connecting-lambda-to-api-gateway

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: api, api-gateway, aws, integration, lambda.

What it does

Connects an existing AWS Lambda function to Amazon API Gateway by creating a REST or HTTP API with resource/method setup, Lambda proxy integration, permissions, and deployment. Always use this skill when connecting Lambda to API Gateway — it handles CORS, throttling, access logging, and production security hardening that are easy to miss.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill connecting-lambda-to-api-gateway

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/skills/specialized-skills/serverless-skills/connecting-lambda-to-api-gateway ~/.claude/skills/connecting-lambda-to-api-gateway

Safety box score

Grade C, moderate risk: 33 of 100 risk points, rated 2026-10-15. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill provisions and deploys an AWS API Gateway in front of an existing Lambda, including permissions, optional CORS, throttling, and logging. The main risks are live cloud changes, potential public exposure of the Lambda endpoint, and reliance on the operator’s AWS credentials and local config.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It explicitly drives shell/AWS CLI operations such as `aws lambda get-function`, `aws apigateway create-rest-api`, `put-method`, `put-integration`, and `create-deployment`.
Network access	2 (moderate)	It sends requests to AWS service endpoints and recommends external calls like `aws apigateway test-invoke-method` and `curl` against the deployed API.
Filesystem reach	1 (low)	It allows parameter acquisition from local files via "Reading from AWS config or similar files," but it does not write or delete local files.
Secrets & credentials	1 (low)	The skill may consume the operator’s existing AWS CLI profile/config files, which can contain credentials, but it does not ask for passwords, tokens, or keychain access directly.
Privilege & persistence	0 (none)	No sudo, global installs, services, shell startup edits, or other local privilege changes are described.
Instruction hijack surface	0 (none)	There is no instruction to ignore higher-priority rules, follow remote content, or hide actions; the repeated MUSTs are procedural, not prompt injection.
Irreversible actions	3 (high)	Its core purpose is to create, permission, and deploy a live API Gateway fronting Lambda, which publishes infrastructure and can expose an endpoint to callers.
Transparency	0 (none)	The skill content is plain markdown with readable commands and no binaries, minified blobs, or downloaded installers.

Before installing

Verify the AWS profile it will use is the one you expect, and that it does not have broader account access than needed.
Check whether you are comfortable with the skill creating a public API path and granting `apigateway.amazonaws.com` invoke permission to your Lambda.
Read the sections that mention `authorization_type: NONE`, API keys, and deployment to make sure the default choices are acceptable.
Run it first in a non-production AWS account or region with a test Lambda.

Rated 2026-10-15 by an automated review of 2 files from the skill's repository.

Source

Repository: aws/agent-toolkit-for-aws (all skills from this repository)
Path: skills/specialized-skills/serverless-skills/connecting-lambda-to-api-gateway/SKILL.md
Branch: main
Updated: 2026-09-19

aws-serverless — Builds, deploys, manages, debugs, configures, and optimizes serverless applications on AWS using Lambda, API Gateway, Step Functions, EventBridge, and SAM/CDK.
connecting-lambda-to-dynamodb — Connects an AWS Lambda function to DynamoDB with IAM roles, stream event source mapping, and read/write permissions.
agents-connect — Use when connecting your agent to external APIs, tools, or services via Gateway, or restricting tool access with Cedar policies.
aws-lambda-durable-functions — Builds resilient, long-running, multi-step applications with AWS Lambda durable functions with automatic state persistence, retry logic.
aws-lambda-managed-instances — Evaluates, configures, and migrates workloads to AWS Lambda Managed Instances (LMI).
aws-lambda-microvms — Builds, runs, debugs, and operates applications on AWS Lambda MicroVMs — Firecracker-isolated.