Serverless Developer Guide
• Postman home page - Learn how to invoke APIs with the Postman application
Protect your API
To authenticate and authorize access to your Rest APIs, you can choose from the following:
• Amazon Cognito user pools as an identity source for who access the API.
• Lambda functions to control access to APIs by using a variety of identity sources.
• Resource-based policies to allow or deny speciﬁed access from source IP addresses or VPC 
endpoints.
• AWS Identity and Access Management roles, policies, and IAM tags to control access for who can 
invoke certain APIs.
Related resource(s):
• Controlling and managing access to a REST API in API Gateway
• API Security Whitepaper - Learn about AWS best practices for API Gateway security
More resources related to access control:
• How to set up cross-origin resource sharing (CORS)
• Mutual TLS in REST API
• Control access with AWS WAF
Advanced Topics
You can connect a microservice with a REST API and a single integration to a Lambda function. As 
you progress on your journey, you should explore the following advanced topics.
• Choose between REST and HTTP APIs
• Explore non-proxy custom integrations and data transformation
• Optimize your API with caching
• Explore HTTP APIs
• Learn how to use proxy routes and resources
• Send binary media types
• Explore bidirectional connections using WebSocket APIs
• Build and export your API using an OpenAPI 3 deﬁnition
Advanced Topics 67