AWS First Steps
Networking

Amazon API Gateway

A fully managed service for creating, publishing, and managing REST APIs, HTTP APIs, and WebSocket APIs, serving as the front door to Lambda and other AWS services

About 5 min readWritten and edited by Awashiro

Overview

Amazon API Gateway is a fully managed service for creating, publishing, maintaining, monitoring, and securing APIs at any scale. It supports three API types - REST API, HTTP API, and WebSocket API - and can connect to Lambda functions, EC2 instances, and arbitrary HTTP endpoints as backends. It provides comprehensive API management capabilities including API key management, usage plans, throttling, request/response transformation, authentication and authorization via Cognito or IAM, and custom domain name configuration. HTTP APIs cost less per request and offer lower latency than REST APIs, making them ideal for simple API proxies. WebSocket APIs support real-time bidirectional communication for building chat applications and live dashboards.

Selection Criteria for REST API vs HTTP API

API Gateway offers two HTTP-based API types - REST API and HTTP API - and you choose based on your requirements. REST API provides advanced features such as request/response transformation via mapping templates, access control through API keys and usage plans, request validation, caching, WAF integration, and canary releases. It is well suited for enterprise APIs or scenarios requiring complex request transformations. HTTP API omits some of these advanced features in exchange for a lower per-request price than REST API and lower latency. Because unit prices vary by Region and usage tier, check the AWS pricing page. It natively supports JWT authorizers, automatic CORS configuration, and OpenID Connect / OAuth 2.0 integration, providing sufficient functionality as a simple proxy to Lambda or HTTP backends. By contrast, Azure API Management (APIM) focuses on broader API lifecycle management including a built-in developer portal and subscription management, while API Gateway specializes in Lambda integration as the entry point to serverless architectures, with billing based primarily on the number of requests.

Authentication, Authorization, and Throttling Design

API Gateway provides multiple authentication mechanisms to secure your APIs. Cognito User Pool authorizers validate JWT tokens and are ideal for mobile and web applications with user sign-up flows. IAM authorization uses AWS Signature Version 4 and is suited for service-to-service communication within AWS. Lambda authorizers (formerly custom authorizers) let you implement arbitrary authentication logic - validating custom tokens, checking IP allowlists, or integrating with third-party identity providers. For throttling, API Gateway enforces account-level limits and allows stage- and method-level throttling to protect specific endpoints. As of September 2026, the default account-level quota is 10,000 requests per second per Region with a maximum burst capacity of 5,000 requests; some Regions default to lower values. The RPS default can be raised on request, while the burst capacity is derived from the RPS quota and cannot be requested separately. Usage plans combined with API keys enable per-client rate limiting and quota management, which is essential when exposing APIs to external partners.

Stage Management and Canary Releases

Stages in API Gateway represent deployment snapshots of your API configuration, enabling you to maintain separate environments (dev, staging, prod) under a single API. Stage variables act as environment-specific configuration values - you can point to different Lambda aliases or backend endpoints per stage without modifying the API definition. Canary releases, available with REST API, let you gradually shift a percentage of production traffic to a new deployment version. For example, you can route 10% of traffic to the canary stage, monitor error rates and latency via CloudWatch, and then promote the canary to full production or roll back if issues arise. Combine custom domain names with ACM certificates and Route 53 to provide branded API endpoints (api.example.com), and use base path mappings to route different paths to different APIs or stages under a single domain.

References (Official AWS Resources)

The primary sources for this page are the official AWS website and documentation. Check the official pages below for the latest specifications and pricing.

If this page and the official documentation disagree, treat the official documentation as authoritative.

ShareXB!

Related Terms

AWS LambdaAmazon CognitoAWS Step FunctionsAWS WAF

Related Services

AWS LambdaAmazon CognitoAWS WAF

Related Articles

Amazon API Gateway Design Patterns - Choosing Between REST API and HTTP APIClear criteria for choosing between HTTP API and REST API, authentication patterns with Cognito and Lambda authorizers, and practical throttling design techniques.Unifying Microservice GraphQL with AWS AppSync Merged API - Distributed Team Development in PracticeMerge GraphQL APIs developed and deployed independently by multiple teams into a single endpoint. Learn strategies for avoiding schema conflicts and designing authentication.Implementing User Authentication with Amazon Cognito - Designing User Pools and Identity PoolsLearn about user authentication with Cognito User Pools, AWS resource access with Identity Pools, and social login integration.Getting Started with Full-Stack Web App Development on AWS Amplify - Git-Connected Deploys and Backend SetupSet up automatic per-branch deployment environments with GitHub integration, and define authentication, APIs, and storage in TypeScript using Backend Gen 2. Also supports Next.js SSR.Visually Design Serverless Applications with AWS Infrastructure Composer (formerly AWS Application Composer) - Automatic IaC Template GenerationLearn about visual design of serverless architectures with Infrastructure Composer, automatic SAM template generation, and VS Code integration.

Similar Terms and Articles

Building Serverless APIs - Scalable API Infrastructure with Amazon API GatewayLearn how to build serverless APIs using Amazon API Gateway and Lambda.Amazon API Gateway Design Patterns - Choosing Between REST API and HTTP APIClear criteria for choosing between HTTP API and REST API, authentication patterns with Cognito and Lambda authorizers, and practical throttling design techniques.Amazon API GatewayA fully managed service for creating, publishing, managing, and monitoring APIsUnifying Microservice GraphQL with AWS AppSync Merged API - Distributed Team Development in PracticeMerge GraphQL APIs developed and deployed independently by multiple teams into a single endpoint. Learn strategies for avoiding schema conflicts and designing authentication.How AWS API Throttling Works - The Token Bucket Algorithm and the Truth Behind 429 ErrorsLearn how AWS API rate limiting is implemented using the token bucket algorithm, understand the concept of burst capacity, explore differences in throttling limits across services, and discover practical strategies to avoid throttling.