ACKF logoACKF
Frontend Web and Mobile

Amazon API Gateway

View on GitHub

Amazon API Gateway

A managed API front door that creates, deploys, and secures HTTP, REST, and WebSocket APIs. It operates as a regional, edge-optimized, or private endpoint that routes requests to backend integrations such as AWS Lambda, HTTP endpoints, or VPC Link targets. It normally sits at the application edge to expose and protect backend services and apply request/response transformations, authorization, throttling, and monitoring.

🗂 Resource Category

Application Integration • Security, Identity, and Compliance

🧠 Exam Memory Hook

Think: "Public or private HTTP APIs + managed ingress + Lambda/VPC backend = Amazon API Gateway"

📖 Ownership

Classification: AWS Managed Service

AWS responsibilities: AWS operates and maintains the API Gateway control plane and managed service platform, including the underlying physical infrastructure, network fabric, and the managed runtime for the gateway. AWS is responsible for securing the infrastructure and service control plane, applying patches to the AWS-owned hardware, hypervisor (where applicable), operating systems, and the managed runtime components that run the API Gateway service. AWS provides the APIs, management console, monitoring integration points, and scaling of the API Gateway service itself.

Customer responsibilities: The customer configures APIs, resources, methods, stages, mappings, domain names, authorizers, resource policies, usage plans, API keys, logging settings, deployment stages, and integrations to backend endpoints. The customer is responsible for securing backend services (for example EC2, containers, or Lambda functions), configuring IAM policies and authorizers, monitoring API usage and metrics, setting throttling and caching policies, and maintaining application code and dependencies in backend systems. The customer must also manage VPC-side resources and network configuration when using private APIs or VPC Link.

Patching responsibilities: AWS patches and maintains the underlying physical infrastructure, hypervisor where applicable, and the managed API Gateway runtime and platform. Customers are responsible for patching guest operating systems, runtimes, libraries, dependencies, and applications for any backend resources they control (for example EC2 instances, container hosts, or self-managed services). For AWS Lambda backends, customers patch function code and packaged dependencies while AWS patches the Lambda service runtime platform.

🏗 Typical Architecture

💡 Top 5 Features

  • Managed hosting and routing for HTTP, REST, and WebSocket APIs with route and method configuration.
  • Native integrations with AWS Lambda, HTTP endpoints, and VPC Link for private backend connectivity.
  • Request and response mapping templates and model validation for transforming payloads.
  • Authorization and access control using IAM roles/policies, Lambda authorizers, and Amazon Cognito.
  • Built-in metrics and access logging integration with Amazon CloudWatch for monitoring and troubleshooting.

✅ Top 5 Use Cases

  • Fronting serverless APIs backed by AWS Lambda to expose HTTP endpoints with throttling and authorization.
  • Proxying and securing microservices in private VPCs using VPC Link and an internal load balancer.
  • Implementing WebSocket APIs for real-time bidirectional client communication such as chat or notifications.
  • Managing third-party developer access with API keys, usage plans, and request throttling.
  • Transforming and validating client requests before they reach backend services using mapping templates.

🏗 Architecture Placement

Amazon API Gateway typically sits at the application edge as a managed API front door; clients such as web or mobile apps, external services, or other AWS services send requests to it. It normally connects to backend integrations including AWS Lambda, public HTTP endpoints, or private backends via VPC Link (for example ALB/NLB and EC2). Deployment options include regional, edge-optimized, or private APIs depending on latency, geographic distribution, and connectivity requirements. It also integrates with IAM, Amazon Cognito, and Amazon CloudWatch for access control and monitoring.

🎯 Commonly Used With

- AWS Lambda
- Amazon VPC
- Amazon CloudWatch
- AWS Identity and Access Management
- Amazon Cognito

🌍 5 Real-World Examples

  • A fintech organisation exposes REST endpoints with API Gateway that trigger Lambda functions for transaction processing while enforcing per-key throttling and authentication.
  • A healthcare provider uses private APIs with VPC Link to surface internal microservices behind an ALB to internal applications, enabling controlled access and centralized logging.
  • An e-commerce platform aggregates product and pricing microservices using HTTP APIs and applies request transformations before forwarding to containerized backends.
  • A media company uses WebSocket APIs to deliver real-time playback events and user presence updates to client applications.
  • A government digital service secures public APIs with IAM and Cognito authorizers and collects CloudWatch logs for audit and operational monitoring.

🎓 AWS Exam Clues

  • Select API Gateway when you need a managed API front door with built-in authorization, mapping, usage plans, and monitoring.
  • Use VPC Link when backend services are inside a private VPC and cannot be invoked directly from a public API endpoint.
  • Choose HTTP APIs instead of REST APIs when lower latency and simplified features align with the API requirements.
  • Design for backend scaling and configure throttling, caching, and retries in API Gateway to protect origin services from overload.
  • Private APIs require configuring VPC interface endpoints and resource policies to control access from VPCs or VPC-connected networks.

📝 Quick Revision

Amazon API Gateway is a managed service that exposes, secures, and routes HTTP, REST, and WebSocket APIs to Lambda, HTTP endpoints, or VPC backends. Use it when you need managed authorization, mapping, throttling, and monitoring; plan for backend scaling, VPC connectivity, and correct IAM/resource policies.

🏷 Keywords

HTTP APIs • REST APIs • WebSocket APIs • VPC Link • Lambda integration • Request mapping templates • Usage plans • API keys • Throttling • Custom/Lambda authorizers • Stage variables • CloudWatch access logs