Filter concepts by levelShowing all levels.

AWS · API Gateway and API Front Doors

API Gateway and API Front Doors

REST vs HTTP APIs, Lambda and private backend patterns, hard limits, and when ALB fits better

  • REST = full features, HTTP = minimal + cheapnot two price points of the same product
  • VPC link → private ALB/NLBno public IP needed on the backend
  • 29s / 10MB ceilings (REST)independent of the backend's own timeout
  • ALB: no API-management overheadfits when those features aren't needed

1.REST APIs vs HTTP APIs

REST APIs carry the full feature set — API keys, per-client throttling via usage plans, request validation, AWS WAF, private endpoints — at a higher price. HTTP APIs are a minimal, cheaper subset built for the common case: JWT authorizers, Lambda/HTTP integrations, and automatic deployments, without API keys or request validation.

Key features

  • REST APIs: full feature set — API keys, usage plans, request validation, AWS WAF, private endpoints, mock integrations
  • HTTP APIs: minimal, lower-cost subset — JWT authorizers, automatic deployments, no API keys/request validation/WAF
  • A stage (e.g. "prod", "dev") is a named, deployed snapshot of the API's configuration; a deployment publishes changes to a stage
  • Authorizers run before the backend integration: Lambda authorizer (custom logic), JWT authorizer (HTTP APIs only), or IAM
  • A usage plan (REST APIs only) ties API keys to throttle and quota limits per client
A request through API Gateway
checked byroutedthroughinvokes

Client request

Authorizer

Lambda, JWT, or IAM

Stage

deployed config snapshot

Integration

Lambda, HTTP, AWS service

  • Client request
    • leads to Authorizer (checked by)
  • Authorizer — Lambda, JWT, or IAM
    • leads to Stage (routed through)
  • Stage — deployed config snapshot
    • leads to Integration (invokes)
  • Integration — Lambda, HTTP, AWS service

Signature

REST API (full features) vs HTTP API (minimal, cheaper)

REST API = full feature set (API keys, usage plans, request validation, WAF) at higher cost. HTTP API = minimal, cheaper subset (JWT authorizer, automatic deployments). Stage = deployed config snapshot; a deployment is what publishes to it.

2.API Gateway + Lambda vs Private Backend Patterns

API Gateway + Lambda is the classic serverless API: each route triggers a function, no server ever runs when idle. API Gateway + private backend routes to resources inside a VPC (an ALB, an NLB, or Cloud Map service discovery) via a VPC link, letting a public API front a backend that never gets a public IP.

Key features

  • API Gateway + Lambda: each route's integration directly invokes a Lambda function, synchronously by default
  • API Gateway + private backend: a VPC link routes traffic to a private ALB, NLB, or Cloud Map service — no public IP needed on the backend
  • REST APIs support private integrations with NLBs and ALBs; HTTP APIs additionally support AWS Cloud Map for private service discovery
  • A private REST API (endpoint type PRIVATE) restricts the API itself to only be reachable from within a VPC via an interface endpoint

Choosing the integration pattern

Choosing the integration pattern
BackendPattern
Serverless function per routeAPI Gateway + Lambda integration
Existing containerized/EC2 service inside a VPCAPI Gateway + VPC link → private ALB/NLB
API itself must never be reachable from the public internetPrivate REST API (endpoint type PRIVATE)
Service discovered dynamically inside a VPCHTTP API + Cloud Map private integration
Two ways API Gateway reaches a backend

Lambda integration

  • The receptionist does the work personally
  • No server runs when idle
  • Classic serverless pattern

VPC link → private ALB/NLB

  • Routed down a private hallway, not the public internet
  • Backend never needs a public IP
  • Fronts an existing containerized/EC2 service
  • Lambda integration
    • The receptionist does the work personally
    • No server runs when idle
    • Classic serverless pattern
  • VPC link → private ALB/NLB
    • Routed down a private hallway, not the public internet
    • Backend never needs a public IP
    • Fronts an existing containerized/EC2 service

Command

text
API Gateway → Lambda integration          (serverless)
API Gateway → VPC link → private ALB/NLB  (private backend)

API Gateway + Lambda: classic serverless, no idle server. API Gateway + VPC link: routes to a private ALB/NLB (or Cloud Map on HTTP APIs) with no public IP needed on the backend.

3.Timeout, Payload, and Rate Limits

API Gateway REST APIs cap integration timeout at 29 seconds and payload size at 10 MB, regardless of what the backend itself is configured for. A workload that needs longer or larger has to be redesigned around an async pattern, not given a longer wait.

Key features

  • REST API integration timeout: maximum 29 seconds, regardless of the backend's own configured timeout
  • REST API payload size: maximum 10 MB for request and response bodies
  • A workload that can exceed these limits needs an async pattern (return immediately, poll or notify on completion) rather than a longer synchronous wait
  • Throttling is enforced at the account level, and additionally per-client via usage plans and API keys on REST APIs

Command

text
REST API integration timeout: max 29s (hard limit, not adjustable)
REST API payload: max 10 MB

REST API integration timeout maxes out at 29 seconds and REST API payloads at 10 MB — both hard ceilings independent of the backend's own limits. Workloads that exceed either need an async pattern, not a longer wait.

4.When ALB Fits Better Than API Gateway

ALB fits better than API Gateway when a workload needs longer synchronous requests than API Gateway allows, or when none of API Gateway's API-management features (keys, usage plans, request validation) are actually needed — ALB just routes and load-balances HTTP traffic, with no per-request API-management overhead.

Key features

  • ALB has no API Gateway-style integration timeout ceiling — limited instead by target/idle timeout settings you control
  • ALB pricing is per-hour plus data processed, not per-request — often cheaper at high, steady traffic volumes
  • API Gateway adds request validation, usage plans, API keys, and native Lambda integration that ALB does not have
  • ALB fits when the backend is already a long-running service (ECS/EC2) and API-management features are not needed

Command

text
Need API-management features (keys, usage plans, validation) or Lambda-native routes → API Gateway
Just need to route/balance HTTP traffic to a running service, no per-request billing → ALB

Choose ALB over API Gateway when the workload needs longer synchronous requests than API Gateway's ceiling allows, or when none of API Gateway's API-management features (keys, usage plans, validation) are actually needed.

Remember

  • HTTP API-only features (usage plans, request validation, WAF) have no upgrade path from HTTP API to REST API without recreating the API.
  • REST API config changes need an explicit deployment to reach a stage — HTTP APIs deploy automatically.
  • API Gateway's integration timeout is a hard ceiling stacked on top of the backend's own timeout — the shorter one always wins.
  • A VPC link lets a public API reach a fully private backend without giving that backend a public IP.

Pro tip

  • A workload that structurally exceeds 29 seconds needs an async response pattern, not a longer timeout request.
  • Choose ALB when the backend already runs continuously and none of API Gateway's API-management features are in use.

Next up

  • S3 — Object Storage
  • S3 Security and Data Lifecycle
  • CloudFront and Edge Delivery

Sources

  • Choose between REST APIs and HTTP APIs — docs.aws.amazon.com/apigateway/latest/developerguide/http-api-vs-rest.html
  • Amazon API Gateway quotas — docs.aws.amazon.com/apigateway/latest/developerguide/limits.html
  • Checked against official AWS documentation 2026-08-21

Spotted a mistake on this page? Tell us.

ReadSheet