🌐
API Gateway
Development with AWS ServicesFully managed service for creating, publishing, and securing APIs at any scale.
API types
- ▸REST API: full feature set (caching, API keys/usage plans, request validation, WAF).
- ▸HTTP API: lower latency and cost, simpler, built-in JWT authorizers — best for simple proxy use cases.
- ▸WebSocket API: for persistent, bidirectional client-server connections.
Endpoint types
- ▸Edge-optimized: routed through CloudFront, best for geographically distributed clients.
- ▸Regional: for clients in the same region, or when you manage your own CDN.
- ▸Private: only accessible from within a VPC via an interface endpoint.
Traffic management
- ▸Throttling: account/stage/method-level rate and burst limits (token bucket algorithm).
- ▸Caching: per-stage response cache with configurable TTL, reduces backend calls.
- ▸Usage plans + API keys: control and meter per-customer access, often paired with throttling quotas.
Security
- ▸Lambda authorizers (token or request-based) for custom auth logic.
- ▸Cognito authorizers to validate user pool JWTs directly.
- ▸IAM authorization using SigV4-signed requests for internal/service-to-service calls.
- ▸CORS must be explicitly enabled for browser-based cross-origin calls.