Building, Managing & Governing APIs on AWS • Giedrius Praspaliauskas • GOTO 2025

Giedrius Praspaliauskas from AWS explores the ten stages of the API lifecycle, demonstrating how modern AI, Generative AI, and agentic systems are reshaping API strategy, development, security, and governance on AWS using services like API Gateway, AppSync, and Amazon Q.

April 21, 2026 5 min read

Building, Managing & Governing APIs on AWS • Giedrius Praspaliauskas • GOTO 2025 — source: https://www.youtube.com/watch?v=xqRUnoaQiUM

As organizations increasingly integrate AI agents with their systems, the strategies for building, managing, and governing APIs on platforms like AWS are evolving. The entire API lifecycle is being infused with AI, from design and development to monitoring and monetization. The primary managed services for this on AWS are Amazon API Gateway and AppSync, chosen for their scalability, pay-per-use model, and built-in security features.

The discussion centers around the ten stages of the API lifecycle, viewed through the lens of different personas (developers, operators, business owners) and the modern tooling available at each step.

Plan & Design

The foundation of a solid API strategy is API-driven development, which establishes a clear contract before any implementation begins. This stage is becoming more complex with the rise of AI agents and new protocols like the Model Context Protocol (MCP). Key considerations now include:

Versioning: Just like traditional REST APIs, AI-centric APIs and MCPs require robust versioning strategies to avoid breaking client integrations as the models and protocols evolve.
Contract Definition: Even with more flexible, AI-driven interactions, the API remains a contract with the outside world. This contract must be carefully designed to accommodate the needs of both human users and AI agents.

Develop & Test

Implementation on AWS typically follows two paths: visual configuration in the console or, more commonly, Infrastructure as a Code (IaC) using tools like CloudFormation, CDK, or Terraform.

Specification-Driven Development: The OpenAPI specification is central to IaC, defining the API structure which is then referenced by the code. This is the standard for integrations with third-party tools like Postman Enterprise or SwaggerHub.
AI-Assisted Development: Generative AI tools and agents, such as Amazon Q or QCLI, can significantly accelerate development. By providing a detailed prompt, developers can ask these tools to generate OpenAPI specifications and the underlying code for complex APIs (e.g., an e-commerce backend). The more detailed the specification, the better the result.
Centralized Guidance: Organizational best practices and style guides can be centralized using knowledge bases, like those in Amazon Bedrock. This knowledge can be exposed to developers through AI agents, ensuring consistency without needing to manually configure rules for each project.
AI in Testing: AI is also transforming testing by generating synthetic data, creating test cases, performing coverage analysis, and even aiding in threat modeling and penetration testing. A key new challenge is testing MCPs, which often act as a facade for existing APIs, adding another layer that requires validation.

Secure

Security is not a single stage but a continuous process that must be embedded throughout the lifecycle. AWS provides numerous options for securing APIs:

Layered Security: A defense-in-depth approach is crucial, applying security at every layer: control plane (IAM), data plane (authorizers), network (VPC, WAF), and governance (detective/preventive rules).
AI for Security Posture Management: AI agents can be used to assess security configurations, troubleshoot incidents, and identify potential gaps by analyzing IaC templates. For example, you can ask an agent, “What security features of the services in my stack are not enabled?”
Anomaly Detection: Machine learning is used for detecting and preventing anomalous traffic patterns, which is critical for mitigating threats.

Deploy & Publish

For teams using IaC, deploying an API is part of the standard CI/CD pipeline for the entire application stack. Modern LLMs are well-trained on common CI/CD tools and can generate pipeline configurations and perform inspections on deployments.

Scale

AWS managed services like API Gateway scale automatically to massive levels, having processed over 100 trillion requests in 2023. The bottleneck is rarely the gateway itself but rather the backend services.

Key Considerations: Teams must monitor account-level quotas (e.g., the default 10,000 requests per second), Lambda concurrency limits for authorizers, and overall resource utilization across the stack. Multi-account architectures are often used for blast radius control.
The AI Agent Challenge: A new scaling challenge comes from external AI agents. Multi-agent architectures can sometimes “brute force” tasks, leading to repeated, rapid-fire calls to an API. This can cause huge, unpredictable spikes in traffic. It is now essential to implement robust, per-user or per-resource throttling to ensure availability for all consumers and protect backend systems that may not scale as quickly.

Monitor

Observability relies on the “three-factor” toolset of CloudWatch Logs, CloudWatch Metrics, and X-Ray, alongside a rich ecosystem of third-party partners like DataDog, Splunk, and Honeycomb.

AI-Powered Operations: CloudWatch now includes AI-powered features for operations. For example, you can select a time window in CloudWatch Logs where an issue occurred and ask it to “investigate.” The tool will correlate logs and events, form a hypothesis about the root cause, and suggest a fix.
Agentic Troubleshooting: Modern command-line tools like QCLI allow operators to troubleshoot using natural language, asking the tool to pull logs, correlate data, and recommend (or even implement) fixes.

Insights & Analytics

Beyond operational monitoring, gaining business insights from API usage is critical.

Natural Language Queries: CloudWatch Log Insights allows users to query log data using natural language, which it translates into the appropriate query syntax. It can also summarize log data to identify trends.
Advanced Analytics: For deeper analysis, API Gateway access logs can be streamed to Amazon S3. From there, they can be analyzed with Amazon Athena and visualized in Amazon QuickSight. QuickSight’s AI engine can generate data narratives, build dashboards from natural language questions, and uncover business-level insights.

Discoverability & Adoption

As the number of APIs grows, discoverability becomes a challenge, leading to duplicated effort and outdated documentation.

Clarity for Humans and Machines: If API documentation is difficult for a human to understand, an AI agent will struggle even more. Documentation must be clear, detailed, and rich with examples.
AI for Documentation: AI tools can help by identifying documentation gaps based on the codebase or by rewriting existing content for clarity and conciseness.

Monetize

APIs are increasingly packaged and sold as products. There are several ways to monetize them on AWS:

Usage Plans: Package APIs into usage plans and sell them on the AWS Marketplace.
Data Exchange: Sell access to data-centric APIs through AWS Data Exchange.
Bill-by-Request: Use access log analysis to build a custom billing system based on consumption per API key.
Product Tiers: Create packaged SKUs of API collections (e.g., a “Pro Plan” with one set of APIs and an “Enterprise Plan” with additional ones) and sell them at a fixed price.