API Gateway Security Architecture (2026): WAF, Cognito, Private APIs, and Verified Permissions

In June 2026, Amazon Cognito launched multi-Region replication so user pools on Essentials or Plus can keep authentication available in a standby Region during a regional disruption (What’s New, developer guide). Amazon Verified Permissions continues to wire Cedar policies to API Gateway via a console wizard and Lambda authorizer for group- and attribute-based access (AVP + API Gateway, Cognito AVP authz).

This is the API security architecture: edge, authz, private vs public, abuse. For REST/HTTP/WebSocket patterns, JWT vs introspection, or the Shield Advanced buyer guide, see those posts.

Artifacts: authz decision matrix, hardening checklist, architecture diagram (draw.io).

Four layers, from edge to backend

Opinionated take: Put WAF in front of every public API before you tune Cedar policies. Cedar policies do not stop a cheap L7 scrape.

Reference architecture

Clients ──► CloudFront ──► AWS WAF ──► API Gateway (public)
                                      │
                                      ├── JWT authorizer (Cognito)
                                      │      └── optional AVP Lambda authorizer (Cedar)
                                      └── integration ──► Lambda / VPC Lattice / HTTP

Internal ──► Private API Gateway ◄── VPC endpoint + resource policy
                                      └── IAM SigV4

Private API patterns with VPC Lattice for cross-account exposure are documented in AWS Containers guidance (API Gateway + VPC Lattice).

Choose the authorizer

Use authz-decision-matrix.md:

• End users: Cognito JWT
• Fine-grained / multi-service rules: Verified Permissions
• AWS service callers: IAM
• Public read: WAF + cache; still inventory every method

What broke: JWT without rate limits

What Cognito multi-Region replication fixes

MRR replicates user directory and config to a secondary Region (max 2 replicas). Requirements include Essentials/Plus, a multi-Region CMK, and a multi-Region OIDC issuer. It does not replicate your API Gateway stages or data stores. Pair with your API DR runbook.

What to Do This Week

1. Inventory every API method: public vs private, authorizer type, WAF association.
2. Score authz needs with the decision matrix; schedule AVP only where groups are insufficient.
3. Add rate-based WAF rules on auth, search, and export.
4. If auth is a single-Region SPOF, evaluate Cognito MRR prerequisites (plan tier, CMK, OIDC issuer).

What This Post Doesn’t Cover

• WebSocket fan-out security edge cases
• mTLS partner termination design
• Full Shield Advanced commercial decision (buyer guide)
• AppSync-specific auth modes

Frequently asked questions