[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-aws-deploying-custom-domain-rest-api":3,"mdc--iv9b7b-key":35,"related-repo-aws-deploying-custom-domain-rest-api":1349,"related-org-aws-deploying-custom-domain-rest-api":1451},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":24,"repoUrl":25,"updatedAt":26,"license":27,"forks":28,"topics":29,"repo":30,"sourceUrl":33,"mdContent":34},"deploying-custom-domain-rest-api","deploy custom domain REST APIs","Deploys a Regional REST API with a custom domain name, a Lambda backend function, and a request-based Lambda authorizer using AWS CLI. Covers ACM certificate provisioning, API Gateway REST API creation, Lambda function deployment, request authorizer setup, custom domain configuration, base path mapping, and Route 53 DNS record creation. Trigger keywords: custom domain, REST API, Lambda, Route 53, API Gateway, regional endpoint, request authorizer, base path mapping.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"aws","AWS (Amazon)","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Faws.png",[12,16,19,22],{"name":13,"slug":14,"type":15},"Deployment","deployment","tag",{"name":17,"slug":18,"type":15},"REST API","rest-api",{"name":20,"slug":21,"type":15},"API Development","api-development",{"name":23,"slug":8,"type":15},"AWS",1822,"https:\u002F\u002Fgithub.com\u002Faws\u002Fagent-toolkit-for-aws","2026-07-12T08:44:41.932471",null,157,[],{"repoUrl":25,"stars":24,"forks":28,"topics":31,"description":32},[],"Official, AWS-supported MCP servers, skills, and plugins to help AI agents build on AWS","https:\u002F\u002Fgithub.com\u002Faws\u002Fagent-toolkit-for-aws\u002Ftree\u002FHEAD\u002Fskills\u002Fspecialized-skills\u002Fserverless-skills\u002Fdeploying-custom-domain-rest-api","---\nname: deploying-custom-domain-rest-api\ndescription: >\n  Deploys a Regional REST API with a custom domain name, a Lambda backend function,\n  and a request-based Lambda authorizer using AWS CLI. Covers ACM certificate\n  provisioning, API Gateway REST API creation, Lambda function deployment, request\n  authorizer setup, custom domain configuration, base path mapping, and Route 53\n  DNS record creation. Trigger keywords: custom domain, REST API, Lambda, Route 53,\n  API Gateway, regional endpoint, request authorizer, base path mapping.\nversion: 1\n---\n\n# Custom Domain REST API with Lambda and Request Authorizer\n\n## Overview\n\nThis SOP deploys a REST API with a Regional custom domain name, a Lambda backend function, and a request-based Lambda authorizer. It handles ACM certificate provisioning, IAM role creation, Lambda function deployment, API Gateway REST API creation with a custom authorizer, custom domain configuration, base path mapping, and Route 53 DNS setup.\n\nThe architecture includes:\n\n- An API Gateway REST API with an endpoint type of REGIONAL\n- A request-based Lambda authorizer that validates headers, query string parameters, and stage variables\n- A Lambda backend function at `GET \u002Fexample`\n- A custom domain name with TLS 1.2\n- A base path mapping connecting the custom domain to the API stage\n- A Route 53 A-alias record pointing the custom domain to the API Gateway Regional endpoint\n\nImportant: This SOP uses Regional endpoints. If the user requests a private endpoint, inform them that this skill covers Regional endpoints only. Private endpoints require VPC endpoint configuration.\n\n## Parameters\n\n- custom_domain_name (required): Fully qualified domain name for the API (e.g., `api.example.com`)\n- region (required): AWS Region for all resources. The ACM certificate must be in this same Region for Regional endpoints\n- hosted_zone_id (required): Route 53 hosted zone ID for the domain\n- acm_certificate_arn (optional): ARN of an existing ACM certificate covering the custom domain. If not provided, Step 2 creates one\n- stage_name (optional, default: \"dev\"): API Gateway stage name\n\nConstraints for parameter acquisition:\n\n- You MUST ask for all required parameters upfront in a single prompt rather than one at a time\n- You MUST support multiple input methods (direct input, file path, URL)\n- You MUST confirm successful acquisition of all parameters before proceeding\n- You MUST inform the user that this skill uses hardcoded demo authorization values (headerValue1, queryValue1, stageValue1) that are NOT suitable for production. For production, use AWS Secrets Manager or Systems Manager Parameter Store to manage authorization credentials. See: https:\u002F\u002Fdocs.aws.amazon.com\u002Fsecretsmanager\u002Flatest\u002Fuserguide\u002Fintro.html\n- You MUST validate that custom_domain_name is a valid FQDN\n\n## Steps\n\n### 0. Verify Dependencies\n\nConstraints:\n\n- You MUST verify the following tools are available: aws-cli, python3, sed, node (v22+)\n- You MUST inform the user about any missing tools with a clear message\n- You MUST ask if the user wants to proceed despite missing tools\n- You MUST respect the customer's decision to abort at any point\n- You MUST explain to the customer what step is being executed, why, and which tool is being called\n\n### 1. Retrieve AWS Account ID\n\nThis step MUST be performed before all other steps.\n\nConstraints:\n\n- You MUST retrieve the account ID with: `aws sts get-caller-identity --query 'Account' --output text`\n- You MUST store the result as {account_id} and reuse it in all subsequent steps that reference {account_id}\n- You MUST abort if credentials are not configured\n\n### 2. Request ACM Certificate\n\nSkip this step if acm_certificate_arn is already provided.\n\nConstraints:\n\n- You MUST request the certificate with: `aws acm request-certificate --domain-name {custom_domain_name} --validation-method DNS --region {region}`\n- You MUST capture the CertificateArn from the response\n- You MUST retrieve the DNS validation record with: `aws acm describe-certificate --certificate-arn {cert_arn} --query 'Certificate.DomainValidationOptions[0].ResourceRecord' --region {region}`\n- You MUST create the validation CNAME in Route 53 with: `aws route53 change-resource-record-sets --hosted-zone-id {hosted_zone_id} --change-batch '{\"Changes\":[{\"Action\":\"UPSERT\",\"ResourceRecordSet\":{\"Name\":\"{validation_name}\",\"Type\":\"CNAME\",\"TTL\":300,\"ResourceRecords\":[{\"Value\":\"{validation_value}\"}]}}]}'`\n- You MUST wait for certificate validation with: `aws acm wait certificate-validated --certificate-arn {cert_arn} --region {region}`\n- The wait command may take up to 30 minutes. If it times out, check status manually with: `aws acm describe-certificate --certificate-arn {cert_arn} --query 'Certificate.Status' --region {region}` and retry the wait if status is still PENDING_VALIDATION\n- You MUST NOT proceed until the certificate status is ISSUED\n- You MUST store the certificate ARN as acm_certificate_arn for use in Step 7\n\n### 3. Create IAM Execution Roles\n\nConstraints:\n\n- You MUST create two IAM roles: one for the authorizer Lambda and one for the example function Lambda\n- Both roles use the same trust policy from `scripts\u002Flambda-trust-policy.json`. The trust policy includes an `aws:SourceAccount` condition scoped to the user's account ID\n- You MUST create a working copy of the trust policy and replace the `ACCOUNT_ID` placeholder with the actual account ID from Step 1. Use: `sed 's\u002FACCOUNT_ID\u002F{account_id}\u002F' scripts\u002Flambda-trust-policy.json > \u002Ftmp\u002Flambda-trust-policy.json`\n- You MUST create the authorizer role with: `aws iam create-role --role-name request-authorizer-role --assume-role-policy-document file:\u002F\u002F\u002Ftmp\u002Flambda-trust-policy.json`\n- You MUST attach the basic execution policy to the authorizer role with: `aws iam attach-role-policy --role-name request-authorizer-role --policy-arn arn:aws:iam::aws:policy\u002Fservice-role\u002FAWSLambdaBasicExecutionRole`\n- You MUST create the example function role with: `aws iam create-role --role-name example-function-role --assume-role-policy-document file:\u002F\u002F\u002Ftmp\u002Flambda-trust-policy.json`\n- You MUST attach the basic execution policy to the example function role with: `aws iam attach-role-policy --role-name example-function-role --policy-arn arn:aws:iam::aws:policy\u002Fservice-role\u002FAWSLambdaBasicExecutionRole`\n- You MUST capture the role ARNs from each create-role response for use in Step 4\n- You MUST wait at least 10 seconds after role creation before creating Lambda functions because IAM role propagation is eventually consistent\n\n### 4. Create and Deploy Lambda Functions\n\nConstraints:\n\n- You MUST create two Lambda functions: the request authorizer and the example function\n- For the authorizer function:\n  - You MUST create the function with inline code. First write the code to a file and package it:\n    `python3 -c \"import zipfile,io,base64; z=io.BytesIO(); f=zipfile.ZipFile(z,'w'); f.writestr('index.mjs', open('scripts\u002Fauthorizer.mjs').read()); f.close(); open('\u002Ftmp\u002Fauthorizer.zip','wb').write(z.getvalue())\"`\n  - Then create the function with: `aws lambda create-function --function-name request-authorizer --runtime nodejs22.x --handler index.handler --role {authorizer_role_arn} --zip-file fileb:\u002F\u002F\u002Ftmp\u002Fauthorizer.zip --timeout 10 --region {region}`\n- For the example function:\n  - You MUST create the function with inline code. First write the code to a file and package it:\n    `python3 -c \"import zipfile,io; z=io.BytesIO(); f=zipfile.ZipFile(z,'w'); f.writestr('index.mjs', open('scripts\u002Fexample_function.mjs').read()); f.close(); open('\u002Ftmp\u002Fexample_function.zip','wb').write(z.getvalue())\"`\n  - Then create the function with: `aws lambda create-function --function-name example-function --runtime nodejs22.x --handler index.handler --role {example_role_arn} --zip-file fileb:\u002F\u002F\u002Ftmp\u002Fexample_function.zip --timeout 10 --region {region}`\n- You MUST verify each function was created by calling: `aws lambda get-function --function-name {function_name} --region {region}`\n\n### 5. Create REST API with Request Authorizer\n\nConstraints:\n\n- You MUST create the REST API with: `aws apigateway create-rest-api --name custom-domain-api --endpoint-configuration types=REGIONAL --region {region}`\n- You MUST capture the API id and get the root resource ID with: `aws apigateway get-resources --rest-api-id {api_id} --region {region}`\n- You MUST create the request-based Lambda authorizer with: `aws apigateway create-authorizer --rest-api-id {api_id} --name request-authorizer --type REQUEST --authorizer-uri 'arn:aws:apigateway:{region}:lambda:path\u002F2015-03-31\u002Ffunctions\u002Farn:aws:lambda:{region}:{account_id}:function:request-authorizer\u002Finvocations' --identity-source 'method.request.header.HeaderAuth1,method.request.querystring.QueryString1,context.stage' --region {region}`\n- You MUST capture the authorizer ID from the response\n- You MUST grant API Gateway permission to invoke the authorizer with: `aws lambda add-permission --function-name request-authorizer --statement-id apigateway-auth-invoke --action lambda:InvokeFunction --principal apigateway.amazonaws.com --source-arn 'arn:aws:execute-api:{region}:{account_id}:{api_id}\u002Fauthorizers\u002F{authorizer_id}' --region {region}`\n- You MUST create the \u002Fexample resource with: `aws apigateway create-resource --rest-api-id {api_id} --parent-id {root_resource_id} --path-part example --region {region}`\n- You MUST create the GET method with: `aws apigateway put-method --rest-api-id {api_id} --resource-id {example_resource_id} --http-method GET --authorization-type CUSTOM --authorizer-id {authorizer_id} --region {region}`\n- You MUST create the Lambda proxy integration with: `aws apigateway put-integration --rest-api-id {api_id} --resource-id {example_resource_id} --http-method GET --type AWS_PROXY --integration-http-method POST --uri 'arn:aws:apigateway:{region}:lambda:path\u002F2015-03-31\u002Ffunctions\u002Farn:aws:lambda:{region}:{account_id}:function:example-function\u002Finvocations' --region {region}`\n- You MUST grant API Gateway permission to invoke the example function with: `aws lambda add-permission --function-name example-function --statement-id apigateway-invoke --action lambda:InvokeFunction --principal apigateway.amazonaws.com --source-arn 'arn:aws:execute-api:{region}:{account_id}:{api_id}\u002F*\u002FGET\u002Fexample' --region {region}`\n- You MUST NOT create the deployment until all resources, methods, and integrations are configured\n- You MUST configure request validation to reject malformed query parameters and headers by validating that QueryString1 and HeaderAuth1 match expected patterns and enforcing size limits\n\n### 6. Deploy the API\n\nConstraints:\n\n- You MUST create the deployment with: `aws apigateway create-deployment --rest-api-id {api_id} --stage-name {stage_name} --region {region}`\n- You MUST set the stage variable required by the authorizer with: `aws apigateway update-stage --rest-api-id {api_id} --stage-name {stage_name} --patch-operations op=replace,path=\u002Fvariables\u002FStageVar1,value=stageValue1 --region {region}`\n- You MUST verify the deployment and stage variable by calling: `aws apigateway get-stage --rest-api-id {api_id} --stage-name {stage_name} --region {region}` and confirming StageVar1 is present in the variables\n- You MUST enable access logging on the stage. First create the log group: `aws logs create-log-group --log-group-name api-gw-access-logs --region {region}`. Then enable logging with format: `aws apigateway update-stage --rest-api-id {api_id} --stage-name {stage_name} --patch-operations op=replace,path=\u002FaccessLogSettings\u002FdestinationArn,value=arn:aws:logs:{region}:{account_id}:log-group:api-gw-access-logs op=replace,path=\u002FaccessLogSettings\u002Fformat,value='{\"requestId\":\"$context.requestId\",\"ip\":\"$context.identity.sourceIp\",\"requestTime\":\"$context.requestTime\",\"httpMethod\":\"$context.httpMethod\",\"resourcePath\":\"$context.resourcePath\",\"status\":\"$context.status\"}' --region {region}`\n\n### 7. Create Custom Domain and Base Path Mapping\n\nConstraints:\n\n- You MUST create the custom domain with: `aws apigateway create-domain-name --domain-name {custom_domain_name} --regional-certificate-arn {acm_certificate_arn} --endpoint-configuration types=REGIONAL --security-policy TLS_1_2 --region {region}`\n- You MUST capture the regionalDomainName and regionalHostedZoneId from the response for use in Step 8\n- You MUST create the base path mapping with: `aws apigateway create-base-path-mapping --domain-name {custom_domain_name} --rest-api-id {api_id} --stage {stage_name} --base-path '(none)' --region {region}`\n- You MUST verify the domain was created by calling: `aws apigateway get-domain-name --domain-name {custom_domain_name} --region {region}`\n- You MUST NOT downgrade the security policy below TLS_1_2\n\n### 8. Create Route 53 DNS Record\n\nConstraints:\n\n- You MUST create a working copy of `scripts\u002Fdns-record.json` with placeholders replaced: `sed -e 's\u002FCUSTOM_DOMAIN_NAME\u002F{custom_domain_name}\u002F' -e 's\u002FREGIONAL_DOMAIN_NAME\u002F{regional_domain_name}\u002F' -e 's\u002FREGIONAL_HOSTED_ZONE_ID\u002F{regional_hosted_zone_id}\u002F' scripts\u002Fdns-record.json > \u002Ftmp\u002Fdns-record.json`\n- The command is: `aws route53 change-resource-record-sets --hosted-zone-id {hosted_zone_id} --change-batch file:\u002F\u002F\u002Ftmp\u002Fdns-record.json`\n- You MUST use the regionalDomainName and regionalHostedZoneId captured from Step 7, not the user's hosted zone ID for the AliasTarget\n- You MUST use an A-alias record (not CNAME) when using Route 53 as the DNS provider\n- You SHOULD inform the user that DNS propagation can take up to 48 hours\n\n### 9. Validate Final Setup\n\nConstraints:\n\n- You SHOULD run `scripts\u002Fvalidate.sh {custom_domain_name} {api_id} {region}` to check all resources\n- You MUST inform the user to test with: `curl 'https:\u002F\u002F{custom_domain_name}\u002Fexample?QueryString1=queryValue1' -H 'HeaderAuth1: headerValue1'`\n- You MUST explain that the expected response is a 200 with `{\"message\": \"Hello from the example function!\"}`\n- You MUST explain that requests missing the correct HeaderAuth1 header or QueryString1 query parameter will be denied by the authorizer\n- You MUST provide a summary of all created resources including:\n  - ACM certificate ARN\n  - IAM role ARNs\n  - Lambda function ARNs\n  - REST API ID and stage name\n  - Authorizer ID\n  - Custom domain name and Regional domain name\n  - Route 53 DNS record\n\n## Examples\n\n### Example Input\n\n```\ncustom_domain_name: api.example.com\nregion: us-east-2\nhosted_zone_id: Z2OJLYMUO9EFXC\nstage_name: prod\n```\n\n### Example Output\n\n```\nACM certificate issued for api.example.com\n  ARN: arn:aws:acm:us-east-2:123456789012:certificate\u002Fabc-123\n\nIAM roles created\n  Authorizer: arn:aws:iam::123456789012:role\u002Frequest-authorizer-role\n  Example: arn:aws:iam::123456789012:role\u002Fexample-function-role\n\nLambda functions deployed\n  Authorizer: arn:aws:lambda:us-east-2:123456789012:function:request-authorizer\n  Example: arn:aws:lambda:us-east-2:123456789012:function:example-function\n\nREST API deployed\n  API ID: a1b2c3d4e5\n  Stage: prod (StageVar1=stageValue1)\n  Authorizer: request-authorizer (REQUEST type)\n\nCustom domain configured\n  Domain: api.example.com\n  Regional endpoint: d-abc123.execute-api.us-east-2.amazonaws.com\n  TLS: 1.2\n\nRoute 53 DNS record created\n  A-alias: api.example.com -> d-abc123.execute-api.us-east-2.amazonaws.com\n\nTest command (authorized):\n  curl 'https:\u002F\u002Fapi.example.com\u002Fexample?QueryString1=queryValue1' -H 'HeaderAuth1: headerValue1'\n\nTest command (denied):\n  curl 'https:\u002F\u002Fapi.example.com\u002Fexample'\n```\n\n## Troubleshooting\n\n### Certificate Stuck in PENDING_VALIDATION\nVerify the DNS validation CNAME record exists in Route 53 by running `aws acm describe-certificate --certificate-arn {arn} --query 'Certificate.DomainValidationOptions'`. Ensure the CNAME was created in the correct hosted zone.\n\n### 403 Forbidden on API Calls\nThe request authorizer checks three values: `HeaderAuth1` header must be `headerValue1`, `QueryString1` query parameter must be `queryValue1`, and stage variable `StageVar1` must be `stageValue1`. Verify all three are present and correct. Check CloudWatch Logs for the authorizer function for detailed error messages.\n\n### 401 Unauthorized\nAPI Gateway returns 401 when the authorizer function cannot be invoked. Verify the Lambda permission was added for API Gateway to invoke the authorizer. Check that the authorizer URI is correct.\n\n### Missing Authentication Token (403)\nThe request path doesn't match a configured resource. Verify the `\u002Fexample` resource exists with `aws apigateway get-resources --rest-api-id {api_id}`. Ensure the API was deployed after creating all resources.\n\n### Custom Domain Returns No Response\nDNS propagation can take up to 48 hours. Check with `dig {custom_domain_name}`. Verify the A-alias record points to the correct regionalDomainName and regionalHostedZoneId from the create-domain-name response.\n\n### Stage Variable Not Set\nIf the authorizer denies all requests, verify the stage variable was set with `aws apigateway get-stage --rest-api-id {api_id} --stage-name {stage_name} --query 'variables'`. The StageVar1 variable must be set to `stageValue1`.\n\n### IAM Role Not Found When Creating Lambda\nIAM role propagation is eventually consistent. Wait at least 10 seconds after role creation before creating Lambda functions. Verify the role ARN with `aws iam get-role --role-name {role_name}`.\n\n### Base Path Mapping Not Working\nVerify with `aws apigateway get-base-path-mappings --domain-name {custom_domain_name}`. The base path `(none)` maps the domain root to the stage. Ensure the deployment to the stage completed successfully.\n\n## Security Considerations\n\n- The hardcoded authorization values (`headerValue1`, `queryValue1`, `stageValue1`) in the Lambda authorizer are **for demonstration only** and are NOT suitable for production. Replace with proper authentication mechanisms (JWT validation, API keys from AWS Secrets Manager, or OAuth) before deploying to production.\n- Enable request throttling on the API stage to prevent abuse. Configure rate and burst limits with: `aws apigateway update-stage --rest-api-id {api_id} --stage-name {stage_name} --patch-operations op=replace,path=\u002Fthrottle\u002FrateLimit,value=1000 op=replace,path=\u002Fthrottle\u002FburstLimit,value=2000`\n- Enable CloudWatch Logs encryption for Lambda log groups. Associate a KMS key with: `aws logs associate-kms-key --log-group-name \u002Faws\u002Flambda\u002Frequest-authorizer --kms-key-arn \u003CKMS_KEY_ARN>`\n- Protect the public API with AWS WAF to mitigate common exploits (SQL injection, XSS, rate-based rules): `aws wafv2 associate-web-acl --web-acl-arn \u003CWAF_ACL_ARN> --resource-arn arn:aws:apigateway:{region}::\u002Frestapis\u002F{api_id}\u002Fstages\u002F{stage_name}`\n\n## Additional Resources\n\n- [API Gateway custom domain names](https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fhow-to-custom-domains.html)\n- [ACM certificate validation](https:\u002F\u002Fdocs.aws.amazon.com\u002Facm\u002Flatest\u002Fuserguide\u002Fdns-validation.html)\n- [Lambda authorizers](https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fapigateway-use-lambda-authorizer.html)\n- [Route 53 alias records](https:\u002F\u002Fdocs.aws.amazon.com\u002FRoute53\u002Flatest\u002FDeveloperGuide\u002Fresource-record-sets-choosing-alias-non-alias.html)\n- [API Gateway Regional endpoints](https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fcreate-regional-api.html)\n",{"data":36,"body":38},{"name":4,"description":6,"version":37},1,{"type":39,"children":40},"root",[41,50,57,63,68,110,115,121,157,162,198,204,211,216,244,250,255,259,283,289,294,298,373,379,383,485,491,495,572,578,582,688,694,698,755,761,765,811,817,821,869,875,879,965,971,977,989,995,1004,1010,1016,1029,1035,1088,1094,1099,1105,1126,1132,1145,1151,1171,1177,1189,1195,1216,1222,1290,1296],{"type":42,"tag":43,"props":44,"children":46},"element","h1",{"id":45},"custom-domain-rest-api-with-lambda-and-request-authorizer",[47],{"type":48,"value":49},"text","Custom Domain REST API with Lambda and Request Authorizer",{"type":42,"tag":51,"props":52,"children":54},"h2",{"id":53},"overview",[55],{"type":48,"value":56},"Overview",{"type":42,"tag":58,"props":59,"children":60},"p",{},[61],{"type":48,"value":62},"This SOP deploys a REST API with a Regional custom domain name, a Lambda backend function, and a request-based Lambda authorizer. It handles ACM certificate provisioning, IAM role creation, Lambda function deployment, API Gateway REST API creation with a custom authorizer, custom domain configuration, base path mapping, and Route 53 DNS setup.",{"type":42,"tag":58,"props":64,"children":65},{},[66],{"type":48,"value":67},"The architecture includes:",{"type":42,"tag":69,"props":70,"children":71},"ul",{},[72,78,83,95,100,105],{"type":42,"tag":73,"props":74,"children":75},"li",{},[76],{"type":48,"value":77},"An API Gateway REST API with an endpoint type of REGIONAL",{"type":42,"tag":73,"props":79,"children":80},{},[81],{"type":48,"value":82},"A request-based Lambda authorizer that validates headers, query string parameters, and stage variables",{"type":42,"tag":73,"props":84,"children":85},{},[86,88],{"type":48,"value":87},"A Lambda backend function at ",{"type":42,"tag":89,"props":90,"children":92},"code",{"className":91},[],[93],{"type":48,"value":94},"GET \u002Fexample",{"type":42,"tag":73,"props":96,"children":97},{},[98],{"type":48,"value":99},"A custom domain name with TLS 1.2",{"type":42,"tag":73,"props":101,"children":102},{},[103],{"type":48,"value":104},"A base path mapping connecting the custom domain to the API stage",{"type":42,"tag":73,"props":106,"children":107},{},[108],{"type":48,"value":109},"A Route 53 A-alias record pointing the custom domain to the API Gateway Regional endpoint",{"type":42,"tag":58,"props":111,"children":112},{},[113],{"type":48,"value":114},"Important: This SOP uses Regional endpoints. If the user requests a private endpoint, inform them that this skill covers Regional endpoints only. Private endpoints require VPC endpoint configuration.",{"type":42,"tag":51,"props":116,"children":118},{"id":117},"parameters",[119],{"type":48,"value":120},"Parameters",{"type":42,"tag":69,"props":122,"children":123},{},[124,137,142,147,152],{"type":42,"tag":73,"props":125,"children":126},{},[127,129,135],{"type":48,"value":128},"custom_domain_name (required): Fully qualified domain name for the API (e.g., ",{"type":42,"tag":89,"props":130,"children":132},{"className":131},[],[133],{"type":48,"value":134},"api.example.com",{"type":48,"value":136},")",{"type":42,"tag":73,"props":138,"children":139},{},[140],{"type":48,"value":141},"region (required): AWS Region for all resources. The ACM certificate must be in this same Region for Regional endpoints",{"type":42,"tag":73,"props":143,"children":144},{},[145],{"type":48,"value":146},"hosted_zone_id (required): Route 53 hosted zone ID for the domain",{"type":42,"tag":73,"props":148,"children":149},{},[150],{"type":48,"value":151},"acm_certificate_arn (optional): ARN of an existing ACM certificate covering the custom domain. If not provided, Step 2 creates one",{"type":42,"tag":73,"props":153,"children":154},{},[155],{"type":48,"value":156},"stage_name (optional, default: \"dev\"): API Gateway stage name",{"type":42,"tag":58,"props":158,"children":159},{},[160],{"type":48,"value":161},"Constraints for parameter acquisition:",{"type":42,"tag":69,"props":163,"children":164},{},[165,170,175,180,193],{"type":42,"tag":73,"props":166,"children":167},{},[168],{"type":48,"value":169},"You MUST ask for all required parameters upfront in a single prompt rather than one at a time",{"type":42,"tag":73,"props":171,"children":172},{},[173],{"type":48,"value":174},"You MUST support multiple input methods (direct input, file path, URL)",{"type":42,"tag":73,"props":176,"children":177},{},[178],{"type":48,"value":179},"You MUST confirm successful acquisition of all parameters before proceeding",{"type":42,"tag":73,"props":181,"children":182},{},[183,185],{"type":48,"value":184},"You MUST inform the user that this skill uses hardcoded demo authorization values (headerValue1, queryValue1, stageValue1) that are NOT suitable for production. For production, use AWS Secrets Manager or Systems Manager Parameter Store to manage authorization credentials. See: ",{"type":42,"tag":186,"props":187,"children":191},"a",{"href":188,"rel":189},"https:\u002F\u002Fdocs.aws.amazon.com\u002Fsecretsmanager\u002Flatest\u002Fuserguide\u002Fintro.html",[190],"nofollow",[192],{"type":48,"value":188},{"type":42,"tag":73,"props":194,"children":195},{},[196],{"type":48,"value":197},"You MUST validate that custom_domain_name is a valid FQDN",{"type":42,"tag":51,"props":199,"children":201},{"id":200},"steps",[202],{"type":48,"value":203},"Steps",{"type":42,"tag":205,"props":206,"children":208},"h3",{"id":207},"_0-verify-dependencies",[209],{"type":48,"value":210},"0. Verify Dependencies",{"type":42,"tag":58,"props":212,"children":213},{},[214],{"type":48,"value":215},"Constraints:",{"type":42,"tag":69,"props":217,"children":218},{},[219,224,229,234,239],{"type":42,"tag":73,"props":220,"children":221},{},[222],{"type":48,"value":223},"You MUST verify the following tools are available: aws-cli, python3, sed, node (v22+)",{"type":42,"tag":73,"props":225,"children":226},{},[227],{"type":48,"value":228},"You MUST inform the user about any missing tools with a clear message",{"type":42,"tag":73,"props":230,"children":231},{},[232],{"type":48,"value":233},"You MUST ask if the user wants to proceed despite missing tools",{"type":42,"tag":73,"props":235,"children":236},{},[237],{"type":48,"value":238},"You MUST respect the customer's decision to abort at any point",{"type":42,"tag":73,"props":240,"children":241},{},[242],{"type":48,"value":243},"You MUST explain to the customer what step is being executed, why, and which tool is being called",{"type":42,"tag":205,"props":245,"children":247},{"id":246},"_1-retrieve-aws-account-id",[248],{"type":48,"value":249},"1. Retrieve AWS Account ID",{"type":42,"tag":58,"props":251,"children":252},{},[253],{"type":48,"value":254},"This step MUST be performed before all other steps.",{"type":42,"tag":58,"props":256,"children":257},{},[258],{"type":48,"value":215},{"type":42,"tag":69,"props":260,"children":261},{},[262,273,278],{"type":42,"tag":73,"props":263,"children":264},{},[265,267],{"type":48,"value":266},"You MUST retrieve the account ID with: ",{"type":42,"tag":89,"props":268,"children":270},{"className":269},[],[271],{"type":48,"value":272},"aws sts get-caller-identity --query 'Account' --output text",{"type":42,"tag":73,"props":274,"children":275},{},[276],{"type":48,"value":277},"You MUST store the result as {account_id} and reuse it in all subsequent steps that reference {account_id}",{"type":42,"tag":73,"props":279,"children":280},{},[281],{"type":48,"value":282},"You MUST abort if credentials are not configured",{"type":42,"tag":205,"props":284,"children":286},{"id":285},"_2-request-acm-certificate",[287],{"type":48,"value":288},"2. Request ACM Certificate",{"type":42,"tag":58,"props":290,"children":291},{},[292],{"type":48,"value":293},"Skip this step if acm_certificate_arn is already provided.",{"type":42,"tag":58,"props":295,"children":296},{},[297],{"type":48,"value":215},{"type":42,"tag":69,"props":299,"children":300},{},[301,312,317,328,339,350,363,368],{"type":42,"tag":73,"props":302,"children":303},{},[304,306],{"type":48,"value":305},"You MUST request the certificate with: ",{"type":42,"tag":89,"props":307,"children":309},{"className":308},[],[310],{"type":48,"value":311},"aws acm request-certificate --domain-name {custom_domain_name} --validation-method DNS --region {region}",{"type":42,"tag":73,"props":313,"children":314},{},[315],{"type":48,"value":316},"You MUST capture the CertificateArn from the response",{"type":42,"tag":73,"props":318,"children":319},{},[320,322],{"type":48,"value":321},"You MUST retrieve the DNS validation record with: ",{"type":42,"tag":89,"props":323,"children":325},{"className":324},[],[326],{"type":48,"value":327},"aws acm describe-certificate --certificate-arn {cert_arn} --query 'Certificate.DomainValidationOptions[0].ResourceRecord' --region {region}",{"type":42,"tag":73,"props":329,"children":330},{},[331,333],{"type":48,"value":332},"You MUST create the validation CNAME in Route 53 with: ",{"type":42,"tag":89,"props":334,"children":336},{"className":335},[],[337],{"type":48,"value":338},"aws route53 change-resource-record-sets --hosted-zone-id {hosted_zone_id} --change-batch '{\"Changes\":[{\"Action\":\"UPSERT\",\"ResourceRecordSet\":{\"Name\":\"{validation_name}\",\"Type\":\"CNAME\",\"TTL\":300,\"ResourceRecords\":[{\"Value\":\"{validation_value}\"}]}}]}'",{"type":42,"tag":73,"props":340,"children":341},{},[342,344],{"type":48,"value":343},"You MUST wait for certificate validation with: ",{"type":42,"tag":89,"props":345,"children":347},{"className":346},[],[348],{"type":48,"value":349},"aws acm wait certificate-validated --certificate-arn {cert_arn} --region {region}",{"type":42,"tag":73,"props":351,"children":352},{},[353,355,361],{"type":48,"value":354},"The wait command may take up to 30 minutes. If it times out, check status manually with: ",{"type":42,"tag":89,"props":356,"children":358},{"className":357},[],[359],{"type":48,"value":360},"aws acm describe-certificate --certificate-arn {cert_arn} --query 'Certificate.Status' --region {region}",{"type":48,"value":362}," and retry the wait if status is still PENDING_VALIDATION",{"type":42,"tag":73,"props":364,"children":365},{},[366],{"type":48,"value":367},"You MUST NOT proceed until the certificate status is ISSUED",{"type":42,"tag":73,"props":369,"children":370},{},[371],{"type":48,"value":372},"You MUST store the certificate ARN as acm_certificate_arn for use in Step 7",{"type":42,"tag":205,"props":374,"children":376},{"id":375},"_3-create-iam-execution-roles",[377],{"type":48,"value":378},"3. Create IAM Execution Roles",{"type":42,"tag":58,"props":380,"children":381},{},[382],{"type":48,"value":215},{"type":42,"tag":69,"props":384,"children":385},{},[386,391,412,431,442,453,464,475,480],{"type":42,"tag":73,"props":387,"children":388},{},[389],{"type":48,"value":390},"You MUST create two IAM roles: one for the authorizer Lambda and one for the example function Lambda",{"type":42,"tag":73,"props":392,"children":393},{},[394,396,402,404,410],{"type":48,"value":395},"Both roles use the same trust policy from ",{"type":42,"tag":89,"props":397,"children":399},{"className":398},[],[400],{"type":48,"value":401},"scripts\u002Flambda-trust-policy.json",{"type":48,"value":403},". The trust policy includes an ",{"type":42,"tag":89,"props":405,"children":407},{"className":406},[],[408],{"type":48,"value":409},"aws:SourceAccount",{"type":48,"value":411}," condition scoped to the user's account ID",{"type":42,"tag":73,"props":413,"children":414},{},[415,417,423,425],{"type":48,"value":416},"You MUST create a working copy of the trust policy and replace the ",{"type":42,"tag":89,"props":418,"children":420},{"className":419},[],[421],{"type":48,"value":422},"ACCOUNT_ID",{"type":48,"value":424}," placeholder with the actual account ID from Step 1. Use: ",{"type":42,"tag":89,"props":426,"children":428},{"className":427},[],[429],{"type":48,"value":430},"sed 's\u002FACCOUNT_ID\u002F{account_id}\u002F' scripts\u002Flambda-trust-policy.json > \u002Ftmp\u002Flambda-trust-policy.json",{"type":42,"tag":73,"props":432,"children":433},{},[434,436],{"type":48,"value":435},"You MUST create the authorizer role with: ",{"type":42,"tag":89,"props":437,"children":439},{"className":438},[],[440],{"type":48,"value":441},"aws iam create-role --role-name request-authorizer-role --assume-role-policy-document file:\u002F\u002F\u002Ftmp\u002Flambda-trust-policy.json",{"type":42,"tag":73,"props":443,"children":444},{},[445,447],{"type":48,"value":446},"You MUST attach the basic execution policy to the authorizer role with: ",{"type":42,"tag":89,"props":448,"children":450},{"className":449},[],[451],{"type":48,"value":452},"aws iam attach-role-policy --role-name request-authorizer-role --policy-arn arn:aws:iam::aws:policy\u002Fservice-role\u002FAWSLambdaBasicExecutionRole",{"type":42,"tag":73,"props":454,"children":455},{},[456,458],{"type":48,"value":457},"You MUST create the example function role with: ",{"type":42,"tag":89,"props":459,"children":461},{"className":460},[],[462],{"type":48,"value":463},"aws iam create-role --role-name example-function-role --assume-role-policy-document file:\u002F\u002F\u002Ftmp\u002Flambda-trust-policy.json",{"type":42,"tag":73,"props":465,"children":466},{},[467,469],{"type":48,"value":468},"You MUST attach the basic execution policy to the example function role with: ",{"type":42,"tag":89,"props":470,"children":472},{"className":471},[],[473],{"type":48,"value":474},"aws iam attach-role-policy --role-name example-function-role --policy-arn arn:aws:iam::aws:policy\u002Fservice-role\u002FAWSLambdaBasicExecutionRole",{"type":42,"tag":73,"props":476,"children":477},{},[478],{"type":48,"value":479},"You MUST capture the role ARNs from each create-role response for use in Step 4",{"type":42,"tag":73,"props":481,"children":482},{},[483],{"type":48,"value":484},"You MUST wait at least 10 seconds after role creation before creating Lambda functions because IAM role propagation is eventually consistent",{"type":42,"tag":205,"props":486,"children":488},{"id":487},"_4-create-and-deploy-lambda-functions",[489],{"type":48,"value":490},"4. Create and Deploy Lambda Functions",{"type":42,"tag":58,"props":492,"children":493},{},[494],{"type":48,"value":215},{"type":42,"tag":69,"props":496,"children":497},{},[498,503,533,561],{"type":42,"tag":73,"props":499,"children":500},{},[501],{"type":48,"value":502},"You MUST create two Lambda functions: the request authorizer and the example function",{"type":42,"tag":73,"props":504,"children":505},{},[506,508],{"type":48,"value":507},"For the authorizer function:\n",{"type":42,"tag":69,"props":509,"children":510},{},[511,522],{"type":42,"tag":73,"props":512,"children":513},{},[514,516],{"type":48,"value":515},"You MUST create the function with inline code. First write the code to a file and package it:\n",{"type":42,"tag":89,"props":517,"children":519},{"className":518},[],[520],{"type":48,"value":521},"python3 -c \"import zipfile,io,base64; z=io.BytesIO(); f=zipfile.ZipFile(z,'w'); f.writestr('index.mjs', open('scripts\u002Fauthorizer.mjs').read()); f.close(); open('\u002Ftmp\u002Fauthorizer.zip','wb').write(z.getvalue())\"",{"type":42,"tag":73,"props":523,"children":524},{},[525,527],{"type":48,"value":526},"Then create the function with: ",{"type":42,"tag":89,"props":528,"children":530},{"className":529},[],[531],{"type":48,"value":532},"aws lambda create-function --function-name request-authorizer --runtime nodejs22.x --handler index.handler --role {authorizer_role_arn} --zip-file fileb:\u002F\u002F\u002Ftmp\u002Fauthorizer.zip --timeout 10 --region {region}",{"type":42,"tag":73,"props":534,"children":535},{},[536,538],{"type":48,"value":537},"For the example function:\n",{"type":42,"tag":69,"props":539,"children":540},{},[541,551],{"type":42,"tag":73,"props":542,"children":543},{},[544,545],{"type":48,"value":515},{"type":42,"tag":89,"props":546,"children":548},{"className":547},[],[549],{"type":48,"value":550},"python3 -c \"import zipfile,io; z=io.BytesIO(); f=zipfile.ZipFile(z,'w'); f.writestr('index.mjs', open('scripts\u002Fexample_function.mjs').read()); f.close(); open('\u002Ftmp\u002Fexample_function.zip','wb').write(z.getvalue())\"",{"type":42,"tag":73,"props":552,"children":553},{},[554,555],{"type":48,"value":526},{"type":42,"tag":89,"props":556,"children":558},{"className":557},[],[559],{"type":48,"value":560},"aws lambda create-function --function-name example-function --runtime nodejs22.x --handler index.handler --role {example_role_arn} --zip-file fileb:\u002F\u002F\u002Ftmp\u002Fexample_function.zip --timeout 10 --region {region}",{"type":42,"tag":73,"props":562,"children":563},{},[564,566],{"type":48,"value":565},"You MUST verify each function was created by calling: ",{"type":42,"tag":89,"props":567,"children":569},{"className":568},[],[570],{"type":48,"value":571},"aws lambda get-function --function-name {function_name} --region {region}",{"type":42,"tag":205,"props":573,"children":575},{"id":574},"_5-create-rest-api-with-request-authorizer",[576],{"type":48,"value":577},"5. Create REST API with Request Authorizer",{"type":42,"tag":58,"props":579,"children":580},{},[581],{"type":48,"value":215},{"type":42,"tag":69,"props":583,"children":584},{},[585,596,607,618,623,634,645,656,667,678,683],{"type":42,"tag":73,"props":586,"children":587},{},[588,590],{"type":48,"value":589},"You MUST create the REST API with: ",{"type":42,"tag":89,"props":591,"children":593},{"className":592},[],[594],{"type":48,"value":595},"aws apigateway create-rest-api --name custom-domain-api --endpoint-configuration types=REGIONAL --region {region}",{"type":42,"tag":73,"props":597,"children":598},{},[599,601],{"type":48,"value":600},"You MUST capture the API id and get the root resource ID with: ",{"type":42,"tag":89,"props":602,"children":604},{"className":603},[],[605],{"type":48,"value":606},"aws apigateway get-resources --rest-api-id {api_id} --region {region}",{"type":42,"tag":73,"props":608,"children":609},{},[610,612],{"type":48,"value":611},"You MUST create the request-based Lambda authorizer with: ",{"type":42,"tag":89,"props":613,"children":615},{"className":614},[],[616],{"type":48,"value":617},"aws apigateway create-authorizer --rest-api-id {api_id} --name request-authorizer --type REQUEST --authorizer-uri 'arn:aws:apigateway:{region}:lambda:path\u002F2015-03-31\u002Ffunctions\u002Farn:aws:lambda:{region}:{account_id}:function:request-authorizer\u002Finvocations' --identity-source 'method.request.header.HeaderAuth1,method.request.querystring.QueryString1,context.stage' --region {region}",{"type":42,"tag":73,"props":619,"children":620},{},[621],{"type":48,"value":622},"You MUST capture the authorizer ID from the response",{"type":42,"tag":73,"props":624,"children":625},{},[626,628],{"type":48,"value":627},"You MUST grant API Gateway permission to invoke the authorizer with: ",{"type":42,"tag":89,"props":629,"children":631},{"className":630},[],[632],{"type":48,"value":633},"aws lambda add-permission --function-name request-authorizer --statement-id apigateway-auth-invoke --action lambda:InvokeFunction --principal apigateway.amazonaws.com --source-arn 'arn:aws:execute-api:{region}:{account_id}:{api_id}\u002Fauthorizers\u002F{authorizer_id}' --region {region}",{"type":42,"tag":73,"props":635,"children":636},{},[637,639],{"type":48,"value":638},"You MUST create the \u002Fexample resource with: ",{"type":42,"tag":89,"props":640,"children":642},{"className":641},[],[643],{"type":48,"value":644},"aws apigateway create-resource --rest-api-id {api_id} --parent-id {root_resource_id} --path-part example --region {region}",{"type":42,"tag":73,"props":646,"children":647},{},[648,650],{"type":48,"value":649},"You MUST create the GET method with: ",{"type":42,"tag":89,"props":651,"children":653},{"className":652},[],[654],{"type":48,"value":655},"aws apigateway put-method --rest-api-id {api_id} --resource-id {example_resource_id} --http-method GET --authorization-type CUSTOM --authorizer-id {authorizer_id} --region {region}",{"type":42,"tag":73,"props":657,"children":658},{},[659,661],{"type":48,"value":660},"You MUST create the Lambda proxy integration with: ",{"type":42,"tag":89,"props":662,"children":664},{"className":663},[],[665],{"type":48,"value":666},"aws apigateway put-integration --rest-api-id {api_id} --resource-id {example_resource_id} --http-method GET --type AWS_PROXY --integration-http-method POST --uri 'arn:aws:apigateway:{region}:lambda:path\u002F2015-03-31\u002Ffunctions\u002Farn:aws:lambda:{region}:{account_id}:function:example-function\u002Finvocations' --region {region}",{"type":42,"tag":73,"props":668,"children":669},{},[670,672],{"type":48,"value":671},"You MUST grant API Gateway permission to invoke the example function with: ",{"type":42,"tag":89,"props":673,"children":675},{"className":674},[],[676],{"type":48,"value":677},"aws lambda add-permission --function-name example-function --statement-id apigateway-invoke --action lambda:InvokeFunction --principal apigateway.amazonaws.com --source-arn 'arn:aws:execute-api:{region}:{account_id}:{api_id}\u002F*\u002FGET\u002Fexample' --region {region}",{"type":42,"tag":73,"props":679,"children":680},{},[681],{"type":48,"value":682},"You MUST NOT create the deployment until all resources, methods, and integrations are configured",{"type":42,"tag":73,"props":684,"children":685},{},[686],{"type":48,"value":687},"You MUST configure request validation to reject malformed query parameters and headers by validating that QueryString1 and HeaderAuth1 match expected patterns and enforcing size limits",{"type":42,"tag":205,"props":689,"children":691},{"id":690},"_6-deploy-the-api",[692],{"type":48,"value":693},"6. Deploy the API",{"type":42,"tag":58,"props":695,"children":696},{},[697],{"type":48,"value":215},{"type":42,"tag":69,"props":699,"children":700},{},[701,712,723,736],{"type":42,"tag":73,"props":702,"children":703},{},[704,706],{"type":48,"value":705},"You MUST create the deployment with: ",{"type":42,"tag":89,"props":707,"children":709},{"className":708},[],[710],{"type":48,"value":711},"aws apigateway create-deployment --rest-api-id {api_id} --stage-name {stage_name} --region {region}",{"type":42,"tag":73,"props":713,"children":714},{},[715,717],{"type":48,"value":716},"You MUST set the stage variable required by the authorizer with: ",{"type":42,"tag":89,"props":718,"children":720},{"className":719},[],[721],{"type":48,"value":722},"aws apigateway update-stage --rest-api-id {api_id} --stage-name {stage_name} --patch-operations op=replace,path=\u002Fvariables\u002FStageVar1,value=stageValue1 --region {region}",{"type":42,"tag":73,"props":724,"children":725},{},[726,728,734],{"type":48,"value":727},"You MUST verify the deployment and stage variable by calling: ",{"type":42,"tag":89,"props":729,"children":731},{"className":730},[],[732],{"type":48,"value":733},"aws apigateway get-stage --rest-api-id {api_id} --stage-name {stage_name} --region {region}",{"type":48,"value":735}," and confirming StageVar1 is present in the variables",{"type":42,"tag":73,"props":737,"children":738},{},[739,741,747,749],{"type":48,"value":740},"You MUST enable access logging on the stage. First create the log group: ",{"type":42,"tag":89,"props":742,"children":744},{"className":743},[],[745],{"type":48,"value":746},"aws logs create-log-group --log-group-name api-gw-access-logs --region {region}",{"type":48,"value":748},". Then enable logging with format: ",{"type":42,"tag":89,"props":750,"children":752},{"className":751},[],[753],{"type":48,"value":754},"aws apigateway update-stage --rest-api-id {api_id} --stage-name {stage_name} --patch-operations op=replace,path=\u002FaccessLogSettings\u002FdestinationArn,value=arn:aws:logs:{region}:{account_id}:log-group:api-gw-access-logs op=replace,path=\u002FaccessLogSettings\u002Fformat,value='{\"requestId\":\"$context.requestId\",\"ip\":\"$context.identity.sourceIp\",\"requestTime\":\"$context.requestTime\",\"httpMethod\":\"$context.httpMethod\",\"resourcePath\":\"$context.resourcePath\",\"status\":\"$context.status\"}' --region {region}",{"type":42,"tag":205,"props":756,"children":758},{"id":757},"_7-create-custom-domain-and-base-path-mapping",[759],{"type":48,"value":760},"7. Create Custom Domain and Base Path Mapping",{"type":42,"tag":58,"props":762,"children":763},{},[764],{"type":48,"value":215},{"type":42,"tag":69,"props":766,"children":767},{},[768,779,784,795,806],{"type":42,"tag":73,"props":769,"children":770},{},[771,773],{"type":48,"value":772},"You MUST create the custom domain with: ",{"type":42,"tag":89,"props":774,"children":776},{"className":775},[],[777],{"type":48,"value":778},"aws apigateway create-domain-name --domain-name {custom_domain_name} --regional-certificate-arn {acm_certificate_arn} --endpoint-configuration types=REGIONAL --security-policy TLS_1_2 --region {region}",{"type":42,"tag":73,"props":780,"children":781},{},[782],{"type":48,"value":783},"You MUST capture the regionalDomainName and regionalHostedZoneId from the response for use in Step 8",{"type":42,"tag":73,"props":785,"children":786},{},[787,789],{"type":48,"value":788},"You MUST create the base path mapping with: ",{"type":42,"tag":89,"props":790,"children":792},{"className":791},[],[793],{"type":48,"value":794},"aws apigateway create-base-path-mapping --domain-name {custom_domain_name} --rest-api-id {api_id} --stage {stage_name} --base-path '(none)' --region {region}",{"type":42,"tag":73,"props":796,"children":797},{},[798,800],{"type":48,"value":799},"You MUST verify the domain was created by calling: ",{"type":42,"tag":89,"props":801,"children":803},{"className":802},[],[804],{"type":48,"value":805},"aws apigateway get-domain-name --domain-name {custom_domain_name} --region {region}",{"type":42,"tag":73,"props":807,"children":808},{},[809],{"type":48,"value":810},"You MUST NOT downgrade the security policy below TLS_1_2",{"type":42,"tag":205,"props":812,"children":814},{"id":813},"_8-create-route-53-dns-record",[815],{"type":48,"value":816},"8. Create Route 53 DNS Record",{"type":42,"tag":58,"props":818,"children":819},{},[820],{"type":48,"value":215},{"type":42,"tag":69,"props":822,"children":823},{},[824,843,854,859,864],{"type":42,"tag":73,"props":825,"children":826},{},[827,829,835,837],{"type":48,"value":828},"You MUST create a working copy of ",{"type":42,"tag":89,"props":830,"children":832},{"className":831},[],[833],{"type":48,"value":834},"scripts\u002Fdns-record.json",{"type":48,"value":836}," with placeholders replaced: ",{"type":42,"tag":89,"props":838,"children":840},{"className":839},[],[841],{"type":48,"value":842},"sed -e 's\u002FCUSTOM_DOMAIN_NAME\u002F{custom_domain_name}\u002F' -e 's\u002FREGIONAL_DOMAIN_NAME\u002F{regional_domain_name}\u002F' -e 's\u002FREGIONAL_HOSTED_ZONE_ID\u002F{regional_hosted_zone_id}\u002F' scripts\u002Fdns-record.json > \u002Ftmp\u002Fdns-record.json",{"type":42,"tag":73,"props":844,"children":845},{},[846,848],{"type":48,"value":847},"The command is: ",{"type":42,"tag":89,"props":849,"children":851},{"className":850},[],[852],{"type":48,"value":853},"aws route53 change-resource-record-sets --hosted-zone-id {hosted_zone_id} --change-batch file:\u002F\u002F\u002Ftmp\u002Fdns-record.json",{"type":42,"tag":73,"props":855,"children":856},{},[857],{"type":48,"value":858},"You MUST use the regionalDomainName and regionalHostedZoneId captured from Step 7, not the user's hosted zone ID for the AliasTarget",{"type":42,"tag":73,"props":860,"children":861},{},[862],{"type":48,"value":863},"You MUST use an A-alias record (not CNAME) when using Route 53 as the DNS provider",{"type":42,"tag":73,"props":865,"children":866},{},[867],{"type":48,"value":868},"You SHOULD inform the user that DNS propagation can take up to 48 hours",{"type":42,"tag":205,"props":870,"children":872},{"id":871},"_9-validate-final-setup",[873],{"type":48,"value":874},"9. Validate Final Setup",{"type":42,"tag":58,"props":876,"children":877},{},[878],{"type":48,"value":215},{"type":42,"tag":69,"props":880,"children":881},{},[882,895,906,917,922],{"type":42,"tag":73,"props":883,"children":884},{},[885,887,893],{"type":48,"value":886},"You SHOULD run ",{"type":42,"tag":89,"props":888,"children":890},{"className":889},[],[891],{"type":48,"value":892},"scripts\u002Fvalidate.sh {custom_domain_name} {api_id} {region}",{"type":48,"value":894}," to check all resources",{"type":42,"tag":73,"props":896,"children":897},{},[898,900],{"type":48,"value":899},"You MUST inform the user to test with: ",{"type":42,"tag":89,"props":901,"children":903},{"className":902},[],[904],{"type":48,"value":905},"curl 'https:\u002F\u002F{custom_domain_name}\u002Fexample?QueryString1=queryValue1' -H 'HeaderAuth1: headerValue1'",{"type":42,"tag":73,"props":907,"children":908},{},[909,911],{"type":48,"value":910},"You MUST explain that the expected response is a 200 with ",{"type":42,"tag":89,"props":912,"children":914},{"className":913},[],[915],{"type":48,"value":916},"{\"message\": \"Hello from the example function!\"}",{"type":42,"tag":73,"props":918,"children":919},{},[920],{"type":48,"value":921},"You MUST explain that requests missing the correct HeaderAuth1 header or QueryString1 query parameter will be denied by the authorizer",{"type":42,"tag":73,"props":923,"children":924},{},[925,927],{"type":48,"value":926},"You MUST provide a summary of all created resources including:\n",{"type":42,"tag":69,"props":928,"children":929},{},[930,935,940,945,950,955,960],{"type":42,"tag":73,"props":931,"children":932},{},[933],{"type":48,"value":934},"ACM certificate ARN",{"type":42,"tag":73,"props":936,"children":937},{},[938],{"type":48,"value":939},"IAM role ARNs",{"type":42,"tag":73,"props":941,"children":942},{},[943],{"type":48,"value":944},"Lambda function ARNs",{"type":42,"tag":73,"props":946,"children":947},{},[948],{"type":48,"value":949},"REST API ID and stage name",{"type":42,"tag":73,"props":951,"children":952},{},[953],{"type":48,"value":954},"Authorizer ID",{"type":42,"tag":73,"props":956,"children":957},{},[958],{"type":48,"value":959},"Custom domain name and Regional domain name",{"type":42,"tag":73,"props":961,"children":962},{},[963],{"type":48,"value":964},"Route 53 DNS record",{"type":42,"tag":51,"props":966,"children":968},{"id":967},"examples",[969],{"type":48,"value":970},"Examples",{"type":42,"tag":205,"props":972,"children":974},{"id":973},"example-input",[975],{"type":48,"value":976},"Example Input",{"type":42,"tag":978,"props":979,"children":983},"pre",{"className":980,"code":982,"language":48},[981],"language-text","custom_domain_name: api.example.com\nregion: us-east-2\nhosted_zone_id: Z2OJLYMUO9EFXC\nstage_name: prod\n",[984],{"type":42,"tag":89,"props":985,"children":987},{"__ignoreMap":986},"",[988],{"type":48,"value":982},{"type":42,"tag":205,"props":990,"children":992},{"id":991},"example-output",[993],{"type":48,"value":994},"Example Output",{"type":42,"tag":978,"props":996,"children":999},{"className":997,"code":998,"language":48},[981],"ACM certificate issued for api.example.com\n  ARN: arn:aws:acm:us-east-2:123456789012:certificate\u002Fabc-123\n\nIAM roles created\n  Authorizer: arn:aws:iam::123456789012:role\u002Frequest-authorizer-role\n  Example: arn:aws:iam::123456789012:role\u002Fexample-function-role\n\nLambda functions deployed\n  Authorizer: arn:aws:lambda:us-east-2:123456789012:function:request-authorizer\n  Example: arn:aws:lambda:us-east-2:123456789012:function:example-function\n\nREST API deployed\n  API ID: a1b2c3d4e5\n  Stage: prod (StageVar1=stageValue1)\n  Authorizer: request-authorizer (REQUEST type)\n\nCustom domain configured\n  Domain: api.example.com\n  Regional endpoint: d-abc123.execute-api.us-east-2.amazonaws.com\n  TLS: 1.2\n\nRoute 53 DNS record created\n  A-alias: api.example.com -> d-abc123.execute-api.us-east-2.amazonaws.com\n\nTest command (authorized):\n  curl 'https:\u002F\u002Fapi.example.com\u002Fexample?QueryString1=queryValue1' -H 'HeaderAuth1: headerValue1'\n\nTest command (denied):\n  curl 'https:\u002F\u002Fapi.example.com\u002Fexample'\n",[1000],{"type":42,"tag":89,"props":1001,"children":1002},{"__ignoreMap":986},[1003],{"type":48,"value":998},{"type":42,"tag":51,"props":1005,"children":1007},{"id":1006},"troubleshooting",[1008],{"type":48,"value":1009},"Troubleshooting",{"type":42,"tag":205,"props":1011,"children":1013},{"id":1012},"certificate-stuck-in-pending_validation",[1014],{"type":48,"value":1015},"Certificate Stuck in PENDING_VALIDATION",{"type":42,"tag":58,"props":1017,"children":1018},{},[1019,1021,1027],{"type":48,"value":1020},"Verify the DNS validation CNAME record exists in Route 53 by running ",{"type":42,"tag":89,"props":1022,"children":1024},{"className":1023},[],[1025],{"type":48,"value":1026},"aws acm describe-certificate --certificate-arn {arn} --query 'Certificate.DomainValidationOptions'",{"type":48,"value":1028},". Ensure the CNAME was created in the correct hosted zone.",{"type":42,"tag":205,"props":1030,"children":1032},{"id":1031},"_403-forbidden-on-api-calls",[1033],{"type":48,"value":1034},"403 Forbidden on API Calls",{"type":42,"tag":58,"props":1036,"children":1037},{},[1038,1040,1046,1048,1054,1056,1062,1064,1070,1072,1078,1080,1086],{"type":48,"value":1039},"The request authorizer checks three values: ",{"type":42,"tag":89,"props":1041,"children":1043},{"className":1042},[],[1044],{"type":48,"value":1045},"HeaderAuth1",{"type":48,"value":1047}," header must be ",{"type":42,"tag":89,"props":1049,"children":1051},{"className":1050},[],[1052],{"type":48,"value":1053},"headerValue1",{"type":48,"value":1055},", ",{"type":42,"tag":89,"props":1057,"children":1059},{"className":1058},[],[1060],{"type":48,"value":1061},"QueryString1",{"type":48,"value":1063}," query parameter must be ",{"type":42,"tag":89,"props":1065,"children":1067},{"className":1066},[],[1068],{"type":48,"value":1069},"queryValue1",{"type":48,"value":1071},", and stage variable ",{"type":42,"tag":89,"props":1073,"children":1075},{"className":1074},[],[1076],{"type":48,"value":1077},"StageVar1",{"type":48,"value":1079}," must be ",{"type":42,"tag":89,"props":1081,"children":1083},{"className":1082},[],[1084],{"type":48,"value":1085},"stageValue1",{"type":48,"value":1087},". Verify all three are present and correct. Check CloudWatch Logs for the authorizer function for detailed error messages.",{"type":42,"tag":205,"props":1089,"children":1091},{"id":1090},"_401-unauthorized",[1092],{"type":48,"value":1093},"401 Unauthorized",{"type":42,"tag":58,"props":1095,"children":1096},{},[1097],{"type":48,"value":1098},"API Gateway returns 401 when the authorizer function cannot be invoked. Verify the Lambda permission was added for API Gateway to invoke the authorizer. Check that the authorizer URI is correct.",{"type":42,"tag":205,"props":1100,"children":1102},{"id":1101},"missing-authentication-token-403",[1103],{"type":48,"value":1104},"Missing Authentication Token (403)",{"type":42,"tag":58,"props":1106,"children":1107},{},[1108,1110,1116,1118,1124],{"type":48,"value":1109},"The request path doesn't match a configured resource. Verify the ",{"type":42,"tag":89,"props":1111,"children":1113},{"className":1112},[],[1114],{"type":48,"value":1115},"\u002Fexample",{"type":48,"value":1117}," resource exists with ",{"type":42,"tag":89,"props":1119,"children":1121},{"className":1120},[],[1122],{"type":48,"value":1123},"aws apigateway get-resources --rest-api-id {api_id}",{"type":48,"value":1125},". Ensure the API was deployed after creating all resources.",{"type":42,"tag":205,"props":1127,"children":1129},{"id":1128},"custom-domain-returns-no-response",[1130],{"type":48,"value":1131},"Custom Domain Returns No Response",{"type":42,"tag":58,"props":1133,"children":1134},{},[1135,1137,1143],{"type":48,"value":1136},"DNS propagation can take up to 48 hours. Check with ",{"type":42,"tag":89,"props":1138,"children":1140},{"className":1139},[],[1141],{"type":48,"value":1142},"dig {custom_domain_name}",{"type":48,"value":1144},". Verify the A-alias record points to the correct regionalDomainName and regionalHostedZoneId from the create-domain-name response.",{"type":42,"tag":205,"props":1146,"children":1148},{"id":1147},"stage-variable-not-set",[1149],{"type":48,"value":1150},"Stage Variable Not Set",{"type":42,"tag":58,"props":1152,"children":1153},{},[1154,1156,1162,1164,1169],{"type":48,"value":1155},"If the authorizer denies all requests, verify the stage variable was set with ",{"type":42,"tag":89,"props":1157,"children":1159},{"className":1158},[],[1160],{"type":48,"value":1161},"aws apigateway get-stage --rest-api-id {api_id} --stage-name {stage_name} --query 'variables'",{"type":48,"value":1163},". The StageVar1 variable must be set to ",{"type":42,"tag":89,"props":1165,"children":1167},{"className":1166},[],[1168],{"type":48,"value":1085},{"type":48,"value":1170},".",{"type":42,"tag":205,"props":1172,"children":1174},{"id":1173},"iam-role-not-found-when-creating-lambda",[1175],{"type":48,"value":1176},"IAM Role Not Found When Creating Lambda",{"type":42,"tag":58,"props":1178,"children":1179},{},[1180,1182,1188],{"type":48,"value":1181},"IAM role propagation is eventually consistent. Wait at least 10 seconds after role creation before creating Lambda functions. Verify the role ARN with ",{"type":42,"tag":89,"props":1183,"children":1185},{"className":1184},[],[1186],{"type":48,"value":1187},"aws iam get-role --role-name {role_name}",{"type":48,"value":1170},{"type":42,"tag":205,"props":1190,"children":1192},{"id":1191},"base-path-mapping-not-working",[1193],{"type":48,"value":1194},"Base Path Mapping Not Working",{"type":42,"tag":58,"props":1196,"children":1197},{},[1198,1200,1206,1208,1214],{"type":48,"value":1199},"Verify with ",{"type":42,"tag":89,"props":1201,"children":1203},{"className":1202},[],[1204],{"type":48,"value":1205},"aws apigateway get-base-path-mappings --domain-name {custom_domain_name}",{"type":48,"value":1207},". The base path ",{"type":42,"tag":89,"props":1209,"children":1211},{"className":1210},[],[1212],{"type":48,"value":1213},"(none)",{"type":48,"value":1215}," maps the domain root to the stage. Ensure the deployment to the stage completed successfully.",{"type":42,"tag":51,"props":1217,"children":1219},{"id":1218},"security-considerations",[1220],{"type":48,"value":1221},"Security Considerations",{"type":42,"tag":69,"props":1223,"children":1224},{},[1225,1257,1268,1279],{"type":42,"tag":73,"props":1226,"children":1227},{},[1228,1230,1235,1236,1241,1242,1247,1249,1255],{"type":48,"value":1229},"The hardcoded authorization values (",{"type":42,"tag":89,"props":1231,"children":1233},{"className":1232},[],[1234],{"type":48,"value":1053},{"type":48,"value":1055},{"type":42,"tag":89,"props":1237,"children":1239},{"className":1238},[],[1240],{"type":48,"value":1069},{"type":48,"value":1055},{"type":42,"tag":89,"props":1243,"children":1245},{"className":1244},[],[1246],{"type":48,"value":1085},{"type":48,"value":1248},") in the Lambda authorizer are ",{"type":42,"tag":1250,"props":1251,"children":1252},"strong",{},[1253],{"type":48,"value":1254},"for demonstration only",{"type":48,"value":1256}," and are NOT suitable for production. Replace with proper authentication mechanisms (JWT validation, API keys from AWS Secrets Manager, or OAuth) before deploying to production.",{"type":42,"tag":73,"props":1258,"children":1259},{},[1260,1262],{"type":48,"value":1261},"Enable request throttling on the API stage to prevent abuse. Configure rate and burst limits with: ",{"type":42,"tag":89,"props":1263,"children":1265},{"className":1264},[],[1266],{"type":48,"value":1267},"aws apigateway update-stage --rest-api-id {api_id} --stage-name {stage_name} --patch-operations op=replace,path=\u002Fthrottle\u002FrateLimit,value=1000 op=replace,path=\u002Fthrottle\u002FburstLimit,value=2000",{"type":42,"tag":73,"props":1269,"children":1270},{},[1271,1273],{"type":48,"value":1272},"Enable CloudWatch Logs encryption for Lambda log groups. Associate a KMS key with: ",{"type":42,"tag":89,"props":1274,"children":1276},{"className":1275},[],[1277],{"type":48,"value":1278},"aws logs associate-kms-key --log-group-name \u002Faws\u002Flambda\u002Frequest-authorizer --kms-key-arn \u003CKMS_KEY_ARN>",{"type":42,"tag":73,"props":1280,"children":1281},{},[1282,1284],{"type":48,"value":1283},"Protect the public API with AWS WAF to mitigate common exploits (SQL injection, XSS, rate-based rules): ",{"type":42,"tag":89,"props":1285,"children":1287},{"className":1286},[],[1288],{"type":48,"value":1289},"aws wafv2 associate-web-acl --web-acl-arn \u003CWAF_ACL_ARN> --resource-arn arn:aws:apigateway:{region}::\u002Frestapis\u002F{api_id}\u002Fstages\u002F{stage_name}",{"type":42,"tag":51,"props":1291,"children":1293},{"id":1292},"additional-resources",[1294],{"type":48,"value":1295},"Additional Resources",{"type":42,"tag":69,"props":1297,"children":1298},{},[1299,1309,1319,1329,1339],{"type":42,"tag":73,"props":1300,"children":1301},{},[1302],{"type":42,"tag":186,"props":1303,"children":1306},{"href":1304,"rel":1305},"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fhow-to-custom-domains.html",[190],[1307],{"type":48,"value":1308},"API Gateway custom domain names",{"type":42,"tag":73,"props":1310,"children":1311},{},[1312],{"type":42,"tag":186,"props":1313,"children":1316},{"href":1314,"rel":1315},"https:\u002F\u002Fdocs.aws.amazon.com\u002Facm\u002Flatest\u002Fuserguide\u002Fdns-validation.html",[190],[1317],{"type":48,"value":1318},"ACM certificate validation",{"type":42,"tag":73,"props":1320,"children":1321},{},[1322],{"type":42,"tag":186,"props":1323,"children":1326},{"href":1324,"rel":1325},"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fapigateway-use-lambda-authorizer.html",[190],[1327],{"type":48,"value":1328},"Lambda authorizers",{"type":42,"tag":73,"props":1330,"children":1331},{},[1332],{"type":42,"tag":186,"props":1333,"children":1336},{"href":1334,"rel":1335},"https:\u002F\u002Fdocs.aws.amazon.com\u002FRoute53\u002Flatest\u002FDeveloperGuide\u002Fresource-record-sets-choosing-alias-non-alias.html",[190],[1337],{"type":48,"value":1338},"Route 53 alias records",{"type":42,"tag":73,"props":1340,"children":1341},{},[1342],{"type":42,"tag":186,"props":1343,"children":1346},{"href":1344,"rel":1345},"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fcreate-regional-api.html",[190],[1347],{"type":48,"value":1348},"API Gateway Regional endpoints",{"items":1350,"total":1450},[1351,1368,1381,1396,1409,1419,1434],{"slug":1352,"name":1352,"fn":1353,"description":1354,"org":1355,"tags":1356,"stars":24,"repoUrl":25,"updatedAt":1367},"agents-build","add capabilities to existing agent projects","Use when adding capabilities to an existing agent project — memory, app integration, VPC, multi-agent, migration, model changes, browser, code interpreter, or resource removal. Triggers on: \"add memory\", \"remember across sessions\", \"call agent from app\", \"invoke agent from code\", \"auth to call agent\", \"streaming responses\", \"VPC\", \"VPC connectivity\", \"VPC error\", \"can't reach from VPC\", \"multi-agent\", \"A2A\", \"A2A auth\", \"orchestrator not delegating\", \"specialist not called\", \"migrate Bedrock Agent\", \"after import\", \"migration issue\", \"framework for migration\", \"change model\", \"browser tool\", \"code interpreter\", \"delete agent\", \"tear down\", \"agentcore remove\", \"cross-account memory\", \"resource-based policy on memory\", \"pay for x402 content\", \"402 Payment Required\", \"microtransactions\", \"paid API or tool\". Not for connecting to external APIs via Gateway — use agents-connect. Not for scaffolding a new project — use agents-get-started. Not for CLI\u002Fdev server errors — use agents-debug. Strands vs LangGraph in a migration context routes here.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1357,1360,1363,1364],{"name":1358,"slug":1359,"type":15},"Agents","agents",{"name":1361,"slug":1362,"type":15},"Automation","automation",{"name":23,"slug":8,"type":15},{"name":1365,"slug":1366,"type":15},"Engineering","engineering","2026-07-12T08:42:53.812877",{"slug":1369,"name":1369,"fn":1370,"description":1371,"org":1372,"tags":1373,"stars":24,"repoUrl":25,"updatedAt":1380},"agents-connect","connect agents to external services","Use when connecting your agent to external APIs, tools, or services via Gateway, or restricting tool access with Cedar policies. Handles gateway setup, target types, outbound auth (OAuth, API key, IAM), credentials, and Cedar policy authoring. Triggers on: \"connect to API\", \"add gateway\", \"connect to MCP server\", \"Lambda tools\", \"OpenAPI\", \"gateway target\", \"Cedar policy\", \"restrict tools\", \"policy engine\", \"gateway auth error\", \"store API key\", \"outbound credential\", \"env var API key\", \"API key None after deploy\", \"credential not available after deploy\", \"should this be a gateway target\", \"give my agent tools\", \"add tools to agent\". Not for inbound auth (who can call your agent) — use agents-harden. Not for debugging agent behavior — use agents-debug. Not for VPC networking errors (agent can't reach APIs due to VPC) — use agents-build. Not for creating or hosting a new MCP server project — use agents-get-started.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1374,1375,1376,1379],{"name":1358,"slug":1359,"type":15},{"name":20,"slug":21,"type":15},{"name":1377,"slug":1378,"type":15},"Authentication","authentication",{"name":23,"slug":8,"type":15},"2026-07-16T06:00:38.866147",{"slug":1382,"name":1382,"fn":1383,"description":1384,"org":1385,"tags":1386,"stars":24,"repoUrl":25,"updatedAt":1395},"agents-debug","debug agent and environment issues","Use when your agent or environment is broken — wrong answers, errors, timeouts, tool failures, or CLI issues. Reads traces and logs to diagnose root causes. Also checks prerequisites when the CLI itself isn't working. Triggers on: \"agent not working\", \"wrong answer\", \"agent error\", \"tool call failing\", \"debug agent\", \"check logs\", \"read traces\", \"broken\", \"500 error\", \"424 error\", \"model access denied\", \"command not found\", \"stuck in DELETING\", \"maxVms exceeded\", \"cold start diagnosis\", \"cold start slow\", \"agentcore create error\", \"create failed\", \"exit code 7\", \"connection refused local dev\". Not for deploy failures — use agents-deploy. Not for performance tuning without errors — use agents-optimize. Not for VPC configuration — use agents-build. Not for observability setup or missing logs — use agents-optimize.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1387,1388,1389,1392],{"name":1358,"slug":1359,"type":15},{"name":23,"slug":8,"type":15},{"name":1390,"slug":1391,"type":15},"Debugging","debugging",{"name":1393,"slug":1394,"type":15},"Observability","observability","2026-07-16T06:00:44.679093",{"slug":1397,"name":1397,"fn":1398,"description":1399,"org":1400,"tags":1401,"stars":24,"repoUrl":25,"updatedAt":1408},"agents-deploy","deploy AI agents to AWS","Use when deploying your agent to AWS, or when a deploy has failed. Handles pre-flight validation, CDK\u002FIAM\u002Fquota error diagnosis, version management, rollback, and canary deployments. Triggers on: \"deploy my agent\", \"agentcore deploy\", \"deploy failed\", \"CDK error\", \"rollback\", \"canary deploy\", \"pin version\", \"redeploy\", \"deploy stuck\". Not for production hardening — use agents-harden. Not for adding capabilities before deploy — use agents-build or agents-connect. Not for VPC configuration errors — use agents-build.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1402,1403,1404,1407],{"name":1358,"slug":1359,"type":15},{"name":23,"slug":8,"type":15},{"name":1405,"slug":1406,"type":15},"CI\u002FCD","ci-cd",{"name":13,"slug":14,"type":15},"2026-07-12T08:42:55.059577",{"slug":1410,"name":1410,"fn":1411,"description":1412,"org":1413,"tags":1414,"stars":24,"repoUrl":25,"updatedAt":1418},"agents-get-started","scaffold and deploy new agent projects","Use when a developer wants to create a new agent project or get started with AgentCore. Handles framework selection, project scaffolding, first deploy, and first invocation. Triggers on: \"build an agent\", \"create an agent\", \"get started\", \"new project\", \"agentcore create\", \"which framework\", \"Strands vs LangGraph\", \"hello world agent\", \"first agent\", \"create MCP server\", \"host MCP server\", \"agentcore dev\", \"dev server\", \"what port\", \"local development\". Not for adding capabilities to existing projects — use agents-build or agents-connect. Strands vs LangGraph in a migration context routes to agents-build, not here. Connecting to an existing MCP server routes to agents-connect, not here.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1415,1416,1417],{"name":1358,"slug":1359,"type":15},{"name":23,"slug":8,"type":15},{"name":13,"slug":14,"type":15},"2026-07-12T08:42:51.963247",{"slug":1420,"name":1420,"fn":1421,"description":1422,"org":1423,"tags":1424,"stars":24,"repoUrl":25,"updatedAt":1433},"agents-harden","harden agents for production","Use when preparing your agent for production — IAM scoping, inbound auth (JWT, SigV4), secrets management, cold start optimization, session lifecycle, rate limiting, input validation, and quota guidance. Triggers on: \"production checklist\", \"harden agent\", \"production ready\", \"secure agent\", \"inbound auth\", \"going live\", \"cold start optimization\", \"session lifecycle\", \"StopRuntimeSession\", \"quota\", \"throttling\", \"maxVms\", \"rate limit\", \"security audit of outbound API calls\", \"gateway target audit for production\", \"restrict who can call\", \"lock down endpoint\", \"only our app can call\". Not for Cedar tool-restriction policies — use agents-connect. Not for quality measurement — use agents-optimize. Not for outbound credential storage or API key wiring — use agents-connect. Not for A2A agent-to-agent auth — use agents-build. Cold start observation and diagnosis (not optimization) routes to agents-debug.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1425,1426,1427,1430],{"name":1358,"slug":1359,"type":15},{"name":23,"slug":8,"type":15},{"name":1428,"slug":1429,"type":15},"Best Practices","best-practices",{"name":1431,"slug":1432,"type":15},"Security","security","2026-07-16T06:00:42.174705",{"slug":1435,"name":1435,"fn":1436,"description":1437,"org":1438,"tags":1439,"stars":24,"repoUrl":25,"updatedAt":1449},"agents-optimize","optimize agent quality and performance","Use when measuring or improving agent quality and performance — set up evaluators, online monitoring, CI\u002FCD quality gates, observability, or cost optimization. Triggers on: \"evaluate my agent\", \"add evaluator\", \"measure quality\", \"quality gate\", \"run evals\", \"agent too slow\", \"why is it slow\", \"reduce latency\", \"set up observability\", \"CloudWatch dashboard\", \"how much does my agent cost\", \"cost optimization\", \"logs not showing up\", \"logs missing\", \"spans not found\", \"eval failing\", \"eval error\", \"dev traces\", \"local traces\", \"agentcore dev traces\", \"traces to CloudWatch\". Not for debugging errors or crashes — use agents-debug. Slow but correct routes here; broken routes to debug.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1440,1441,1442,1445,1446],{"name":1358,"slug":1359,"type":15},{"name":23,"slug":8,"type":15},{"name":1443,"slug":1444,"type":15},"Evals","evals",{"name":1393,"slug":1394,"type":15},{"name":1447,"slug":1448,"type":15},"Performance","performance","2026-07-12T08:42:56.488105",114,{"items":1452,"total":1569},[1453,1460,1467,1474,1481,1487,1494,1502,1519,1532,1544,1559],{"slug":1352,"name":1352,"fn":1353,"description":1354,"org":1454,"tags":1455,"stars":24,"repoUrl":25,"updatedAt":1367},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1456,1457,1458,1459],{"name":1358,"slug":1359,"type":15},{"name":1361,"slug":1362,"type":15},{"name":23,"slug":8,"type":15},{"name":1365,"slug":1366,"type":15},{"slug":1369,"name":1369,"fn":1370,"description":1371,"org":1461,"tags":1462,"stars":24,"repoUrl":25,"updatedAt":1380},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1463,1464,1465,1466],{"name":1358,"slug":1359,"type":15},{"name":20,"slug":21,"type":15},{"name":1377,"slug":1378,"type":15},{"name":23,"slug":8,"type":15},{"slug":1382,"name":1382,"fn":1383,"description":1384,"org":1468,"tags":1469,"stars":24,"repoUrl":25,"updatedAt":1395},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1470,1471,1472,1473],{"name":1358,"slug":1359,"type":15},{"name":23,"slug":8,"type":15},{"name":1390,"slug":1391,"type":15},{"name":1393,"slug":1394,"type":15},{"slug":1397,"name":1397,"fn":1398,"description":1399,"org":1475,"tags":1476,"stars":24,"repoUrl":25,"updatedAt":1408},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1477,1478,1479,1480],{"name":1358,"slug":1359,"type":15},{"name":23,"slug":8,"type":15},{"name":1405,"slug":1406,"type":15},{"name":13,"slug":14,"type":15},{"slug":1410,"name":1410,"fn":1411,"description":1412,"org":1482,"tags":1483,"stars":24,"repoUrl":25,"updatedAt":1418},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1484,1485,1486],{"name":1358,"slug":1359,"type":15},{"name":23,"slug":8,"type":15},{"name":13,"slug":14,"type":15},{"slug":1420,"name":1420,"fn":1421,"description":1422,"org":1488,"tags":1489,"stars":24,"repoUrl":25,"updatedAt":1433},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1490,1491,1492,1493],{"name":1358,"slug":1359,"type":15},{"name":23,"slug":8,"type":15},{"name":1428,"slug":1429,"type":15},{"name":1431,"slug":1432,"type":15},{"slug":1435,"name":1435,"fn":1436,"description":1437,"org":1495,"tags":1496,"stars":24,"repoUrl":25,"updatedAt":1449},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1497,1498,1499,1500,1501],{"name":1358,"slug":1359,"type":15},{"name":23,"slug":8,"type":15},{"name":1443,"slug":1444,"type":15},{"name":1393,"slug":1394,"type":15},{"name":1447,"slug":1448,"type":15},{"slug":1503,"name":1503,"fn":1504,"description":1505,"org":1506,"tags":1507,"stars":24,"repoUrl":25,"updatedAt":1518},"amazon-aurora-mysql","manage Amazon Aurora MySQL clusters","Amazon Aurora MySQL — creates, modifies, and advises on Aurora MySQL clusters specifically (MySQL-compatible engine, Aurora serverless, parallel query). Trigger for Aurora MySQL cluster operations, ACU sizing, I\u002FO-Optimized storage, commitment pricing, or MySQL upgrade planning. Aurora MySQL uses full (VPC-based) configuration — express configuration is PostgreSQL-only. For Aurora PostgreSQL, use amazon-aurora-postgresql instead. Contains safety guardrails and response templates that override defaults.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1508,1509,1512,1515],{"name":23,"slug":8,"type":15},{"name":1510,"slug":1511,"type":15},"Database","database",{"name":1513,"slug":1514,"type":15},"MySQL","mysql",{"name":1516,"slug":1517,"type":15},"Serverless","serverless","2026-07-12T08:43:13.27939",{"slug":1520,"name":1520,"fn":1521,"description":1522,"org":1523,"tags":1524,"stars":24,"repoUrl":25,"updatedAt":1531},"amazon-aurora-postgresql","configure Amazon Aurora PostgreSQL clusters","Amazon Aurora PostgreSQL — creates, modifies, and advises on Aurora PostgreSQL clusters specifically (PostgreSQL-compatible engine, Aurora serverless, express configuration, pgvector, Babelfish). Trigger for Aurora PostgreSQL cluster operations, express-configuration quick-start, ACU sizing, I\u002FO-Optimized storage, commitment pricing, or PostgreSQL upgrade planning. For Aurora MySQL, use amazon-aurora-mysql instead. Contains safety guardrails, express-first routing, and response templates that override defaults.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1525,1526,1527,1530],{"name":23,"slug":8,"type":15},{"name":1510,"slug":1511,"type":15},{"name":1528,"slug":1529,"type":15},"PostgreSQL","postgresql",{"name":1516,"slug":1517,"type":15},"2026-07-16T06:00:34.789624",{"slug":1533,"name":1533,"fn":1534,"description":1535,"org":1536,"tags":1537,"stars":24,"repoUrl":25,"updatedAt":1543},"amazon-bedrock","build generative AI apps with Amazon Bedrock","Builds generative AI applications on Amazon Bedrock. Covers model invocation (Converse API, InvokeModel), RAG with Knowledge Bases, Bedrock Agents, Guardrails, and AgentCore. Use when invoking models, setting up Knowledge Bases, creating agents, applying guardrails, deploying to AgentCore, migrating\u002Fporting\u002Fconverting a Bedrock Agent (including inline agents) to an AgentCore Harness, troubleshooting Bedrock errors (ThrottlingException, AccessDeniedException), or choosing models (Claude, Llama, Nova, Titan). ALSO USE for prompt caching setup and debugging, quota health checks and throttling diagnosis, cost attribution and tracking, migrating between Claude model generations (4.5 to 4.6 to 4.7), chunking strategies, API selection (Converse vs InvokeModel), guardrail capabilities, and model selection. Also covers AgentCore Payments setup (x402, microtransactions, Payment Manager, Connector, Instrument, Coinbase CDP, Stripe Privy, 402 Payment Required, pay for content, paid endpoint, agent payments). NOT for custom model training, Rekognition, or Comprehend.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1538,1539,1540],{"name":1358,"slug":1359,"type":15},{"name":23,"slug":8,"type":15},{"name":1541,"slug":1542,"type":15},"LLM","llm","2026-07-25T05:30:35.20899",{"slug":1545,"name":1545,"fn":1546,"description":1547,"org":1548,"tags":1549,"stars":24,"repoUrl":25,"updatedAt":1558},"amazon-documentdb","manage Amazon DocumentDB clusters","Manages Amazon DocumentDB end-to-end — serverless-on-8.0 cluster setup, TLS\u002FVPC\u002Fdriver config, flexible-schema and vector-search data modeling, MongoDB compatibility assessment, DMS-based migration, slow-query diagnosis, major version upgrades (4.0→5.0→8.0), Well-Architected reviews (41-check wa_review.py), cost estimation, and security hardening. Retrieve for every DocumentDB question and when the user asks to set up or migrate MongoDB to AWS — DocumentDB is AWS's MongoDB-compatible managed database. Triggers: JSON document store, document database, MongoDB on AWS, Nested fields, Lambda cannot connect, TLS handshake, VPC port 27017, IAM auth, Secrets Manager, encryption at rest, $graphLookup, flexible schema, COLLSCAN, compound index, DMS migration, CDC cutover, $vectorSearch, RAG, Global Clusters, DR replication, cost sizing, audit, health check, production-readiness.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1550,1551,1552,1555],{"name":23,"slug":8,"type":15},{"name":1510,"slug":1511,"type":15},{"name":1553,"slug":1554,"type":15},"MongoDB","mongodb",{"name":1556,"slug":1557,"type":15},"NoSQL","nosql","2026-07-12T08:43:00.455878",{"slug":1560,"name":1560,"fn":1561,"description":1562,"org":1563,"tags":1564,"stars":24,"repoUrl":25,"updatedAt":1568},"amazon-dynamodb","design and debug DynamoDB data layers","Designs, reviews, and debugs DynamoDB data layers from design axioms — enumerates access patterns, chooses partition\u002Fsort keys and GSIs, decides single-table vs. multi-table, configures Streams, Global Tables, TTL, and zero-ETL integrations to OpenSearch\u002FRedshift\u002FSageMaker Lakehouse, and produces a defensible data-layer design with a monthly cost estimate and optional live validation. Applies whenever a user is designing, reviewing, or refactoring anything backed by DynamoDB — schemas, access patterns, GSIs, single- vs. multi-table choices, Streams consumers, transactional outboxes, Global Tables, zero-ETL pipelines — even when they don't say \"axioms\" or \"design review.\" Also applies when debugging hot partitions, throttling, unbounded Scans, LWW conflicts, or surprise bills on DynamoDB workloads.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1565,1566,1567],{"name":23,"slug":8,"type":15},{"name":1510,"slug":1511,"type":15},{"name":1556,"slug":1557,"type":15},"2026-07-16T06:00:37.690386",115]