API keys and usage plans in AWS - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

How does API Gateway enforce usage limits with usage plans?

API Gateway allows you to create usage plans to control how clients use your APIs. What happens when a client exceeds the quota or rate limits defined in a usage plan?

A API Gateway automatically increases the quota and rate limits to allow more requests.

B API Gateway blocks further requests from the client until the quota resets or the rate limit window passes.

C API Gateway queues the extra requests and processes them after the quota resets.

D API Gateway ignores the usage plan limits and allows all requests to pass.

💡 Hint

Think about how limits protect your API from overuse.

When a client exceeds the quota or rate limits in a usage plan, API Gateway blocks further requests until the limits reset. This prevents abuse and controls costs.

❓ Configuration

intermediate

Which AWS CLI command creates an API key linked to a usage plan?

You want to create an API key and associate it with an existing usage plan using AWS CLI. Which command correctly does this?

A aws apigateway create-api-key --name MyKey --enabled --usage-plan-id xyz789

B aws apigateway create-api-key --name MyKey --enabled --stage-keys restApiId=abc123,stage=prod --usage-plan-id xyz789

C aws apigateway create-api-key --name MyKey --enabled && aws apigateway create-usage-plan-key --key-id <key-id> --usage-plan-id xyz789

D aws apigateway create-usage-plan-key --name MyKey --enabled --usage-plan-id xyz789

💡 Hint

Creating an API key and linking it to a usage plan are two separate steps.

First, create the API key with create-api-key. Then, link it to a usage plan with create-usage-plan-key using the key ID and usage plan ID.

❓ Architecture

advanced

Designing API key usage for multiple clients with different limits

You have an API used by two clients: Client A needs 1000 requests/day, Client B needs 5000 requests/day. How should you configure usage plans and API keys to enforce these limits?

A Create one usage plan with a 5000 requests/day quota and assign both clients the same API key.

B Create one usage plan with a 6000 requests/day quota and assign each client a unique API key.

C Create two API keys with no usage plans; rely on client-side throttling.

D Create two usage plans with different quotas (1000 and 5000 requests/day) and assign each client a unique API key linked to their respective usage plan.

💡 Hint

Think about how usage plans control limits per API key.

Usage plans define quotas and rate limits. Assigning unique API keys linked to different usage plans allows enforcing different limits per client.

❓ security

advanced

What is a security risk of using API keys without usage plans?

If you deploy an API with API keys enabled but do not attach usage plans, what security risk arises?

A Clients can use unlimited requests, potentially causing denial of service or unexpected costs.

B API keys become invalid immediately after creation.

C API Gateway automatically disables the API keys after 24 hours.

D Clients cannot authenticate and will be blocked from accessing the API.

💡 Hint

Consider what usage plans control besides authentication.

Without usage plans, API keys only identify clients but do not limit their usage. This can lead to abuse or high costs.

✅ Best Practice

expert

How to rotate API keys securely without downtime?

You want to rotate API keys used by clients without causing service interruption. Which approach follows best practices?

A Create a new API key, associate it with the usage plan, update clients to use the new key, then delete the old key after confirmation.

B Use the same API key indefinitely to avoid rotation complexity.

C Update the usage plan to disable API keys temporarily during rotation.

D Delete the old API key first, then create a new one and update clients immediately.

💡 Hint

Think about minimizing downtime and ensuring clients can switch keys smoothly.

Creating a new key and associating it before removing the old key allows clients to switch without losing access, avoiding downtime.