AWS & CloudAmazon API Gateway là managed service cho phép tạo, publish, bảo vệ và monitor HTTP/WebSocket API ở scale lớn — cổng kết nối giữa client và backend (Lambda, EC2, hoặc bất kỳ HTTP endpoint).
REST API (v1) là loại cũ hơn, hỗ trợ đầy đủ tính năng: request/response transformation, API keys, usage plans, custom authorizers, caching; phù hợp enterprise API cần nhiều tính năng. HTTP API (v2) ra mắt 2019, đơn giản hơn, nhanh hơn (~60% latency thấp hơn), rẻ hơn (~70%) so với REST API; hỗ trợ JWT authorizer, Lambda proxy integration, CORS — phù hợp microservices hiện đại. WebSocket API cho realtime bidirectional communication.
Tích hợp Lambda: chọn Lambda Proxy Integration để API Gateway forward toàn bộ request (headers, body, query params) vào event object của Lambda; response Lambda phải có format {statusCode, headers, body}.
Bảo mật API bằng: Cognito User Pool authorizer, Lambda custom authorizer (kiểm tra JWT/API key tùy chỉnh), hoặc IAM authorization. Throttling mặc định 10,000 RPS per account, có thể tăng qua request. Pricing: HTTP API ~$1/triệu request, REST API ~$3.5/triệu request.
Amazon API Gateway is a managed service for creating, publishing, securing, and monitoring HTTP/WebSocket APIs at scale — the gateway between clients and backends (Lambda, EC2, or any HTTP endpoint).
REST API (v1) is the older type with full feature support: request/response transformation, API keys, usage plans, custom authorizers, and caching — ideal for enterprise APIs requiring rich functionality. HTTP API (v2) was launched in 2019 and is simpler, faster (~60% lower latency), and cheaper (~70% less) than REST API; it supports JWT authorizers, Lambda proxy integration, and CORS — well-suited for modern microservices. WebSocket API enables real-time bidirectional communication.
Lambda integration: use Lambda Proxy Integration so API Gateway forwards the entire request (headers, body, query params) into the Lambda event object; the Lambda response must follow the format {statusCode, headers, body}.
Secure APIs using: Cognito User Pool authorizer, Lambda custom authorizer (for custom JWT/API key checks), or IAM authorization. Default throttling is 10,000 RPS per account and can be increased on request. Pricing: HTTP API ~$1/million requests, REST API ~$3.5/million requests.