API Security Beginning to Outweigh My Vendor Lock-In Concerns

ICYDK: I’ve been on the AWS train since day one. I’ve been integrating Amazon S3 and EC2 into my business(es) since they first launched a decade ago. While the platform has faithfully provided my storage and compute for over a decade, I’ve always been wary of vendor lock-in. After a decade-long ride on Microsoft (1998-2008), I felt pretty burned. Then, recently, after a similar decade-long ride on Google (2005-2015), I felt burned, but in a different way. After a decade on AWS, I’m nervous, but I don’t feel as burned; however, I’d say there is one aspect of doing business online that is making me put aside some of my concerns regarding vendor lock-in on AWS, and even on Google, and Azure–SECURITY. I’m just not convinced I can do this alone, and I need the help of the platforms I operate on to help make sure my operations are secure.

I spent the weekend setting up a set of APIs using AWS RDS as the backend database, AWS Lambda as the code layer, and AWS API Gateway as the API front-end. As part of this work, I established an identity and access management (IAM) role with policies tailored for brokering the exchanges between RDS, Lambda, and the API Gateway. I’m leaning on AWS for two key API security pieces here: 1) API key management with AWS API Gateway, and 2) backend security using AWS IAM. The key management stuff is pretty straightforward and something I can easily replicate, but the AWS IAM stuff is a little more involved, and I’m grateful for how easy AWS IAM makes it for me to setup roles, cherry pick from common policies, and lock down the infrastructure I a using to drive the backend of my APIs and other applications. https://goo.gl/21rySQ #DataIntegration #ML

Could I Please Get an API Discovery Tool That Evaluates an OpenAPI Diff?

I am increasingly tracking OpenAPI definitions published to GitHub by leading API providers I track on. Platforms like Stripe, Box, and New York Times are actively managing their OpenAPI definitions using Github, making them well suited for integration into their platform operations, API consumer scenarios, and even within analyst systems like what I have going on as the API Evangelist.

Once I have an authoritative source of an OpenAPI, meaning a public URI for an OpenAPI that is actively being maintained by the API provider, I have a pretty valuable feed into the roadmap, as well as a change log for an API. I feel like we are getting to the point where there are enough authoritative OpenAPIs that we can start using as a machine-readable notification and narrative tool for helping us stay in tune with one or many APIs across the landscape. Helping us stay in tune with APIs in real-time, and giving APIs an effective tool for communicating out changes to the platform–we just need more OpenAPIs, and some new tooling to emerge. https://goo.gl/dbKfDu #DataIntegration #ML

I Added a Taxonomy API to Support the Human Services Data API (HSDA)

ICYMI: I have been organizing my Human Services Data API (HSDA) specification work into separate microservices as part of version 1.0 for the API definition that cities and other organizations running 211 operations can pick and choose which aspects they want to run. One service I carved off of the move from version 1.0 to 1.1 of the specification was taxonomy, and how the human services are categories and organized. I saw there was more research to be done around 211 taxonomy, and I felt it had the potential to be a separate but supporting service to augment what Open Referral is already trying to do with the Human Services Data API (HSDA) specification.

The HSDA Taxonomy API specification provides a handful of API paths for creating, reading, updating, and deleting taxonomy used in any HSDA implementation. I have populated my demo API with the Open Eligibility taxonomy to help jumpstart folks, but any HSDA provider can populate with their own custom taxonomy, or another existing format. Then you can apply any taxonomy to any of the services stored within an HSDA database, and there is an API path for querying services by taxonomy. Next, I’ll make sure you can search by taxonomy, and see the taxonomy as part of the response body for all services returned across HSDA, HSDA Search, and HSDA Taxonomy. https://goo.gl/Dns8sx #DataIntegration #ML