Amazon API Gateway
Fully managed front door for APIs — handles auth, throttling, and routing so your backend doesn't have to.
Verified against AWS documentation · 2026-09-09
Key facts
- 01Clients only ever hit the gateway — it authenticates, throttles, then forwards to Lambda, an HTTP endpoint, or another AWS service
- 02Three types: REST (full feature set), HTTP (same job, ~70% cheaper, fewer features), WebSocket (server can push to clients)
- 03Handles auth, throttling, caching, stages (dev/test/prod), and CloudWatch logging for you — API keys, usage plans, caching, WAF and private endpoints are REST-only
- 04Limits: 10 MB payload, 29s integration timeout (raisable on Regional/private REST APIs), 10,000 RPS per account per Region
Exam triggers
Phrases and scenarios that point here.
- "Front door", "single entry point", "expose Lambda to the internet", "publish an API at scale"
- Meter, throttle, or monetize per customer → API keys + usage plans (REST APIs)
- Serverless web/mobile backend → API Gateway + Lambda + DynamoDB, the classic three-service answer
- Server needs to push to clients without polling → WebSocket API
Not this service
- Plain HTTP/HTTPS load balancing to EC2 or containers, no API features needed → ALB
- GraphQL instead of REST → AppSync
Use cases
- 01Fronting Lambda with a public REST API so a mobile app never holds AWS credentials or talks to AWS services directly
- 02Giving each partner their own API key and rate limit, so one partner's runaway script can't starve everyone else
- 03Wrapping a legacy EC2 or on-prem backend in a modern HTTPS API without touching its code — TLS, auth and throttling bolted on at the edge
- 04Running v1 and v2 as separate stages and canarying a small slice of traffic onto the new one before cutting over
- 05WebSocket API for a live dashboard or chat, where the server pushes updates instead of the browser polling every five seconds
How it's charged
- 01Priced per request received, and the rate depends on API type — REST costs roughly 3.5x what HTTP costs for the same Lambda call, so picking the right type is the single biggest cost lever
- 02WebSocket bills two dimensions: messages (metered in 32 KB increments) plus connection minutes — an idle open connection still costs money
- 03Per-million price steps down at higher volume tiers; free tier covers 1M REST calls and 1M HTTP calls per month for 12 months
- 04REST API caching is billed hourly by cache size whether or not anyone hits it — a fixed cost that's easy to leave switched on
- 05Data transfer out is billed separately; Private APIs have no data-transfer-out charge but do incur PrivateLink VPC endpoint charges
