AWS API Gateway
Amazon API Gateway is a fully managed service for creating, publishing, maintaining, monitoring, and securing REST, HTTP, and WebSocket APIs at any scale.
What is API Gateway? (Simple Explanation)
API Gateway is an AWS service in the Network category. Amazon API Gateway is a fully managed service for creating, publishing, maintaining, monitoring, and securing REST, HTTP, and WebSocket APIs at any scale.
When Would You Use API Gateway?
- REST API backends for web & mobile apps
- Real-time WebSocket applications
- API monetization & rate limiting
- Backend For Frontend patterns
Who Uses API Gateway?
From startups to enterprises, API Gateway powers:
What Makes API Gateway Powerful
API Gateway Pricing & Free Tier
Free Tier: 1GB data transfer out (12 months), 750 hours of ELB (12 months). Pay-as-you-go from ~$0.025/GB for CloudFront.
API Gateway Best Practices
- 1Use VPC Flow Logs for network traffic monitoring and threat detection
- 2Restrict security group inbound rules to specific CIDR ranges (never 0.0.0.0/0 for SSH/RDP)
- 3Use VPC Endpoints to keep traffic to AWS services off the public internet
- 4Enable WAF with managed rules (AWS Managed Core Rule Set) on all public-facing load balancers
- 5Use Transit Gateway instead of VPC peering mesh for >5 VPCs
Getting Started with API Gateway in 5 Minutes
- 1Open the AWS Console and navigate to API Gateway
- 2Click "Create" and define your network scope (VPC, subnets, region)
- 3Configure routing, security, and access controls
- 4Review and create — test connectivity before routing production traffic
API Gateway CLI Quick Reference
2 production-ready commands. Full CLI Library (225+ services) →
aws apigateway get-rest-apis --query 'items[*].{ID:id,Name:name,Endpoint:apiEndpoint}' --output tableList all REST APIsaws apigateway get-stages --rest-api-id xxx --query 'item[*].{Stage:stageName,Deployed:deploymentId,Cache:cacheClusterEnabled}'View API stages and cache statusPros & Cons of API Gateway
Pros
- REST APIs, HTTP APIs, and WebSocket APIs
- Request/response transformation and validation
- API keys, usage plans, and throttling
- Lambda and HTTP backend integration
- Stage-level caching
Cons
- ✕Data transfer costs are notoriously difficult to predict — egress is the #1 hidden cost
- ✕Network ACL and Security Group rules can conflict in complex multi-tier apps
- ✕VPC design mistakes (overlapping CIDRs) are painful to fix after resources are deployed
API Gateway vs Alternatives
API Gateway vs Lambda
Choose API Gateway for REST API backends for web & mobile apps and Real-time WebSocket applications. It excels at rest apis, http apis, and websocket apis.
Choose Lambda as an alternative when your requirements differ. Each service in the Network category serves different architectural patterns.
Services That Work with API Gateway
API Gateway is rarely used alone. It is typically combined with:
Compliance & Security
How AWS API Gateway fits into major compliance standards. Browse all 41 frameworks →
API Gateway configuration is audited by CIS Benchmarks v1.5–v3.0 for secure cloud defaults.
NIST 800-53API Gateway access controls, encryption, and audit logging map to NIST 800-53 AC, SC, and AU control families.
PCI DSS 4.0API Gateway encryption, access control, and logging support PCI DSS for cardholder data environments.
SOC 2API Gateway security, availability, and confidentiality controls evaluated under SOC 2 Trust Services Criteria.
ISO 27001API Gateway configuration and monitoring controls map to ISO 27001 Annex A information security management.
Frequently Asked Questions About API Gateway
What is AWS API Gateway?
Amazon API Gateway is a fully managed service for creating, publishing, maintaining, monitoring, and securing REST, HTTP, and WebSocket APIs at any scale.
What is API Gateway used for?
API Gateway is commonly used for: REST API backends for web & mobile apps; Real-time WebSocket applications; API monetization & rate limiting; Backend For Frontend patterns. It's a core service in the network category of AWS.
Is API Gateway free?
Free Tier: 1GB data transfer out (12 months), 750 hours of ELB (12 months). Pay-as-you-go from ~$0.025/GB for CloudFront.
What are the key features of API Gateway?
API Gateway's most important capabilities include: REST APIs, HTTP APIs, and WebSocket APIs. Request/response transformation and validation. API keys, usage plans, and throttling. Lambda and HTTP backend integration. Stage-level caching. Each of these is designed to help teams rest api backends for web & mobile apps.
How does API Gateway compare to alternatives?
API Gateway competes with both AWS-native alternatives (Lambda, Cognito, CloudFront) and third-party equivalents. The right choice depends on your specific requirements for scalability, cost, and operational overhead. See the comparisons section below for detailed guidance.
Which compliance frameworks apply to API Gateway?
CIS AWS v3.0: API Gateway configuration is audited by CIS Benchmarks v1.5–v3.0 for secure cloud defaults. NIST 800-53: API Gateway access controls, encryption, and audit logging map to NIST 800-53 AC, SC, and AU control families. PCI DSS 4.0: API Gateway encryption, access control, and logging support PCI DSS for cardholder data environments. SOC 2: API Gateway security, availability, and confidentiality controls evaluated under SOC 2 Trust Services Criteria. ISO 27001: API Gateway configuration and monitoring controls map to ISO 27001 Annex A information security management.
People also search for
Was this page helpful?
Ready to secure your API Gateway configuration?
Pavora continuously monitors your AWS API Gateway for misconfigurations, compliance violations, and security risks.