title: Securing AWS API Gateway for external end users and internal systems
body: <p>We have an API hosted in <code>AWS API Gateway</code>. This need to be secured and for that we use the <code>AWS Cognito User Pool</code> for giving access to a mobile client and web application.</p>
  
  <p>We would also like to give access to the API to internal systems which in our case is <code>AWS Lambdas</code>. </p>
  
  <p>Can anyone explain the best approach for securing API Gateway resources for both external end users, but also from internal micro services?</p>
  
  <p>Any help is appreciated.</p>