API Gateway

Relax. We'll talk through this in plain words — no textbook voice.

What you'll walk away with

Understand API Gateway without any of the intimidation
Get comfortable running things yourself in the AWS CLI/Console
Be ready to apply this concept in a real project right away

Let's think about this for a second

A Lambda function can't receive HTTP requests directly on its own — you need API Gateway to connect an HTTP endpoint (URL) to a Lambda function. API Gateway separates each route (`/users`, `/products/{id}`) by HTTP method (GET, POST, PUT, DELETE) and triggers the matching Lambda function. Authentication, rate limiting, request/response transformation, CORS setup — all of it can be handled at the API Gateway level.

Let's connect this to a real scenario

If you define a `GET /users/{id}` endpoint in API Gateway and connect it to the `get-user-function` Lambda — the moment a client requests `https://api.example.com/users/123`, API Gateway triggers `get-user-function` with the `{id: 123}` parameter and sends the function's response back to the client — a full REST API with no EC2/backend server running at all.

API Gateway = connects an HTTP endpoint (URL) to a Lambda/backend service
Triggers a Lambda function based on route + HTTP method
Authentication, rate limiting, and CORS can all be handled at the API Gateway level

Let's look at this together

bash

# Create an HTTP API and connect it to a Lambda function
aws apigatewayv2 create-api \
  --name tutorial-api \
  --protocol-type HTTP \
  --target arn:aws:lambda:us-east-1:123456789012:function:get-user-function

# The API is now live at a URL like:
# https://abc123.execute-api.us-east-1.amazonaws.com/

You should see

$ curl https://abc123.execute-api.us-east-1.amazonaws.com/users/123
{"id": 123, "name": "Example User"}

Try it in 5 minutes

Try connecting the Lambda function from Advanced lesson 2 to an API Gateway HTTP endpoint — send a request to the endpoint URL with `curl` or your browser and see if you get a response.

A quick word of caution

If you leave API Gateway publicly open in production without authentication (API Key, IAM, JWT authorizer) — attackers can repeatedly invoke your Lambda function and deliberately drive up your costs.

Easy traps

Leaving an API Gateway endpoint public with no authentication or rate limiting whatsoever — this carries an abuse/DDoS risk
Trying to connect a frontend app to your API from a browser without setting up CORS configuration — the browser will show a CORS error

Now try it yourself

Try connecting the Lambda function from Advanced lesson 2 to an API Gateway HTTP endpoint — send a request to the endpoint URL with `curl` or your browser and see if you get a response.

You'll know it worked when: $ curl https://abc123.execute-api.us-east-1.amazonaws.com/users/123 {"id": 123, "name": "Example User"}