,

API Gateway Case Study: Secure API’s for Collaboration Platform of a Manufacturing Organization

Executive Summary

Our customer is the world's leading electronic measurement company, transforming today's measurement experience through innovations in wireless, modular, and software solutions. The customer wanted to develop secure application with high availability and seamless user experience for their supply chain management process through their collaboration platform.

About the Customer

Our customer is the world's leading electronic measurement company, transforming today's measurement experience through innovations in wireless, modular, and software solutions. With its roots based in Hewlett-Packard and Agilent, the customer delivers solutions in wireless communications, aerospace and defense and semiconductor markets with world-class platforms, software and consistent measurement science.

Customer Challenge

The customer needed a Collaboration Platform for its member and suppliers. The customer was using two different SaaS solution providers for separate business units or departments. They wanted a single solution that would cater to all their requirements and was not billed by the number of users accessing the platform. The customer had a usage pattern that had a broad range of volume.

AspireNXT had designed a solution that is completely serverless. This required a strong API Gateway that could manage security and access control that will govern client access to the Web Data (Files, Media, User Data, etc.) directly. Moreover, the access had to be role-based access permissions and they wanted a certain level of security to be established to avoid deliberate or accidental irregularities.

Why AWS

Being an existing user of the platform, the customer was confident in the capabilities of Amazon Web Services. AWS provided the services to deploy the application in line with the vision laid out by the customer. A serverless approach was chosen to deploy the application.

To facilitate the continuous build and deployment environment in AWS, the customer chose to work with AspireNXT, an IT services provider that is part of the AWS Partner Network (APN).

Partner Solution

Aspire NXT suggested to use an API Gateway wherein anyone trying to access any AWS resource had to go through this gateway. The following operations from our Client are being sent to the API Gateway; which in turn execute the requests using lambda functions:
o Read/Write of data operations into DynamoDB
o Read/Write object into AWS S3 bucket
o Backend Lambda based Web Application calls
o API calls to Cognito pool
o REST API Calls from on-premise to AWS Service

- HTTP, REST API for sales-order requirement which requires to store Oracle data into the DynamoDB table, and object files to S3 bucket.
- Restful API is integrated to get pre-signed S3 bucket URL to upload file attachments from the application to destination S3 bucket.
- Endpoints are enabled with Edge-optimized and ensuring cost optimization, security and performance.
- Enabled CloudWatch metrics for monitoring health checks and HTTP calls status.
- CORS configuration is enabled.
- AWS WAF service is integrated with API Gateway service.

Results and and Benefits

By using API Gateway, our customer was able to create, publish, maintain, monitor, and secure REST and WebSocket APIs at any scale.

- API gateway is set up to request authorization and verify request to AWS services. The AWS Lambda function is used to verify tokens and if validated the access is granted to the API.
- As with all the services included in AWS, the Amazon API gateway also provides the option of pay as you go. The service does not require any monthly or annual subscription. There is no startup or minimum cost; you only pay for incoming calls and data processed out.
- After the deployment of an API, the API can be tested from the application by generating SDKs. The SDK helps the developer by automatically managing retries and detecting network or other errors.
- Monitor the API in a secure and scalable environment.
- API versioning to ensure compatibility between multiple API implementations without any code changes.
- Memory management and data caching mechanisms to improve API performance and response times.

Top