AWS offers two "flavors" of API Gateway. Choosing the wrong one is a common and costly mistake — REST APIs can cost roughly 3.5× more than HTTP APIs for the same traffic volume.
1. HTTP APIs (The Modern Choice)
HTTP APIs were introduced in 2019 specifically to address the cost and latency overhead of REST APIs for common serverless patterns.
- Philosophy: "Fast, Cheap, and Simple."
- Cost: ~70% cheaper than REST APIs ($1.00 per million requests vs. $3.50).
- Latency: Lower latency due to a leaner internal processing pipeline.
- Features: Native OIDC/OAuth 2.0 JWT authorization (no Lambda Authorizer needed for standard JWTs), Lambda proxy integration, and automatic deployments.
- Missing: No WAF support, no X-Ray tracing, no response caching, no request validation, no usage plans/API keys, and no VTL (Velocity Template Language) transformations.
2. REST APIs (The Enterprise Choice)
REST APIs are the original API Gateway product and remain the right choice when you need the full feature set.
- Philosophy: "Feature-Complete."
- Cost: More expensive ($3.50 per million requests for the first 333 million).
- Features: WAF (Web Application Firewall) integration, response caching (up to 3,600 seconds TTL), AWS X-Ray tracing, private VPC endpoints, request/response validation, VTL body mapping templates, usage plans, and API keys.
- Use Case: If you need to sell your API (Usage Plans/API Keys), enforce WAF rules, cache responses, or perform complex request/response transformations, you must use REST APIs.
The Decision Framework
| Requirement | HTTP API | REST API |
|---|---|---|
| Lowest cost | ✅ | ❌ |
| WAF integration | ❌ | ✅ |
| Response caching | ❌ | ✅ |
| X-Ray tracing | ❌ | ✅ |
| Usage plans / API keys | ❌ | ✅ |
| Native JWT auth (OIDC) | ✅ | ❌ (needs Lambda Authorizer) |
| Private VPC endpoint | ❌ | ✅ |
| VTL transformations | ❌ | ✅ |
Rule of Thumb: Start with HTTP APIs. Only switch to REST APIs when you hit a specific missing feature. Don't pay the REST API premium for a simple Lambda proxy that doesn't need WAF or caching.
Senior nuance: The "HTTP API is always cheaper" rule has an exception. If your REST API has a high cache hit rate (e.g., 90%), the effective cost per uncached request drops significantly, and the caching benefit (reduced Lambda invocations, reduced backend load) may outweigh the higher per-request price. Always model your actual traffic pattern before assuming HTTP API wins on cost.