serverless aws networking claude-curated
Amazon API Gateway is a managed front door for HTTP and WebSocket APIs. It handles TLS termination, request routing, authentication, throttling, and observability — letting AWS Lambda (or any backend) stay focused on business logic.
Three flavours
| Type | Use case | Notes |
|---|---|---|
| REST API | Full feature set | Original product, most expensive |
| HTTP API | Lambda + JWT, lightweight | ~70% cheaper, faster, fewer features |
| WebSocket API | Bi-directional, persistent connections | Chat, live dashboards, push updates |
REST API
The full-featured offering: API keys, usage plans, request/response transformations, native AWS WAF integration, edge-optimised endpoints, request validation, SDK generation, private APIs (VPC-only).
HTTP API
Stripped down for speed and cost. Supports JWT authorisers natively, but no API keys, no usage plans, no AWS WAF native integration, no request/response mapping. Best fit for greenfield Lambda + JWT APIs where you don’t need the gateway-level features REST gives you.
WebSocket API
Maintains long-lived connections. Routes messages by selection expression to Lambda or other backends. Useful for real-time apps where polling is wasteful.
Integrations
API Gateway can route to many backends:
- Lambda proxy — most common; the entire request goes to Lambda as JSON, the response shape determines the HTTP response.
- Lambda non-proxy — explicit mapping templates between HTTP and Lambda payload (REST only).
- AWS service integration — call DynamoDB, SQS, SNS, Step Functions directly with no Lambda in the middle.
- HTTP integration — proxy to any HTTP endpoint.
- VPC link — private integration to resources inside a VPC (NLB for REST, ALB/NLB/Cloud Map for HTTP).
The “no Lambda in the middle” pattern is underused — for simple write-to-queue or write-to-DynamoDB endpoints it removes a moving part.
Throttling and quotas
- Account-level throttling protects the region-wide ceiling.
- Per-stage / per-route throttling caps a specific deployment.
- Usage plans (REST only) bind API keys to per-key request rates and quotas.
When throttled the gateway returns HTTP 429. Use this rather than relying on Lambda concurrency limits — it fails faster and doesn’t burn invocation cost.
Custom domains
Three steps:
- Issue an ACM certificate (must be in
us-east-1for edge-optimised REST APIs; in the API’s region for regional/HTTP APIs). - Create the API Gateway custom domain pointing at the certificate.
- Route 53 alias record (or CNAME) pointing the domain at the API Gateway target.
Base path mapping lets you serve multiple APIs under the same domain (/v1, /internal, etc.).
Authorisers
- IAM — sign requests with SigV4. Good for service-to-service inside AWS.
- Cognito — verify JWT issued by a Cognito user pool.
- Lambda authoriser — your own logic; returns an IAM policy. Slowest but most flexible. Cache results to amortise the Lambda call.
- JWT authoriser (HTTP API only) — verify JWTs from any OIDC issuer, no Lambda needed.
Caching
REST API supports a managed cache (0.5–237 GB) keyed by request parameters. TTL configurable per method. Reduces Lambda invocations for read-heavy idempotent endpoints — but invalidation is coarse (clear-all). HTTP APIs do not have built-in caching; put CloudFront in front if you need it.