7 questions found
What is Amazon API Gateway and why is it used?
Beginner
Amazon API Gateway is a fully managed service that lets you create, publish, secure, and monitor REST, HTTP, and WebSocket APIs at any scale, acting as the front door for applications to access backend services such as AWS Lambda, EC2, or any other web application, without you needing to manage any servers yourself.
aws apigateway create-rest-api --name 'MyDemoAPI'
Real-world example
An online store exposes its product catalog and checkout functionality through API Gateway endpoints, which route incoming requests to Lambda functions that handle the actual business logic.
Common follow-ups: What is the difference between REST APIs and HTTP APIs in API Gateway?;How does API Gateway integrate with Lambda?
Lambda & Serverless;IAM
What are the different types of APIs you can build with API Gateway?
Beginner
API Gateway supports REST APIs, which offer the most features including request validation and API keys, HTTP APIs, which are lighter and cheaper for simple proxy integrations, and WebSocket APIs, which allow persistent two way connections for real time applications like chat apps or live dashboards.
aws apigatewayv2 create-api --name 'ChatAPI' --protocol-type WEBSOCKET
Real-world example
A ride sharing application uses a WebSocket API to continuously push a driver's live location to the customer's app, while using a simpler HTTP API for one time actions like booking a ride.
Common follow-ups: When should you choose HTTP APIs over REST APIs?;How do WebSocket APIs maintain a persistent connection?
Lambda & Serverless;Amazon SNS (Simple Notification Service)
How does API Gateway handle authentication and authorization for incoming requests?
Intermediate
API Gateway supports multiple authorization methods including IAM based permissions, Amazon Cognito user pools for managing app users, and custom Lambda authorizers that let you write your own logic to validate tokens such as JSON Web Tokens before allowing a request to reach the backend.
aws apigateway create-authorizer --rest-api-id abc123 --name 'MyAuthorizer' --type TOKEN --authorizer-uri arn:aws:lambda:us-east-1:123456789012:function:authFunction
Real-world example
A mobile banking app uses a Lambda authorizer that checks a customer's login token on every API call, rejecting the request immediately if the token is invalid or expired before it ever reaches the backend service.
Common follow-ups: What is the difference between a Lambda authorizer and Cognito user pool authorization?;How do you secure an API Gateway endpoint using API keys?
IAM;Amazon SageMaker & Machine Learning on AWS
What is request throttling in API Gateway and why is it important?
Intermediate
Request throttling allows you to set limits on how many requests per second a client or the overall API can make, protecting your backend services from being overwhelmed by sudden traffic spikes or abusive clients, and it can be configured at the account level, the API stage level, or for individual usage plans tied to API keys.
aws apigateway update-stage --rest-api-id abc123 --stage-name prod --patch-operations op=replace,path=/throttle/rateLimit,value=1000
Real-world example
A ticket booking platform sets a strict throttling limit during a popular concert release to prevent bots from overwhelming the backend database, while still allowing genuine customers to complete their purchases.
Common follow-ups: What happens to a request that exceeds the throttle limit?;How do usage plans work together with API keys?
Monitoring (CloudWatch);Auto Scaling Groups
How can you cache responses in API Gateway to improve performance?
Intermediate
API Gateway provides a built in caching layer that stores responses from your backend for a configurable time to live period, so repeated requests for the same data can be served directly from the cache instead of hitting your backend service again, which reduces latency and backend load significantly.
aws apigateway update-stage --rest-api-id abc123 --stage-name prod --patch-operations op=replace,path=/cacheClusterEnabled,value=true
Real-world example
A weather application caches its API Gateway responses for five minutes, since weather data does not change every second, dramatically reducing the number of calls made to the backend Lambda function.
Common follow-ups: How do you invalidate the API Gateway cache manually?;What cache sizes are available for API Gateway?
Amazon CloudFront & Content Delivery;Monitoring (CloudWatch)
How does API Gateway support versioning and staged deployments of an API?
Advanced
API Gateway allows you to deploy the same API definition to multiple stages, such as development, testing, and production, each with its own configuration, throttling limits, and stage variables, letting you safely test changes in a lower environment before promoting the exact same deployment to production without rebuilding the API from scratch.
aws apigateway create-deployment --rest-api-id abc123 --stage-name staging
Real-world example
A software company tests a new version of its public API in a staging stage using real traffic from internal testers, then promotes the exact same deployment package to the production stage once it passes validation.
Common follow-ups: What are stage variables and how are they used?;How do you roll back a bad deployment in API Gateway?
AWS CodePipeline
CodeBuild & CodeDeploy (CI/CD);IaC (CloudFormation)
What is the difference between edge optimized, regional, and private API Gateway endpoints?
Advanced
An edge optimized endpoint routes requests through Amazon CloudFront to reduce latency for geographically distributed clients, a regional endpoint keeps traffic within a single AWS region which is ideal when clients are located near that region, and a private endpoint is only accessible from within your own Amazon VPC through an interface endpoint, keeping the API completely isolated from the public internet.
aws apigateway create-rest-api --name 'InternalAPI' --endpoint-configuration types=PRIVATE
Real-world example
A healthcare company builds an internal API that must never be exposed to the public internet, so it deploys a private API Gateway endpoint accessible only from its own VPC, satisfying strict compliance requirements.
Common follow-ups: How do you restrict access to a private API Gateway endpoint?;When should you choose regional over edge optimized endpoints?
VPC & Networking;AWS Security Hub & GuardDuty