Amazon API Gateway
Amazon API Gateway is a serverless Amazon Web Services service that maintains and secures APIs at any scale, letting users publish and manage REST, HTTP, and WebSocket APIs.
Key points
- Supports three API types: REST APIs (full feature set — API keys, per-client throttling, request validation, mock integrations, caching, AWS WAF support), HTTP APIs (a cheaper, lower-latency subset built for proxying to Lambda or HTTP backends, minus most of the REST API management features), and WebSocket APIs (persistent, two-way connections for real-time apps).
- Default throttling is a shared account-and-Region quota of 10,000 requests per second, with burst capacity up to 5,000 requests, across all REST, HTTP, WebSocket, and WebSocket callback APIs combined (2,500 RPS / 1,250 burst by default in several newer Regions); the account-level limit can be raised by contacting AWS Support.
- Consists of Stages, Resources, Methods, and Integrations.
- Acts as a front door for applications to access data and business logic from back-end services, such as code running on AWS Lambda or any web application.
- Handles processing of hundreds of thousands of API calls, including authorization, access control, different environments (dev, test, production), and API version management.
- Helps create web APIs that route HTTP requests to Lambda functions.
- Example flow: a request sent through a browser or HTTP client to the public endpoint is broadcast by API Gateway and sent to the Lambda function; the function calls the Lambda API to get the required data and returns it via the API.
- Integrates:
- Outside of a VPC with any AWS service, AWS Lambda, EC2 endpoints, and Load Balancers.
- Inside of a VPC with AWS Lambda and EC2 endpoints.
- Its request count can be tracked as an Amazon Cloudwatch metric.
- REST APIs can be protected against common web exploits by attaching AWS WAF.
- AWS X-Ray can trace a user request as it moves through an API Gateway API, a Lambda function, and a database such as DynamoDB.