Amazon API Gateway
A fully managed REST API service: API types, caching, backend targets beyond Lambda, and authorizing directly against Cognito without a custom Lambda.
A fully managed RESTful API service. Web apps, mobile apps, IoT devices, and private (VPC or on-premises) clients all reach it over standard HTTP, GET, POST, PUT, DELETE. API Gateway logs request data to CloudWatch automatically.
API types
- REST API: the original, full-featured type.
- HTTP API: a newer, lower-latency, lower-cost type. Fewer features than REST API, but cheaper and faster, worth defaulting to unless a specific REST API feature is actually needed.
- WebSocket API: for real-time, bidirectional communication. AWS AppSync is the alternative worth knowing about specifically for a real-time GraphQL API.
- Private API: not exposed to the public internet, reachable only from inside a VPC.
Endpoint types (for REST APIs) add another axis: regional (served from one AWS region), edge-optimized (served through CloudFront's edge network, worth it when users are spread globally), and private. Reaching a resource inside a VPC from API Gateway goes through a VPC link, a private connection into that network.
Caching
API Gateway can cache responses itself. On a GET request, it checks its own cache before calling the backend at all; a cache hit skips the backend (Lambda, DynamoDB, whatever) entirely and returns straight from the cache, which is a real latency win on read-heavy endpoints. A cache miss calls the backend as normal and populates the cache with the result for next time.
Backend targets beyond Lambda
Lambda behind API Gateway, both serverless, is the default pairing (often called the traditional serverless web architecture), but it's not the only option. API Gateway can also call other AWS services directly, or any publicly accessible HTTP endpoint, including something outside AWS entirely, without a Lambda function in the middle.
The non-obvious benefit of routing an already-public endpoint through API Gateway anyway: the same authorization logic configured at the gateway applies to that call too. A public endpoint reached through API Gateway still has to pass whatever authorizer is attached, even though the endpoint itself doesn't enforce that on its own.
Cognito as a direct authorizer
An API Gateway route can point straight at a Cognito user pool as its authorizer, no custom authorizer Lambda needed for a plain token check. Every request carries a token; API Gateway validates it against the pool before the request goes anywhere else. A missing, expired, or invalid token gets rejected with a 401 before any application code runs.
The payoff: the check is enforced once, at the gateway, instead of reimplemented inside every Lambda function that needs it.
Direct service integrations
API Gateway can call some AWS services directly, no Lambda required as a transport layer. Used here to publish an event straight to EventBridge from a registration request. Skip the Lambda unless the request actually needs to be transformed before it reaches the target service.
Where this showed up
- The token gets checked first: Cognito authorizer mechanics.
- A Lambda that only moves data is a Lambda you don't need: direct EventBridge integration.