API Gateway is often extra cost and config for features nobody uses. A function URL is free and enough for most things. I only reach for API Gateway when a function URL can't do something, and I decide that case by case.
Use it when
- You need an HTTPS endpoint for one function, with IAM or app-level auth.
- MVPs, internal APIs, webhooks into AWS.
Don't use it when
- You need usage plans, API keys per customer, request validation or WAF directly on the endpoint. That's API Gateway territory (or CloudFront or Workers in front).
Pricing
Free. You pay only for the Lambda invocation.
Gotchas, with fixes
Gotcha: Response streaming doesn't work through a function URL for a function inside a VPC.
Fix: Keep streaming functions outside the VPC, or use Workers or Lambda Web Functions.
Provisioning
Official Pulumi package · Official Terraform provider
aws.lambda.FunctionUrl, with invokeMode BUFFERED or RESPONSE_STREAM.
Instead, consider
- API Gateway Only when a function URL genuinely can't do it.
- Cloudflare Workers A global front door with auth, rate limits and bot rules.
Worked examples
Where it fits
- An API for my app: Pick 01.
Start here. Free front door, one function per concern.
- A traffic spike I can see coming: Don't.
Not as the front door for the crowd. Function URLs are still my default for normal APIs, and Lambda still does the checkout above. The problem is pointing 50,000 people straight at it: the spike hits Lambda's scaling steps and 1,000-instance default, gets 429s, and every new instance opens a database connection at once. Put the Worker in front and only the winners reach Lambda.
Instead: Cloudflare Workers
Sources
Last reviewed by Nicolas Dao