API keys and usage plans in AWS - Mini Project: Build & Apply

API Keys and Usage Plans in AWS API Gateway

📖 Scenario: You are setting up an API in AWS API Gateway for a small app. You want to control who can use your API by creating API keys and usage plans. This helps you limit how many requests each user can make.

🎯 Goal: Build an AWS CloudFormation template that creates an API key and a usage plan with throttling limits. Then link the API key to the usage plan so only authorized users can access the API within set limits.

📋 What You'll Learn

Create an API key named MyApiKey with a description Key for app users

Create a usage plan named BasicUsagePlan with throttle limits: RateLimit 100 requests per second and BurstLimit 200

Associate the MyApiKey with the BasicUsagePlan

Use valid AWS CloudFormation syntax and resource types

💡 Why This Matters

🌍 Real World

API keys and usage plans are used to control access and limit usage of APIs in production environments, protecting backend services from overload and unauthorized use.

💼 Career

Cloud architects and DevOps engineers often configure API Gateway usage plans and keys to manage API consumption and billing.

1

Create the API key resource

Create an AWS CloudFormation resource of type AWS::ApiGateway::ApiKey named MyApiKey with the description Key for app users.

AWS

# Your CloudFormation template starts here
# Define the API key resource named MyApiKey with description

Hint

Use the AWS::ApiGateway::ApiKey resource type and set the Name and Description properties exactly as instructed.

2

Create the usage plan resource

Add an AWS CloudFormation resource of type AWS::ApiGateway::UsagePlan named BasicUsagePlan with throttle limits: RateLimit 100 and BurstLimit 200.

AWS

Resources:
  MyApiKey:
    Type: AWS::ApiGateway::ApiKey
    Properties:
      Name: MyApiKey
      Description: Key for app users
      Enabled: true

# Add the BasicUsagePlan resource with throttle limits here

Hint

Define the BasicUsagePlan resource with Throttle property containing RateLimit and BurstLimit as numbers.

3

Associate the API key with the usage plan

Add the ApiStages property to the BasicUsagePlan resource with an empty list (you will add stages later). Then add the UsagePlanId and KeyId properties to a new resource of type AWS::ApiGateway::UsagePlanKey named MyUsagePlanKey that links MyApiKey to BasicUsagePlan.

AWS

Resources:
  MyApiKey:
    Type: AWS::ApiGateway::ApiKey
    Properties:
      Name: MyApiKey
      Description: Key for app users
      Enabled: true
  BasicUsagePlan:
    Type: AWS::ApiGateway::UsagePlan
    Properties:
      UsagePlanName: BasicUsagePlan
      Throttle:
        RateLimit: 100
        BurstLimit: 200
      # Add ApiStages property here

# Add MyUsagePlanKey resource linking MyApiKey and BasicUsagePlan here

Hint

Use ApiStages: [] in BasicUsagePlan. Create MyUsagePlanKey resource with KeyId referencing MyApiKey and UsagePlanId referencing BasicUsagePlan.

4

Complete the usage plan with API stage association

Update the ApiStages property of BasicUsagePlan to include one stage with ApiId set to exampleApiId and Stage set to prod. This completes the usage plan configuration to control usage on the production stage of the API.

AWS

Resources:
  MyApiKey:
    Type: AWS::ApiGateway::ApiKey
    Properties:
      Name: MyApiKey
      Description: Key for app users
      Enabled: true
  BasicUsagePlan:
    Type: AWS::ApiGateway::UsagePlan
    Properties:
      UsagePlanName: BasicUsagePlan
      Throttle:
        RateLimit: 100
        BurstLimit: 200
      # Update ApiStages property here
  MyUsagePlanKey:
    Type: AWS::ApiGateway::UsagePlanKey
    Properties:
      KeyId: !Ref MyApiKey
      KeyType: API_KEY
      UsagePlanId: !Ref BasicUsagePlan

Hint

Replace the empty ApiStages list with one item containing ApiId: exampleApiId and Stage: prod.

Practice

1. What is the main purpose of an API key in AWS API Gateway?

easy

A. To monitor server CPU usage

B. To store user data securely

C. To encrypt API responses

D. To identify and control who can access the API

Solution

1. Step 1: Understand API key role

   An API key is used to identify the client calling the API.

2. Step 2: Identify purpose in AWS API Gateway

   It helps control and track who can access the API, not data storage or encryption.

3. Final Answer:

   To identify and control who can access the API -> Option D

4. Quick Check:

   API key = identify and control access [OK]

Hint: API keys identify users, not store or encrypt data [OK]

Common Mistakes:

• Confusing API keys with encryption keys
• Thinking API keys store user data
• Assuming API keys monitor server metrics

2. Which of the following is the correct way to associate an API key with a usage plan in AWS API Gateway?

easy

A. Create a usage plan, then add the API key to it

B. Create an API key, then add a usage plan to it

C. Create a usage plan and API key separately without linking

D. Create an API key inside the usage plan settings

Solution

1. Step 1: Understand usage plan and API key relationship

   Usage plans define limits and must have API keys linked to enforce them.

2. Step 2: Correct linking process

   You create a usage plan first, then add API keys to it to apply limits.

3. Final Answer:

   Create a usage plan, then add the API key to it -> Option A

4. Quick Check:

   Usage plan first, then add API key [OK]

Hint: Link API keys by adding them to usage plans [OK]

Common Mistakes:

• Trying to add usage plans to API keys
• Not linking keys and plans at all
• Assuming API keys are created inside usage plans

3. Given this AWS CLI command output showing usage plan limits:

{"throttle": {"rateLimit": 100, "burstLimit": 200}, "quota": {"limit": 1000, "period": "DAY"}}

What does this usage plan enforce?

medium

A. Max 1000 requests per second, burst up to 200, and 100 requests per day

B. Max 200 requests per second, burst up to 100, and 1000 requests per day

C. Max 100 requests per second, burst up to 200, and 1000 requests per day

D. No limits on requests per second or daily quota

Solution

1. Step 1: Interpret throttle limits

   RateLimit 100 means 100 requests per second max, burstLimit 200 allows short bursts up to 200 requests.

2. Step 2: Interpret quota limits

   Quota limit 1000 per DAY means max 1000 requests allowed in one day.

3. Final Answer:

   Max 100 requests per second, burst up to 200, and 1000 requests per day -> Option C

4. Quick Check:

   Throttle = 100/sec + 200 burst, Quota = 1000/day [OK]

Hint: Throttle = per second, quota = daily limit [OK]

Common Mistakes:

• Mixing burstLimit with rateLimit
• Confusing quota limit with per second limit
• Ignoring the quota period

4. You created an API key and a usage plan, but API calls with the key are not limited by the usage plan. What is the most likely cause?

medium

A. The usage plan has no throttle or quota limits set

B. The API key is not associated with the usage plan

C. The API key is expired

D. The API Gateway stage is not deployed

Solution

1. Step 1: Check API key and usage plan link

   Usage plans only apply limits if the API key is linked to them.

2. Step 2: Verify other causes

   While no limits or deployment can cause issues, the key not linked means no limits apply.

3. Final Answer:

   The API key is not associated with the usage plan -> Option B

4. Quick Check:

   Key must be linked to usage plan for limits [OK]

Hint: Check if API key is linked to usage plan [OK]

Common Mistakes:

• Assuming usage plan limits apply without linking keys
• Ignoring deployment status
• Confusing expired keys with unlinked keys

5. You want to create a usage plan that limits users to 5000 requests per month and 50 requests per second with a burst of 100. You also want to track usage per API key. Which steps correctly achieve this?

hard

A. Create usage plan with quota 5000/month and throttle 50/sec burst 100, then add API keys to the plan

B. Create API keys with limits, then assign usage plan to each key

C. Create usage plan with limits, deploy API, no need to link API keys

D. Set limits on API Gateway stage, then create API keys without usage plan

Solution

1. Step 1: Define usage plan with required limits

   Set quota to 5000 per month and throttle to 50 requests per second with burst 100.

2. Step 2: Link API keys to usage plan

   Adding API keys to the usage plan enables tracking and enforcement of limits per key.

3. Final Answer:

   Create usage plan with quota 5000/month and throttle 50/sec burst 100, then add API keys to the plan -> Option A

4. Quick Check:

   Usage plan sets limits + keys linked for tracking [OK]

Hint: Set limits in usage plan, then add API keys [OK]

Common Mistakes:

• Trying to set limits on API keys directly
• Not linking API keys to usage plan
• Setting limits only on API Gateway stage