deploying-custom-domain-rest-api

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: api-gateway, aws, custom-domain, rest-api, route53.

What it does

Deploys a Regional REST API with a custom domain name, a Lambda backend function, and a request-based Lambda authorizer using AWS CLI. Covers ACM certificate provisioning, API Gateway REST API creation, Lambda function deployment, request authorizer setup, custom domain configuration, base path mapping, and Route 53 DNS record creation. Trigger keywords: custom domain, REST API, Lambda, Route 53, API Gateway, regional endpoint, request authorizer, base path mapping.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill deploying-custom-domain-rest-api

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/skills/specialized-skills/serverless-skills/deploying-custom-domain-rest-api ~/.claude/skills/deploying-custom-domain-rest-api

Safety box score

Grade C, moderate risk: 44 of 100 risk points, rated 2026-10-14. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill provisions a full public AWS REST API stack: IAM roles, Lambda functions, API Gateway, ACM, Route 53, and a validation script. The main risks are broad changes to the user’s AWS account and public network exposure; it also embeds demo authorization values and logs request data, which are not production-safe.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It ships a shell validator and Python packaging one-liners plus many AWS CLI calls (`scripts/validate.sh`, `python3 -c ... zipfile`), so it executes commands and code during setup/validation.
Network access	2 (moderate)	It makes outbound calls to AWS services and a live public endpoint (`aws acm ...`, `aws apigateway ...`, `curl 'https://{custom_domain_name}/example...'`), but only for deployment and validation.
Filesystem reach	1 (low)	It writes temporary artifacts under `/tmp` (`/tmp/lambda-trust-policy.json`, `/tmp/authorizer.zip`, `/tmp/example_function.zip`, `/tmp/dns-record.json`) and does not target user files or dotfiles.
Secrets & credentials	1 (low)	It does not read secret stores, but it hardcodes demo auth values (`headerValue1`, `queryValue1`, `stageValue1`) and points to AWS Secrets Manager as the production alternative.
Privilege & persistence	2 (moderate)	It creates IAM roles and grants Lambda/API Gateway invoke permissions in the user’s AWS account (`aws iam create-role`, `aws lambda add-permission`), which changes cloud privileges.
Instruction hijack surface	0 (none)	There is no hidden prompt injection, instruction-skipping text, or fetched remote instructions in the shipped files.
Irreversible actions	3 (high)	The skill’s purpose is to create and publish live infrastructure end-to-end (`create-deployment`, `create-domain-name`, `change-resource-record-sets`) with no mandatory human approval per resource.
Transparency	0 (none)	All shipped files are plain text; there are no binaries, unpinned installers, or runtime-downloaded code.

Before installing

Read `scripts/authorizer.mjs` to confirm the demo auth values and logging are acceptable for your use case.
Review the AWS CLI commands in `SKILL.md` and run them only in the intended AWS account/region.
Decide whether you want the validation step to make a real public `curl` request to the new domain.
If you plan to use this beyond a demo, replace the hardcoded authorizer checks before deployment.

Rated 2026-10-14 by an automated review of 6 files from the skill's repository.

Source

Repository: aws/agent-toolkit-for-aws (all skills from this repository)
Path: skills/specialized-skills/serverless-skills/deploying-custom-domain-rest-api/SKILL.md
Branch: main
Updated: 2026-09-19

aws-serverless — Builds, deploys, manages, debugs, configures, and optimizes serverless applications on AWS using Lambda, API Gateway, Step Functions, EventBridge, and SAM/CDK.
connecting-lambda-to-api-gateway — Connects an existing AWS Lambda function to Amazon API Gateway by creating a REST or HTTP API with resource/method setup, Lambda proxy integration.
creating-api-gateway-stage — Creates an API Gateway stage with CloudWatch logging, X-Ray tracing, throttling, WAF integration, and IAM roles following AWS best practices.
amazon-opensearch-service — Guides migration, provisioning, search, log-analytics, trace-analytics.
aws-security — Covers AWS security services and workflows — Security Hub V2 (OCSF) findings, connectors, aggregators, automation rules, and security posture summaries.
aws-storage — Selects, investigates, and compares AWS object, file, and block storage services, and answers cost, performance, configuration, security.