Loading…
While this loads — worth knowing
ElastiCache RedisnotElastiCache Memcached
Redis has data structures — sorted sets, counters, pub/sub. Memcached has plain keys and nothing else.
Loading…
While this loads — worth knowing
Redis has data structures — sorted sets, counters, pub/sub. Memcached has plain keys and nothing else.
A managed front door for APIs: REST, HTTP and WebSocket APIs that take each call, check who is calling, throttle it, and pass it to Lambda, another service or any HTTP backend.
Where API Gateway takes you5 steps, all open
Amazon API Gateway creates, publishes and secures APIs at any scale. It is the front door: it accepts the calls, handles authorization, throttling and monitoring, and passes each call to a backend such as a Lambda function, another AWS service, or an HTTP endpoint.
Three kinds of API. REST APIs have the most features: API keys, per-client throttling, request validation, caching, WAF and private endpoints. HTTP APIs have fewer features and a lower price. WebSocket APIs hold a two-way connection open, so the backend can push messages to clients.
A hotel's reception desk. Every guest's request comes to the desk first: the receptionist checks the room key, turns away anyone asking too often, answers common questions from a card on the counter, and passes the rest to the right department. Some guests keep a phone line open, so the desk can call them back.
API GatewayAuthorizerThrottlingStage cacheIntegrationWebSocket APIDoes the Lambda authorizer or Cognito user pool accept the caller? No token means 401; a Deny policy means 403.
Is the client within its usage plan's rate, and the account within its Regional limit? Otherwise, 429 Too Many Requests.
On a REST API with caching on, is a cached response still within its TTL, 300 seconds by default?
The backend must answer within the integration timeout, 29 seconds by default on a REST API.
Pick a case to follow the call through each check.
Sign in outside, check inside. The app signs in to a Cognito user pool, and the REST API's Cognito authorizer checks the token on every call.
Push instead of polling. The functions send status updates to connected clients through the WebSocket API's @connections API.
Filter first. A WAF web ACL on the REST API blocks common web exploits; an HTTP API could not use WAF.
Who may call. IAM for AWS callers, Cognito user pools for your users, Lambda authorizers for anything custom such as OAuth or SAML tokens, and resource policies for source addresses and VPC endpoints.
API keys are not authentication. AWS warns against using them to control access: a key valid for one API in a usage plan works for every API in that plan.
Throttling is a target, not a wall. Usage plan limits are applied on a best-effort basis; use WAF to manage requests and AWS Budgets to watch costs.
Private APIs can be called only from a VPC, through an interface VPC endpoint.
REST and HTTP APIs are charged per million calls received, plus data transfer out; HTTP APIs cost less.
WebSocket APIs are charged for messages, metered in 32 KB units, and for connection minutes.
A REST API cache is charged by the hour for its size, and is not in the free tier.
The free tier covers a million REST calls, a million HTTP calls, a million WebSocket messages and 750,000 connection minutes a month, for the first 12 months.
Prices change, so none are printed here. Check the API Gateway pricing page on aws.amazon.com.
| Feature | REST API | HTTP API |
|---|---|---|
| Price | Higher | Lower |
| Endpoint types | Edge-optimized, Regional, private | Regional |
| API keys and per-client throttling | Yes | No |
| Caching | Yes | No |
| AWS WAF | Yes | No |
| JWT authorizers | Through a Lambda authorizer | Built in |
| Integration timeout | 29 s by default, raisable on Regional and private APIs | 30 s at most |
| REST endpoint type | Reached through | Choose it when |
|---|---|---|
| Edge-optimized | The nearest CloudFront point of presence | Clients spread around the world; the default |
| Regional | The Region itself, or your own CloudFront | Callers in one Region, or your own distribution in front |
| Private | An interface VPC endpoint only | APIs used only inside your network |
push real-time updates to connected clientsA WebSocket API
The backend posts to clients through the @connections API.
a rate limit and monthly quota for each customerUsage plans with API keys
REST APIs only; HTTP APIs have no API keys.
use API keys to authenticate usersNo: IAM, Cognito or a Lambda authorizer
AWS says API keys should not be used to control access.
clients start receiving 429 errorsThrottling
The account default is 10,000 requests a second per Region, with bursts of 5,000.
a backend call through a REST API takes 45 secondsPast the 29-second default
Make it asynchronous, or raise the timeout on a Regional or private API, trading away account throughput.
cache responses to cut calls to the backendStage caching on a REST API
The TTL is 300 seconds by default and 3600 at most; HTTP APIs have no cache.
an API reachable only from inside the VPCA private REST API
It is called through an interface VPC endpoint.
the cheapest API in front of Lambda, with JWT authorizationAn HTTP API
Fewer features, a lower price, and JWT authorizers built in.
protect the API from SQL injectionAWS WAF on a REST API
HTTP APIs cannot use WAF.
authorize callers with a third-party OAuth tokenA Lambda authorizer
It checks the token and returns an IAM policy, which can be cached.
A company sells access to its pricing API, backed by Lambda. Each customer must have its own rate limit and monthly quota, requests must be checked for common web exploits, and repeated identical requests should not reach the Lambda function every time. What should a solutions architect use?
A mobile app needs an HTTPS API in front of Lambda functions. Each partner app gets its own key with a rate limit and monthly quota, and requests are checked against a WAF web ACL. What receives the app's calls?
10,000 requests a second per Region, burst 5,000, then 429.29 s by default; HTTP API 30 s at most.300 s by default, 3600 at most.2 hours, 10 minutes idle.This whole page is free right now.The AWS library is still being written, so every page of it is open to everyone while that lasts. It becomes a paid bundle later; what you read today costs you nothing.
Every fact on this page was checked against AWS’s own documentation on 15 Sept 2026. If AWS has changed something since, its page is the one to trust.