Amazon API Gateway Design Patterns - Choosing Between REST API and HTTP API
Clear criteria for choosing between HTTP API and REST API, authentication patterns with Cognito and Lambda authorizers, and practical throttling design techniques.
Criteria for Choosing Between REST API and HTTP API
API Gateway offers two types: REST API and HTTP API. HTTP API, introduced in 2019, covers the core features of REST API while being up to 71% cheaper with lower latency. If your primary use case is proxying to Lambda functions or HTTP endpoints, HTTP API is the right choice. Cases where you should choose REST API include: publishing APIs to third parties with API keys and usage plans, request/response transformation (mapping templates), WAF integration, edge-optimized endpoints, and request validation features. For new projects, the recommended approach is to default to HTTP API and only consider REST API when you need features that HTTP API doesn't offer.
Authentication and Authorization Patterns
API Gateway supports multiple authentication methods. The Cognito user pool authorizer automatically validates JWT tokens issued by Cognito at the API Gateway level. Since you don't need to implement token validation logic yourself, it's the easiest way to add authentication. Lambda authorizers let you implement custom authentication logic in a Lambda function. Use them when you need flexible authorization logic such as custom token formats, integration with external IdPs, or IP address-based controls. Lambda authorizer results can be cached, and setting a TTL reduces duplicate authentication Lambda invocations. IAM authentication uses AWS SigV4 signatures to authenticate requests and is suited for internal communication between AWS services.
Throttling and Usage Plans
API Gateway throttling is implemented using the token bucket algorithm. The default account-level limit is 10,000 requests per second per Region, with a burst of 5,000 requests. Finer-grained limits can be set at the stage and method levels to prevent specific endpoints from overloading the backend. Usage plans are a REST API-specific feature that lets you set daily and monthly request limits and throttling rates per API key. When exposing APIs to external partners, you can apply different rate limits per partner. Clients that receive a 429 Too Many Requests response should implement retries with exponential backoff. For a comprehensive study of API design architecture, refer to technical books on Amazon.
API Gateway Pricing
HTTP API costs approximately $1.00 per million requests, roughly 71% cheaper than REST API at $3.50. WebSocket API costs approximately $1.00 per million messages plus connection time charges (approximately $0.25 per million minutes). Enabling REST API caching incurs hourly charges based on cache memory size ($0.02/hour for 0.5 GB). Properly setting Lambda authorizer cache TTL to reduce the number of authentication Lambda invocations is also effective for cost optimization. The free tier includes 1 million requests per month each for HTTP API and REST API during the first 12 months.
Summary
API Gateway is a service that centrally manages authentication, throttling, and monitoring at the API layer as the entry point for serverless architectures. By defaulting to HTTP API and choosing REST API only when enterprise features are needed, you can optimize both cost and latency.