users, not store or encrypt data [OK]

Common Mistakes:

• Confusing API keys with encryption keys
• Thinking API keys store user data
• Assuming API keys monitor server metrics

2. Which of the following is the correct way to associate an API key with a usage plan in AWS API Gateway?

easy

A. Create a usage plan, then add the API key to it

B. Create an API key, then add a usage plan to it

C. Create a usage plan and API key separately without linking

D. Create an API key inside the usage plan settings

Solution

1. Step 1: Understand usage plan and API key relationship

   Usage plans define limits and must have API keys linked to enforce them.

2. Step 2: Correct linking process

   You create a usage plan first, then add API keys to it to apply limits.

3. Final Answer:

   Create a usage plan, then add the API key to it -> Option A

4. Quick Check:

   Usage plan first, then add API key [OK]

Hint: Link API keys by adding them to usage plans [OK]

Common Mistakes:

• Trying to add usage plans to API keys
• Not linking keys and plans at all
• Assuming API keys are created inside usage plans

3. Given this AWS CLI command output showing usage plan limits:

{"throttle": {"rateLimit": 100, "burstLimit": 200}, "quota": {"limit": 1000, "period": "DAY"}}

What does this usage plan enforce?

medium

A. Max 1000 requests per second, burst up to 200, and 100 requests per day

B. Max 200 requests per second, burst up to 100, and 1000 requests per day

C. Max 100 requests per second, burst up to 200, and 1000 requests per day

D. No limits on requests per second or daily quota

Solution

1. Step 1: Interpret throttle limits

   RateLimit 100 means 100 requests per second max, burstLimit 200 allows short bursts up to 200 requests.

2. Step 2: Interpret quota limits

   Quota limit 1000 per DAY means max 1000 requests allowed in one day.

3. Final Answer:

   Max 100 requests per second, burst up to 200, and 1000 requests per day -> Option C

4. Quick Check:

   Throttle = 100/sec + 200 burst, Quota = 1000/day [OK]

Hint: Throttle = per second, quota = daily limit [OK]

Common Mistakes:

• Mixing burstLimit with rateLimit
• Confusing quota limit with per second limit
• Ignoring the quota period

4. You created an API key and a usage plan, but API calls with the key are not limited by the usage plan. What is the most likely cause?

medium

A. The usage plan has no throttle or quota limits set

B. The API key is not associated with the usage plan

C. The API key is expired

D. The API Gateway stage is not deployed

Solution

1. Step 1: Check API key and usage plan link

   Usage plans only apply limits if the API key is linked to them.

2. Step 2: Verify other causes

   While no limits or deployment can cause issues, the key not linked means no limits apply.

3. Final Answer:

   The API key is not associated with the usage plan -> Option B

4. Quick Check:

   Key must be linked to usage plan for limits [OK]

Hint: Check if API key is linked to usage plan [OK]

Common Mistakes:

• Assuming usage plan limits apply without linking keys
• Ignoring deployment status
• Confusing expired keys with unlinked keys

5. You want to create a usage plan that limits users to 5000 requests per month and 50 requests per second with a burst of 100. You also want to track usage per API key. Which steps correctly achieve this?

hard

A. Create usage plan with quota 5000/month and throttle 50/sec burst 100, then add API keys to the plan

B. Create API keys with limits, then assign usage plan to each key

C. Create usage plan with limits, deploy API, no need to link API keys

D. Set limits on API Gateway stage, then create API keys without usage plan

Solution

1. Step 1: Define usage plan with required limits

   Set quota to 5000 per month and throttle to 50 requests per second with burst 100.

2. Step 2: Link API keys to usage plan

   Adding API keys to the usage plan enables tracking and enforcement of limits per key.

3. Final Answer:

   Create usage plan with quota 5000/month and throttle 50/sec burst 100, then add API keys to the plan -> Option A

4. Quick Check:

   Usage plan sets limits + keys linked for tracking [OK]

Hint: Set limits in usage plan, then add API keys [OK]

Common Mistakes:

• Trying to set limits on API keys directly
• Not linking API keys to usage plan
• Setting limits only on API Gateway stage