AWS for DevOps — API Gateway

9.2 — API Gateway

Amazon API Gateway creates, publishes, and manages REST and HTTP APIs at any scale. It’s the front door for your Lambda functions and backend services.

REST API vs HTTP API

Feature	REST API	HTTP API
Cost	~$3.50/million requests	~$1.00/million requests
Latency	Higher (~30ms overhead)	Lower (~10ms overhead)
Features	Full (caching, API keys, usage plans, WAF)	Basic (simpler, faster)
Auth	IAM, Cognito, Lambda authorizer, API keys	IAM, Cognito, JWT
Best for	Enterprise APIs needing full features	Simple APIs, microservices

Creating an HTTP API with Lambda

# Step 1 — Create the HTTP API
$ aws apigatewayv2 create-api \
    --name my-api \
    --protocol-type HTTP
{
    "ApiId": "abc123def4",
    "ApiEndpoint": "https://abc123def4.execute-api.ap-south-1.amazonaws.com"
}

# Step 2 — Create Lambda integration
$ aws apigatewayv2 create-integration \
    --api-id abc123def4 \
    --integration-type AWS_PROXY \
    --integration-uri arn:aws:lambda:ap-south-1:123456789012:function:hello-world \
    --payload-format-version "2.0"

# Step 3 — Create a route
$ aws apigatewayv2 create-route \
    --api-id abc123def4 \
    --route-key "GET /hello" \
    --target integrations/INTEGRATION_ID

# Step 4 — Create a stage (auto-deploy)
$ aws apigatewayv2 create-stage \
    --api-id abc123def4 \
    --stage-name prod \
    --auto-deploy

Grant API Gateway Permission to Invoke Lambda

$ aws lambda add-permission \
    --function-name hello-world \
    --statement-id apigateway-invoke \
    --action lambda:InvokeFunction \
    --principal apigateway.amazonaws.com \
    --source-arn "arn:aws:execute-api:ap-south-1:123456789012:abc123def4/*/*/hello"

Request Flow

  Client
    │
    ▼ GET /hello
  API Gateway
    │
    ▼ (route: GET /hello → Lambda integration)
  Lambda: hello-world
    │
    ▼ (returns response)
  API Gateway
    │
    ▼ (forwards response to client)
  Client receives:
  {"message": "Hello, World!"}

Stages and Deployment

Stages represent environments:

  API: my-api
  ├── Stage: dev   → https://abc123.execute-api.ap-south-1.amazonaws.com/dev
  ├── Stage: staging → https://abc123.execute-api.ap-south-1.amazonaws.com/staging
  └── Stage: prod  → https://abc123.execute-api.ap-south-1.amazonaws.com/prod

Each stage can have different settings (throttling, logging, stage variables).

Custom Domain Names

# Create a custom domain
$ aws apigatewayv2 create-domain-name \
    --domain-name api.example.com \
    --domain-name-configurations \
        CertificateArn=arn:aws:acm:ap-south-1:123456789012:certificate/abc123,EndpointType=REGIONAL

# Map to your API stage
$ aws apigatewayv2 create-api-mapping \
    --domain-name api.example.com \
    --api-id abc123def4 \
    --stage prod

Throttling

Level	Default	Purpose
Account	10,000 requests/sec	Prevent runaway costs
Stage	Configurable	Different limits per environment
Route	Configurable	Protect specific endpoints

$ aws apigatewayv2 update-stage \
    --api-id abc123def4 \
    --stage-name prod \
    --default-route-settings '{"ThrottlingBurstLimit":100,"ThrottlingRateLimit":50}'

CORS Configuration

$ aws apigatewayv2 update-api \
    --api-id abc123def4 \
    --cors-configuration \
        AllowOrigins="https://example.com",\
        AllowMethods="GET,POST,OPTIONS",\
        AllowHeaders="Content-Type,Authorization",\
        MaxAge=86400

Common Mistakes

Mistake	Why It Hurts	Fix
Missing Lambda permission	API returns 500	Add lambda:InvokeFunction permission for API Gateway
No throttling	One client can exhaust your Lambda concurrency	Set burst/rate limits
REST API for simple use cases	Paying 3.5× more, higher latency	Use HTTP API unless you need REST-specific features
Not enabling CORS	Frontend gets blocked	Configure CORS on the API

Quick Reference

Task	Command
Create HTTP API	aws apigatewayv2 create-api --name NAME --protocol-type HTTP
Create integration	aws apigatewayv2 create-integration --api-id ID --integration-type AWS_PROXY --integration-uri LAMBDA_ARN
Create route	aws apigatewayv2 create-route --api-id ID --route-key "GET /path"
Create stage	aws apigatewayv2 create-stage --api-id ID --stage-name prod --auto-deploy
Test	curl https://API_ID.execute-api.REGION.amazonaws.com/prod/hello

---

Next → DynamoDB for DevOps