API Key enabled, but requests without key still running
<p>In my API Gateway console, I did the following:</p>

<ul>
<li>Created an API key</li>
<li>Associated the key with a deployed API stage</li>
<li>Checked the key's "Enabled" checkbox</li>
<li>For each method of each resource of my API, required the API key for authentication</li>
</ul>

<p>I expected <code>curl https://my-api-gateway-url/my-resource</code> to 403, since I didn't include the <code>x-api-key</code> header, but it was a 200 instead. My Lambda function behind API Gateway ended up running when it shouldn't have run without the API key.</p>

<p>How can I ensure the key is required to authenticate all requests?</p>

<p>EDIT: I was following the documentation here: <a href="http://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-api-keys.html" rel="noreferrer">http://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-api-keys.html</a></p>