API Gateway is a good product, and it earns its place for public APIs, per-customer quotas and direct service integrations. It's just over-engineered as a starting point: most apps never need those features, and you pay for them in configuration from day one. Start on a function URL; the handler moves behind API Gateway unchanged when the need is real.
Use it when
- You sell or expose an API to third parties and need per-customer API keys, usage plans and throttling.
- Request validation, WAF or custom-domain base paths on the endpoint itself.
- Direct AWS service integrations with no Lambda in between (for example API Gateway straight into SQS).
Don't use it when
- High-volume device ingestion: at 216M messages a month, a REST API alone costs about $756, vs about $215–230 for the whole IoT Core pipeline. Use IoT Core or an HTTP API into SQS.
- WebSocket fan-out to many watchers: every server push is a paid message, connections last at most 2 hours, and the account default is 10,000 requests a second.
- Getting started. A function URL already gives you HTTPS, IAM auth, CORS and streaming. API Gateway adds routes, stages, deployments and integrations to keep in sync with your code, and a 29–30 second request timeout by default (a function URL allows up to 15 minutes).
Pricing
Sydney: HTTP APIs $1.29 per million requests, REST APIs $3.50 per million, WebSocket messages $1.30 per million plus $0.325 per million connection-minutes.
Gotchas, with fixes
Gotcha: REST API pricing ($3.50/M) is almost three times HTTP API pricing ($1.29/M).
Fix: Default to HTTP APIs, or a function URL, unless you need a REST-only feature.
Gotcha: Adding API Gateway later looks like a rewrite.
Fix: It isn't. Function URLs use the same event format as HTTP APIs (payload version 2.0), so the same handler works behind either.
Gotcha: API Gateway execution logs at INFO level log every request into CloudWatch.
Fix: Keep access logs; turn execution logging down or off in production.
Provisioning
Official Pulumi package · Official Terraform provider
@pulumi/aws (apigateway and apigatewayv2).
Instead, consider
- Lambda function URLs Most of the time.
- Cloudflare Workers A global gateway at volume: about $300 instead of about $1,290 per billion requests.
Worked examples
Where it fits
- An API for my app: Don't.
Useful, just not on day one. A function URL already gives you HTTPS, IAM auth, CORS and streaming with nothing else to configure. API Gateway adds routes, stages, deployments and integrations to keep in sync with your code, and a 29–30 second request timeout by default (a function URL allows 15 minutes). Add it when you need what only it does: per-customer API keys and usage plans, request validation, WAF on the endpoint, or writing straight into SQS. Function URLs use the same event format as HTTP APIs, so adding it later changes no code.
Instead: Lambda function URLs
- Something live that many people watch at once: Don't.
WebSocket APIs bill every message pushed to every watcher, close connections after 2 hours, and hold no state, so you still need a database to decide who's winning. The auction example costs about $407 a month, vs $15–30 with one Durable Object per auction.
Instead: Cloudflare Durable Objects
- Device and IoT data: Don't.
A per-request HTTP front door for a stream of tiny messages. At 216M messages a month, the REST API alone costs about $756. The whole IoT Core pipeline, processing included, costs about $215–230.
Instead: AWS IoT Core
Sources
- API Gateway pricing
- API Gateway quotas (integration timeout)
- Lambda function URL invocation (payload format)
Last reviewed by Nicolas Dao