API & Integration Services

TL;DR

• API Gateway (REST or HTTP) is the default ingress; HTTP APIs are usually simpler and cheaper; REST APIs retain usage plans and fine-grained request validation.
• AppSync (GraphQL) solves flexible, nested-entity fetching in a single query; REST forces over-fetching or under-fetching.
• Private APIs are network-isolated; they never touch the public internet. This is a different guarantee than authentication-protected public APIs.
• VPC Links let API Gateway call private backends without exposing them publicly.
• AppFlow is purpose-built for SaaS-to-AWS recurring data flows with built-in governance; custom Lambda integrations lack this rigor.
• Choose integration patterns per use case: flexible nested data (AppSync), internal-only (Private API), VPC-hosted backend (VPC Link), SaaS sync (AppFlow).

Core Concepts

API Gateway: REST vs. HTTP APIs

HTTP APIs (v2) are the default for straightforward Lambda-proxy patterns. They are simpler, cheaper, and have faster deployment. Use HTTP APIs unless a specific REST-only feature is required.

REST APIs (v1) retain features that simple proxy patterns don’t need:

• Usage plans and API keys: Tiered rate limiting for external consumers.
• Request/response validation and transformation: Validate incoming requests against a schema before reaching Lambda.
• WAF integration: Some WAF-specific patterns only work with REST APIs.
• API keys for billing tiers: Track consumption per consumer.

Decision: HTTP APIs unless a named REST-only feature is genuinely required.

AppSync and GraphQL: Solving the Flexible-Data Problem

REST APIs have an inherent constraint: the server decides the response shape. A REST endpoint returns a fixed set of fields: user (id, name, email, created_at, status). Some clients need all fields; some need only name; some need orders and items too.

Over-fetching: The user endpoint returns 5 fields; the mobile screen only uses 2. Bandwidth wasted.

Under-fetching: The mobile screen needs user, their recent orders, and each order’s items. Three REST calls required instead of one.

Custom endpoints: Build separate endpoints per screen (e.g., /users/{id}?mobile=true). Maintenance burden explodes.

GraphQL via AppSync lets the client request exactly the fields it needs across related entities in a single query:

{
  user(id: "123") {
    name
    orders {
      id
      items {
        name
        price
      }
    }
  }
}

The server respects the query shape; no over-fetching, no under-fetching, no custom endpoints per screen.

AppSync also includes:

• Real-time subscriptions: WebSocket-based subscriptions to data changes, native to AppSync.
• Data source integrations: Direct resolution to RDS, DynamoDB, Lambda, HTTP endpoints.
• Schema stitching: Combine multiple data sources into a single GraphQL schema.

Private APIs: Network Isolation, Not Just Authentication

A Private API is an API Gateway endpoint of type PRIVATE, reachable only through an interface VPC endpoint. The API never has a public IP and never routes over the public internet.

A public API protected by an API key is still public: it has a public IP, is reachable from anywhere on the internet, and relies on authentication (the API key) to grant access.

The difference:

• Private API: Network-level isolation. An attacker on the public internet cannot even reach the endpoint.
• Public API with auth: Authentication-level isolation. The endpoint is reachable; authentication gates access.

When to use: Internal-only services where the actual security requirement is “not reachable from the internet,” not just “only accessible with credentials.”

VPC Links: Calling Private Backends

VPC Links let API Gateway (or a Network Load Balancer) call backends inside a VPC without those backends being exposed publicly.

Pattern:

1. API Gateway has a VPC Link to an NLB in a private subnet.
2. The NLB targets EC2 instances or ECS tasks running application logic.
3. Application instances are not in public subnets; they have no public IPs.
4. API Gateway’s public endpoint is the only ingress; it forwards to the private NLB.

Benefit: Keep backend fully private while using API Gateway’s routing, throttling, authentication, and logging.

AppFlow: Purpose-Built SaaS Integration

Custom Lambda integration:

Lambda (scheduled) → calls Salesforce API → transforms data → writes to S3

Works, but:

• Credential management is DIY (Secrets Manager, environment variables).
• Field-level PII handling is custom.
• Transformation logic is custom.
• Error handling and retries are custom.
• Monitoring and troubleshooting are custom.

AppFlow:

• Pre-built connectors for Salesforce, Slack, Zendesk, and 100+ others.
• Drag-and-drop field mapping.
• Built-in PII redaction, field-level filtering.
• Scheduled or event-triggered flows.
• Built-in error handling, monitoring, audit logs.

AppFlow is the right choice when the SaaS connector is well-supported and you want to avoid maintenance burden.

Comparison Table

Common Pitfalls

Interview Questions

• A mobile team complains their REST API requires 4 round trips to fetch a user, their orders, and each order’s items. Design a solution. — Tests whether AppSync/GraphQL is reached for the right underlying reason (flexible response shape, single round trip).

• Explain the security difference between a Private API and a public API protected by an API key. — Tests understanding of network isolation (Private API) vs. authentication (API key), and when each is appropriate.

• Design the integration for syncing Salesforce opportunities into S3 nightly, with field-level governance (PII redaction, field filtering). — Tests whether AppFlow is evaluated as the right tool with built-in governance, or if a custom Lambda integration is wrongly assumed to be the only option.

• You need to call a backend running inside a private VPC from a public API Gateway endpoint without exposing the backend. How do you do it? — Tests understanding of VPC Links as the bridge between public APIs and private backends.