Skip to main content
This lesson explains Amazon API Gateway: the problems it solves, the API types it supports, key features, integrations, and how it helps you manage secure, reliable, well-documented APIs at scale.
API Gateway centralizes cross-cutting concerns—security, request/response transformation, rate limiting, monitoring, and documentation—so teams can focus on application logic and iterate faster.
Why use API Gateway? When you build modern applications you often need to expose a single, consistent API surface that aggregates many backend services: serverless functions, containers, virtual machines, databases, third-party APIs, and more. Manually wiring security, validation, throttling, and observability for each backend is time-consuming and error-prone. API Gateway simplifies this by providing:
  • Seamless integration with backend services such as AWS Lambda, Amazon EC2, Amazon ECS, and external HTTP endpoints.
  • Centralized request/response transformation, validation, and model mapping so clients and backends can use different formats.
  • Built-in authentication and authorization via IAM, Amazon Cognito, or custom Lambda authorizers.
  • Throttling, rate limiting, and usage plans to protect backends from spikes and abuse.
  • Monitoring, logging, and analytics via CloudWatch for usage, latency, and error visibility.
  • Tools for generating API documentation and developer portals to reduce documentation drift and speed onboarding.
A presentation slide titled "Why Do We Need API Gateway?" showing an AWS architecture where backend services (Lambda, EC2, ECS) connect through Amazon API Gateway with IAM/Cognito/OAuth for security. A sidebar lists gateway benefits like integration complexity handling, request/response transformation, security/access control, rate limiting, monitoring, and documentation.

​
Types of APIs supported

API Gateway currently supports three main API types. Choose based on your use-case, cost sensitivity, and required features.
Choose HTTP APIs for most CRUD and proxy use-cases to save cost and latency. Use REST APIs when you need stage-level caching, fine-grained usage plans/API key features, or generated SDKs. Use WebSocket APIs when the server must push updates to clients.
A diagram of AWS-supported API types showing HTTP, WebSocket, and REST APIs inside the AWS Cloud, with backend services (Lambda, EC2, ECS) routed through Amazon API Gateway to mobile and web clients.

​
Key features and benefits

API Gateway provides a range of features that simplify building, securing, and operating APIs:
  • Build RESTful and WebSocket APIs: Create HTTP and real-time endpoints with managed execution environments.
  • Private integrations: Route requests to private resources inside a VPC using private ALB/NLB targets or IP-based services registered in AWS Cloud Map.
  • Resiliency and throttling: Configure per-method throttling and request-per-second limits to protect backend systems.
  • Caching: For REST APIs, enable stage-level caching with customizable cache keys and TTL values to reduce backend load.
  • Rapid deployment: Wire API methods to Lambda functions, Step Functions, Elastic Beanstalk apps, EC2, or external HTTP services.
  • Monitoring and logging: Integrated with CloudWatch for dashboards, metrics (calls, latency, errors), and logs—plus alarms on API metrics.
  • Authentication & Authorization:
    • IAM SigV4 for service-to-service auth.
    • Amazon Cognito for user authentication and federated identities.
    • Lambda authorizers for custom token validation (JWTs, SAML).
  • API keys & usage plans (REST APIs): Issue API keys, assign fine-grained permissions, and enforce throttling/quota per key.
  • SDK generation (REST APIs): Auto-generate client SDKs (Java, JavaScript, Android, iOS, Ruby, etc.) or use AWS CLI (get-sdk) to simplify client integration.
  • Lifecycle management: Manage versions and stages (alpha, beta, production), map custom domain names to stages, and route traffic to different backend endpoints for safe rollouts.
A slide titled "API Gateway – Features" showing an AWS Cloud diagram with rounded boxes listing Amazon API Gateway capabilities. Features shown include RESTful and WebSocket APIs, create & deploy, third‑party and private integration, monitoring, SDK generation, resiliency, AWS authorization, and lifecycle management, with the API Gateway icon on the right.
Quick example — invoking an API endpoint (public HTTP API):
Use IAM/SigV4, Cognito tokens, or API keys depending on your auth configuration.

​
Service integrations

API Gateway integrates natively with many AWS services and external endpoints—allowing flexible architectures without managing additional infrastructure.
An architecture diagram titled "API Integrations" showing an AWS Cloud box with icons and labels for services like AWS Lambda, Amazon S3, Kinesis Video Streams, Elastic Beanstalk, DynamoDB, RDS, EC2, Step Functions, and Cognito. These services are depicted linked to an Amazon API Gateway icon on the right.

​
Best practices checklist

  • Choose the right API type:
    • HTTP APIs for low-latency, low-cost HTTP use-cases.
    • REST APIs when you need caching, SDKs, and advanced usage plans.
    • WebSocket APIs for real-time, two-way client-server communication.
  • Offload cross-cutting concerns to API Gateway:
    • Authentication, request validation, transformation, throttling, and logging.
  • Protect backends:
    • Enforce throttling, quotas, WAF (where applicable), and rate limits.
  • Use stages and versions:
    • Maintain backward compatibility and enable safe rollouts.
  • Centralize secrets:
    • Use Secrets Manager instead of embedding credentials in code or configs.
  • Monitor and alert:
    • Send metrics and logs to CloudWatch and create alarms for error spikes or latency regressions.
  • Secure private integrations:
    • Use VPC links for private ALB/NLB targets and restrict access via security groups and IAM.
API Gateway centralizes many API concerns—integration, security, throttling, monitoring, and documentation—so you can focus on delivering application value while relying on managed features to run APIs at scale.
Use this guide as a foundation to design API architectures that balance cost, performance, and operational complexity. Start with HTTP APIs for simple workloads, then introduce REST features or WebSocket capabilities where the use-case demands them.

Watch Video