Amazon API Gateway
Front door for APIs
Create and manage REST/HTTP/WebSocket APIs: authentication, rate limiting, caching, then forward requests to Lambda or other backends.
- Cost$ Low
- Difficulty●●●●●
- Costs money when idle?No
- Serverless
- In examsSAA · DVA · SOA
Think of it asLike a building's reception desk: checks your badge, logs you in, and points you to the right room.
Where does API Gateway fit?
Calls API Gateway
API GatewayAPI Gateway calls
A real example, step by step
- A food-ordering mobile app needs an API to show the menu and place orders.
- You create an HTTP API in API Gateway: GET /menu and POST /orders, each calling a Lambda function.
- Users sign in with Cognito, and API Gateway checks the token before letting a request through.
- You limit each user to a few dozen requests per second to stop anyone hammering the API.
- Late at night there are almost no requests, so it costs almost nothing; at the lunch rush the API scales on its own.
When to use it
✓ Use it when
Serverless APIs that need built-in authentication and rate limiting.
✗ Avoid it when
Very high traffic to containers/EC2 → ALB is usually cheaper.
Common uses
- REST/HTTP APIs for Lambda
- WebSocket for chat, real-time notifications
- API gateway for partners: API keys, usage plans, rate limiting
API Gateway, ELB or Lambda?
| API Gateway |  ELB |  Lambda | |
|---|---|---|---|
| Role | API front door: auth, limits, transformation | Spreads traffic to instances/containers | Runs the code that handles requests |
| Built-in auth | Cognito, IAM, Lambda authorizers, API keys | OIDC/Cognito (ALB) | None; you write it |
| Billing | Per request | Hourly + capacity units | Requests + run time |
| Best for | Serverless APIs, many clients | Very high traffic to EC2/ECS | The logic behind API Gateway |
What does it cost?
- Pricing model: HTTP API ~$1.00/1 million requests; REST API ~$3.50/1 million; WebSocket billed per message + connection minutes; cache billed hourly.
- Free tier: Older accounts: 1 million requests/month for 12 months.
Using REST API when HTTP API is enough (3.5× more expensive); enabling cache in dev environments; for very high traffic to containers, ALB is cheaper.
A serverless API in front of Lambda → API Gateway. Stop request floods or sell quota-based plans → throttling and usage plans with API keys. A browser calling the API from another domain gets blocked → enable CORS.
Try real exam questions
1A company hosts its static website by using Amazon S3. The company wants to add a contact form to its webpage. The contact form will have dynamic server-side components for users to input their name, email address, phone number, and user message. The company anticipates that there will be fewer than 100 site visits each month. Which solution will meet these requirements MOST cost-effectively?
- AHost the dynamic contact form in Amazon Elastic Container Service (Amazon ECS). Set up Amazon Simple Email Service (Amazon SES) to connect to a third-party email provider.
- BCreate an Amazon API Gateway endpoint that returns the contact form from an AWS Lambda function. Configure another Lambda function on the API Gateway to publish a message to an Amazon Simple Notification Service (Amazon SNS) topic.
- CHost the website by using AWS Amplify Hosting for static content and dynamic content. Use server-side scripting to build the contact form. Configure Amazon Simple Queue Service (Amazon SQS) to deliver the message to the company.
- DMigrate the website from Amazon S3 to Amazon EC2 instances that run Windows Server. Use Internet Information Services (IIS) for Windows Server to host the webpage. Use client-side scripting to build the contact form. Integrate the form with Amazon WorkMail.
Show answer
Correct answer: B
With fewer than 100 visits a month, choose pay-per-use serverless: API Gateway + Lambda handle the form, and SNS sends the notification. ECS or EC2 running all the time costs money while nobody uses it.
2A recently created startup built a three-tier web application. The front end has static content. The application layer is based on microservices. User data is stored as JSON documents that need to be accessed with low latency. The company expects regular traffic to be low during the first year, with peaks in traffic when it publicizes new features every month. The startup team needs to minimize operational overhead costs. What should a solutions architect recommend to accomplish this?
- AUse Amazon S3 static website hosting to store and serve the front end. Use AWS Elastic Beanstalk for the application layer. Use Amazon DynamoDB to store user data.
- BUse Amazon S3 static website hosting to store and serve the front end. Use Amazon Elastic Kubernetes Service (Amazon EKS) for the application layer. Use Amazon DynamoDB to store user data.
- CUse Amazon S3 static website hosting to store and serve the front end. Use Amazon API Gateway and AWS Lambda functions for the application layer. Use Amazon DynamoDB to store user data.
- DUse Amazon S3 static website hosting to store and serve the front end. Use Amazon API Gateway and AWS Lambda functions for the application layer. Use Amazon RDS with read replicas to store user data.
Show answer
Correct answer: C
S3 for the static front end, API Gateway + Lambda for processing, DynamoDB for JSON data: all serverless, pay per use and scaling automatically for the monthly peaks. EKS or Elastic Beanstalk still leave servers to operate.
Frequently asked questions
What is the difference between REST APIs, HTTP APIs and WebSocket APIs?
HTTP APIs are cheaper and faster and cover most APIs that call Lambda or an HTTP backend. REST APIs add features such as API keys and usage plans, request validation, caching and direct integrations with AWS services. WebSocket APIs are for two-way connections such as chat.
How is API Gateway priced?
By the number of API requests (HTTP APIs cost less than REST APIs) and the data transferred out. Enabling caching on a REST API adds an hourly charge. WebSocket APIs are billed by messages and connection minutes.
What do AWS exams ask about API Gateway?
Throttling and usage plans, authentication with Cognito, Lambda authorizers or IAM, enabling CORS, stages and stage variables, caching, and the integration timeout limit.