Several internal systems need to read aggregate data stored in S3 over HTTPS.
Centralize authentication, rate limits, and input validation without exposing the data store directly.
Which design or service is most appropriate?
API Gateway with Lambda separates API authentication, throttling, and validation from the S3 retrieval logic.
Detailed explanation
There is no authentication, rate limiting, or input validation, so data can be exposed unintentionally.
There is no authentication, rate limiting, or input validation, so data can be exposed unintentionally.
A crawler discovers schemas and updates a catalog; it does not serve authenticated data requests.
A crawler discovers schemas and updates a catalog; it does not serve authenticated data requests.
Audit logs do not provide a consumer data contract or access control for aggregate data.
Audit logs do not provide a consumer data contract or access control for aggregate data.
Authentication, throttling, input validation, and retrieval logic can be managed at separate boundaries.
Authentication, throttling, input validation, and retrieval logic can be managed at separate boundaries.
Check official documentation
Compare the following points with the official documentation.
API Gatewayの認証・スロットリング、Lambda統合、S3のアクセス制御に関する公式説明を確認する。
What to confirm
データAPI、オブジェクト公開、カタログ更新、監査ログの責務を区別できる。
Key points
- Data API
- API Gateway
- Authentication
- Throttling
Notes
- Environment: AWS公式DEA-C01試験ガイドと各サービスの公式ドキュメントの確認
- Confirm the relevant DEA-C01 Skill and current AWS service documentation.
Foundation review
Contract
Define fields, pagination, errors, and authorization independently of S3 objects.
Boundary
Keep storage permissions private and expose only the intended API response.