API Gateway & Serverless Patterns

In one line

API Gateway is a managed HTTP front door that handles routing, auth, throttling, and TLS in front of Lambda or other backends; combined with events and Step Functions it forms the backbone of serverless architectures.

0/4 · 0%

Think of it like this

A building's front desk that checks badges, limits how many visitors go up per minute, and directs each person to the right floor — so the people on each floor (your functions) only deal with legitimate, routed requests.

Key ideas

01
Two main flavours: HTTP APIs (cheaper, lower latency, JWT/OIDC authorizers, simple Lambda and HTTP integrations — the default choice) and REST APIs (more features: API keys and usage plans, request validation, caching, WAF integration, private APIs). WebSocket APIs handle persistent bidirectional connections.
02
A ROUTE (GET /orders/{id}) maps to an INTEGRATION — usually a Lambda proxy integration, which passes the whole request to the function and expects a status/headers/body response. API Gateway has a 29-second integration timeout by default, so long work must be made asynchronous.
03
AUTH options: JWT authorizers (validate tokens from Cognito, Auth0, or any OIDC provider — no code), Lambda authorizers (custom logic, cached per token), and IAM auth (SigV4 for service-to-service). THROTTLING and burst limits protect your backends, and custom domains use ACM certificates.
04
Common serverless patterns: (1) API Gateway → Lambda → DynamoDB for CRUD APIs; (2) accept a request, drop it on SQS, return 202, process asynchronously (Phase 6); (3) S3 upload → EventBridge/S3 event → Lambda processing; (4) STEP FUNCTIONS for multi-step workflows with retries, branching, waits, and human approval — instead of Lambdas calling Lambdas.
05
Deploy serverless apps with infrastructure-as-code (AWS SAM, CDK, Serverless Framework, or Terraform) rather than console clicks — a real API has dozens of routes, permissions, and triggers that must be reproducible.

Code & diagrams

template.yamlyaml

AWS SAM: an HTTP API with a JWT authorizer, one route, one function, least-privilege table access.

AWSTemplateFormatVersion: "2010-09-09"
Transform: AWS::Serverless-2016-10-31

Resources:
  Api:
    Type: AWS::Serverless::HttpApi
    Properties:
      Auth:
        DefaultAuthorizer: Jwt
        Authorizers:
          Jwt:
            IdentitySource: $request.header.Authorization
            JwtConfiguration:
              issuer: https://auth.example.com/
              audience: [orders-api]

  GetOrder:
    Type: AWS::Serverless::Function
    Properties:
      Runtime: nodejs22.x
      Architectures: [arm64]
      Handler: get-order.handler
      MemorySize: 512
      Timeout: 10
      Environment:
        Variables: { TABLE: !Ref Orders }
      Policies:
        - DynamoDBReadPolicy: { TableName: !Ref Orders }
      Events:
        Get:
          Type: HttpApi
          Properties: { ApiId: !Ref Api, Path: /orders/{id}, Method: GET }

  Orders:
    Type: AWS::DynamoDB::Table
    Properties:
      BillingMode: PAY_PER_REQUEST
      AttributeDefinitions: [{ AttributeName: pk, AttributeType: S }]
      KeySchema: [{ AttributeName: pk, KeyType: HASH }]

deploy.shbash

sam build
sam deploy --guided          # first time: stack name, region, confirm IAM changes
sam local invoke GetOrder -e events/get-order.json   # run locally in Docker
sam logs -n GetOrder --tail

AsyncApiPatterndiagram

Rendering diagram…

Explain it without notes

Why does API Gateway's integration timeout push you toward asynchronous designs for long-running work?

When would you choose Step Functions over a Lambda function that calls other Lambda functions?

Practice

Should a new public JSON API with JWT auth use an HTTP API or a REST API? What would change your answer?

Sketch a serverless image-thumbnail pipeline for user uploads.

Trade-offs

↔
Fully serverless stacks remove idle cost and server operations, but distribute your logic across many small managed pieces — tracing, local testing, and reasoning about the whole system get harder, and per-request pricing can overtake containers at high, steady volume.

Done when you can

I can choose between HTTP APIs and REST APIs.
I design long-running work as asynchronous behind API Gateway.
I use Step Functions for multi-step workflows instead of chaining Lambdas.
I deploy serverless apps with infrastructure-as-code.