Amazon API Gateway

The API entry point that invokes Lambda from the frontend.

Back to glossary Go to related practice questions

In one sentence

The API entry point that invokes Lambda from the frontend.

Overview

A service for publishing HTTP APIs and REST APIs. Integrates with Lambda to build serverless APIs.

Common use cases

Contact form submission API
Serverless REST API
API with Cognito authentication

CLF-C02 exam points

Used as the entry point for APIs
Integrates with Lambda
Supports authentication, CORS, and rate limiting

SAA-C03 exam points

Understand the differences between HTTP API and REST API
Restrict CORS to production Origins
Design error handling for cases like 429 and 5xx

Practical Use

Amazon API Gateway is a managed service for publishing and managing HTTP APIs, REST APIs, and WebSocket APIs. The most common use case in practice is building serverless APIs in combination with Lambda. Requests from the frontend are received by API Gateway, which handles authentication, authorization, rate limiting, and CORS at this layer before forwarding them to backend Lambda functions or services running on EC2. Because no server runs continuously, costs are kept low during periods without traffic, and the service automatically scales to handle sudden traffic spikes. API Gateway offers two main types — HTTP APIs and REST APIs — which are chosen based on the use case. HTTP APIs offer low latency and low cost, providing basic features such as JWT authentication and CORS, making them the first choice for most modern web and mobile API workloads. REST APIs offer advanced features such as request validation, API key management, AWS WAF integration, and private APIs, making them better suited for enterprise use cases and APIs that require fine-grained control. WebSocket APIs are used for bidirectional communication such as chat and real-time notifications. CLF-C02 / SAA-C03 typically ask questions such as "Which service serves as the entry point for serverless APIs?" and "Which service integrates with Lambda to provide APIs to the frontend?". CORS configuration, authentication methods (IAM authentication, Cognito Authorizer, Lambda Authorizer), and rate limiting / throttling design are explored more deeply starting from SAA-C03. Basic production security topics — such as avoiding leaving Access-Control-Allow-Origin set to wildcard (`*`), and not logging API keys or authentication tokens — are also commonly tested.

Official Documentation

Cost notes

Charged based on API call count and data transfer
For MVP, limit to POST /contact only

Security notes

Do not use * for Access-Control-Allow-Origin in production
Also validate inputs on the Lambda side

Related services

AWS Lambda

Runs code only when needed, without launching servers.

Amazon Cognito

An authentication service that manages user registration and login for apps.

Amazon CloudWatch

A monitoring service to view the state and logs of AWS resources.

Related architecture diagrams

SERVERLESS / API / BASIC