Thanks!

Thanks! I prefer the code-first approach. I hate writing specs and would much rather the code generate them. I talk about this a little bit in the next article: https://matt.martz.codes/openapi-specs-from-cdk-stack-without-deploying-first But I have since moved more towards Event Driven Documentation: https://matt.martz.codes/automate-documenting-api-gateways-in-eventcatalog Both still rely on converting typescript interfaces to json schemas... but in the more recent post I shift to downloading the spec from the deployed version of the API Gateway. Thanks for the feedback though, that's totally a valid approach... just not my preferred one.

No, there aren't any credentials in the DDB key. The IAM policy that the Lambda uses to get read access to DDB includes a constraint that restricts what it can see. In the example above you can see the PK is just simply Tenant#1. The JWT includes the tenant number so the condition in the policy: 'dynamodb:LeadingKeys' : [ `Tenant# ${who} ` ], means that when the lambda is invoked where "who" is 1... they'd only see the Tenant#1 records.