1. Amazon API Gateway

What is an API Gateway?

Amazon API Gateway is a fully managed service for creating, publishing, maintaining, monitoring, and securing APIs at any scale. It acts as the "front door" for applications to access backends like Lambda, EC2, or any HTTP endpoint.

Core Concept API Gateway = managed API endpoint. You define your API (routes, methods), connect each route to a backend (Lambda, HTTP, AWS service), and API Gateway handles: authentication, authorization, throttling, caching, request/response transformation, CORS, API versioning, and SSL termination.

API Types

REST API vs HTTP API

API Gateway Key Features


  1. Stages: Deploy API to stages (dev, staging, prod). Each stage has its own URL. Stage variables for configuration.
  2. Throttling: Default: 10,000 requests/sec, 5,000 burst. Per-method, per-client throttling via Usage Plans and API Keys.
  3. Caching (REST API only): Cache API responses at the API Gateway level. TTL: 0–3600 seconds (default 300). Reduces backend calls. Per-stage configuration.
  4. Authorization Methods: IAM (SigV4), Cognito User Pools (JWT token), Lambda Authorizer (custom auth logic), API Keys (identification, not auth), Resource Policies (IP/VPC restrictions).
  5. Request/Response Transformation: REST API: modify requests/responses using mapping templates (Apache Velocity). HTTP API: simple parameter mapping only.
  6. CORS: Cross-Origin Resource Sharing. Must be enabled for browser-based clients calling API from different domains.


API Gateway Integrations

API GW Direct AWS Integration API Gateway can call AWS services DIRECTLY without Lambda. Example: API GW → SQS:SendMessage. This eliminates the Lambda "middleman" for simple pass-through operations, reducing cost and latency. Common pattern: API GW → SQS (queue requests), API GW → Step Functions (start workflow), API GW → DynamoDB (CRUD operations).

API Gateway Endpoint Types

API Gateway Limits

  1. Timeout: 29 seconds maximum (if backend takes longer, use async pattern with SQS/Step Functions)
  2. Payload: 10 MB maximum request/response size
  3. Throttling: 10,000 requests/sec account-level (soft limit)
  4. WebSocket: 500 new connections/sec, 128 KB message size
Important Warning API Gateway has a hard 29-second timeout. If your backend processing takes longer, you CANNOT extend this. Use an async pattern: API GW → SQS (or Step Functions) → process asynchronously → client polls for result or receives callback. This is a very common exam question.

2. AWS AppSync


What is AppSync?

AWS AppSync is a fully managed service that creates GraphQL and Pub/Sub APIs. It enables applications to interact with multiple data sources through a single API endpoint, with real-time data synchronization and offline support.

GraphQL vs REST REST: multiple endpoints (/users, /orders, /products). Clients may over-fetch or under-fetch data. GraphQL: single endpoint (/graphql). Client specifies exactly what data it wants in the query. No over-fetching. Resolvers combine data from multiple sources in one request. AppSync is the AWS managed GraphQL service.

Key Characteristics

  1. Fully managed GraphQL API service
  2. Single endpoint, client defines query shape (request exactly the data you need)
  3. Real-time subscriptions via WebSocket (data pushed to clients on changes)
  4. Offline data synchronization (for mobile apps — caches locally, syncs when online)
  5. Combines data from multiple sources in a single API call
  6. Automatic conflict detection and resolution (for offline sync)
  7. Supports: JavaScript and VTL (Velocity Template Language) resolvers


AppSync Data Sources

AppSync Security

  1. API Key: simple token (for dev/test, public APIs with throttling)
  2. Cognito User Pools: user authentication via Cognito JWT tokens
  3. IAM: AWS SigV4 for service-to-service calls
  4. OIDC: any OpenID Connect provider (Auth0, Okta, etc.)
  5. Lambda Authorizer: custom auth logic
  6. Can use multiple auth types on the same API


AppSync Subscriptions (Real-Time)

  1. Clients subscribe to specific data changes via WebSocket
  2. When a mutation occurs, subscribed clients receive the update in real time
  3. Example: chat app — new message → all participants receive it instantly
  4. Powered by MQTT over WebSocket under the hood
  5. Scales to millions of connected clients


AppSync Merged APIs

  1. Combine multiple AppSync source APIs into a single merged API endpoint
  2. Each team owns its own source API (microservice pattern)
  3. The merged API provides a unified schema to clients
  4. Use for: large organizations with multiple teams building different parts of the API

3. API Gateway vs AppSync

4. Complete Integration Services Decision Table

Exam Tip API GW & AppSync: "REST API" = API Gateway. "GraphQL API" = AppSync. "Real-time mobile sync + offline" = AppSync. "WebSocket" = API GW WebSocket API. HTTP API = cheaper (~70%), fewer features. REST API = full features + caching + WAF. "Call SQS without Lambda" = API GW AWS Service integration. "29-sec timeout" = use async pattern. "Migrate AMQP/MQTT broker" = Amazon MQ. "Migrate Kafka" = MSK.