Deploys a Regional REST API with a custom domain name, a Lambda backend function, and a request-based Lambda authorizer using AWS CLI. Covers ACM certificate provisioning, API Gateway REST API creation, Lambda function deployment, request authorizer setup, custom domain configuration, base path mapping, and Route 53 DNS record creation. Trigger keywords: custom domain, REST API, Lambda, Route 53, API Gateway, regional endpoint, request authorizer, base path mapping.
This skill is a standard operating procedure for deploying a Regional Amazon API Gateway REST API fronted by a custom domain name, backed by a Lambda function, and protected by a request-based Lambda authorizer, all driven through the official AWS CLI. It solves the fiddly, multi-service setup of wiring together ACM certificates, IAM roles, Lambda functions, API Gateway resources, custom domains, base path mapping, and Route 53 DNS into one guided flow.
The procedure collects required parameters up front (custom domain, region, hosted zone ID, optional existing certificate ARN, and stage name), verifies dependencies such as the AWS CLI, python3, sed, and Node v22+, and retrieves the account ID before doing anything else. It then requests and DNS-validates an ACM certificate, creates two least-privilege IAM execution roles from a trust policy scoped by an aws:SourceAccount condition, deploys the authorizer and backend Lambda functions, configures the REST API with the custom authorizer, sets up the TLS 1.2 custom domain and base path mapping, and creates a Route 53 A-alias record. Throughout, it explains each step and the tool being called, respects the user's decision to abort, and explicitly warns that the demo authorization values (headerValue1, queryValue1, stageValue1) are hardcoded and not production-safe, pointing to AWS Secrets Manager or Parameter Store instead.
Target users are cloud and serverless engineers who want a repeatable, security-conscious way to stand up an authenticated custom-domain REST API on AWS. It provisions real, billable infrastructure using official AWS tooling and IAM best practices rather than performing any risky or unofficial operations.
A Regional API Gateway REST API, a Lambda backend, a request-based Lambda authorizer, an ACM certificate, IAM roles, a custom domain with TLS 1.2, base path mapping, and a Route 53 A-alias record.
The AWS CLI (with configured credentials), python3, sed, and Node v22+; it verifies these and warns before proceeding if any are missing. Route 53 hosted zone and a hosted zone ID are also required.
No. It covers Regional endpoints only; private endpoints would require VPC endpoint configuration, which it tells the user is out of scope.
No. It uses hardcoded demo values and explicitly instructs the user to move to AWS Secrets Manager or Systems Manager Parameter Store for production credentials.
It creates dedicated execution roles from a trust policy scoped with an aws:SourceAccount condition to the user's account and attaches the AWS-managed basic execution policy.
Quick Setup:
.claude/skills/Repository
aws/agent-toolkit-for-aws