Support for Community Game Servers, RegisterGameServer

Are there tools to verify that the server registration is legitimate and not someone maliciously registering false servers by calling AWS api's?

First of all, it's not recommended that the game client directly calls AWS APIs because it will expose AWS credentials to the clients. Instead it's recommended to use a backend service that handles communication between game clients and Amazon GameLift. You can also use backend services for other game-specific tasks such as player authentication and authorization, inventory, or currency control. https://docs.aws.amazon.com/gamelift/latest/developerguide/gamelift-architecture.html

can anyone that spins up an in-game or dedicated server, register the game server as active in GameLift?

By community servers, do you mean using Amazon GameLift managed EC2 fleets/fleetIQ as game servers, or have game clients host games locally in their machines? If it's the first case, then yes, and as I mentioned it's recommended to have a backend service to communicate between game clients and Amazon GameLift. You can refer to our public documentation for instructions: https://docs.aws.amazon.com/gamelift/latest/developerguide/gamelift-intro.html. If it's the second case, Amazon GameLift cannot support such use case right now. However you can still use our standalone FlexMatch feature for matchmaking: https://docs.aws.amazon.com/gamelift/latest/flexmatchguide/match-tasks-safm.html.

ListGameServers (https://docs.aws.amazon.com/gamelift/latest/apireference/API_ListGameServers.html) is used with the Amazon GameLift FleetIQ solution and game server groups. For more info: https://docs.aws.amazon.com/gamelift/latest/fleetiqguide/gsg-intro.html. To find game sessions, SearchGameSessions might be a better option, see details here: https://docs.aws.amazon.com/gamelift/latest/developerguide/gamelift-sdk-client-api.html#gamelift-sdk-client-api-find