1.2 Amazon API Gateway

What API Gateway Does

Amazon API Gateway publishes, secures, and scales HTTP and WebSocket APIs that front Lambda functions, public HTTP endpoints, or other AWS services through direct service integrations. It handles authorization, throttling, caching, request validation, and traffic management so your backend stays thin. On the DVA-C02 exam, nearly every API Gateway item is a service-selection or troubleshooting scenario — cross-origin failure, tiered rate limits, who authenticates the caller, or transform the payload without touching backend code.

REST vs HTTP vs WebSocket

The selection rule: choose HTTP API for simple, low-cost Lambda/HTTP proxy APIs; choose REST API when you need its advanced features such as API keys, caching, WAF, or VTL mapping; choose WebSocket API only when you need persistent two-way connections.

Proxy vs Non-Proxy Integration

• Lambda proxy integration passes the entire raw HTTP request to the function as a structured event and expects the function to return the exact shape { "statusCode": 200, "headers": {...}, "body": "..." }. All mapping lives in your code — simple and flexible. A common bug: returning a raw object instead of a JSON-stringified body, which yields a 502 Bad Gateway ("malformed Lambda proxy response").
• Non-proxy (custom) integration uses mapping templates written in Velocity Template Language (VTL) inside API Gateway to transform requests and responses, rename fields, and inject values. This decouples the public API contract from the backend so you can reshape JSON without redeploying the function.

Stages, Throttling, and Usage Plans

A stage (for example dev, test, prod) is a named deployment snapshot of an API with its own settings, variables, logging, and throttling. Stage variables let one stage point at a dev Lambda alias and another at prod. Throttling uses a token-bucket model — a steady-state rate (requests per second) plus a burst (bucket capacity) — and returns HTTP 429 Too Many Requests when callers exceed it. There is an account-level default, per-stage, per-method, and per-client (usage plan) throttling, applied from broadest to most specific.

Usage plans associate API keys with specific rate and quota (for example, 1,000 requests per day) so you can meter and tier consumers. The critical exam distinction: an API key identifies and meters a caller; it does not authenticate the caller. Authentication is the authorizer's job.

Authorizers

Lambda authorizer results can be cached by token for a configurable TTL to cut invocations.

Caching and CORS

Enable per-stage response caching with a TTL (default 300 s, 0-3,600 s) to cut backend calls; it is billed by cache size and supports cache-key parameters and per-method invalidation. For browsers calling a different origin, configure CORS (Cross-Origin Resource Sharing) so API Gateway answers the preflight OPTIONS request with Access-Control-Allow-Origin, -Methods, and -Headers. A request that works in curl but fails in the browser with a preflight error is the textbook CORS symptom, because curl ignores CORS while browsers enforce it.

Request Validation, Logging, and Custom Domains

REST APIs can perform request validation against a JSON Schema model to reject malformed bodies, query strings, or headers before they ever reach your backend, saving Lambda invocations and cost. Enable CloudWatch access logs and execution logs per stage to troubleshoot integration latency and errors, and turn on X-Ray tracing to follow a request from API Gateway through Lambda to DynamoDB. For production you typically attach a custom domain name with an ACM TLS certificate and map base paths (/v1, /v2) to stages, so consumers see a stable branded URL rather than the default execute-api endpoint.

Latency, WAF, and Common Traps

Edge-optimized REST endpoints route through CloudFront for global callers; choose regional endpoints when callers are in-region or when you front the API with your own CloudFront distribution, and private endpoints (interface VPC endpoint) for internal-only APIs. Attach AWS WAF to a REST API stage to block SQL injection, cross-site scripting, and rate-based floods. Watch these traps on the exam: a 502 from a proxy integration almost always means the function returned the wrong response shape; a 429 means throttling, not a code bug; and an API key by itself authorizes nothing without a usage plan.

Also remember HTTP APIs do not support API keys, usage plans, or response caching — if a scenario needs those, it must be a REST API.