AWS API Gateway vs. AWS WAF: What’s the Difference?

AWS API Gateway and AWS WAF are both commonly found at the front of modern AWS applications. Because both can control incoming HTTP traffic—and both provide some form of rate limiting—they are sometimes confused with each other.

However, they solve fundamentally different problems:

AWS API Gateway manages APIs. AWS WAF protects applications and APIs from malicious or unwanted HTTP traffic.

In a well-designed architecture, they are often used together rather than as alternatives.

What Is AWS API Gateway?

Amazon API Gateway is a managed service for creating, publishing, securing, monitoring, and operating APIs.

It acts as the front door to your application’s backend services.

A simple serverless architecture might look like this:

Client
   │
   │ HTTPS
   ▼
AWS API Gateway
   │
   ├── Authenticate
   ├── Authorize
   ├── Validate API request
   ├── Apply throttling
   ├── Log request
   └── Route request
   │
   ▼
AWS Lambda
   │
   ▼
DynamoDB

API Gateway can expose APIs backed by services such as:

• AWS Lambda
• HTTP services
• Applications running on EC2
• Containerized applications
• Other AWS services

API Gateway supports REST APIs, HTTP APIs, and WebSocket APIs.

Major AWS API Gateway Features

Feature	API Gateway
REST APIs
HTTP APIs
WebSocket APIs
Backend routing
Lambda integration
IAM authorization
Cognito authorization
Lambda authorizers
JWT authorization	, depending on API type
API keys
Usage plans	, REST APIs
Client quotas
Request throttling
Request/response transformation
API stages
Canary deployments
Custom domains
CloudWatch monitoring
X-Ray integration
Response caching	, REST APIs

The important point is that API Gateway understands the concept of an API consumer and API operation.

For example:

Customer A
    │
 API Key
    │
    ▼
API Gateway
    │
    ├── Authenticate
    ├── Authorize
    ├── Check quota
    ├── Check throttle
    └── POST /orders
           │
           ▼
        Lambda

API Gateway can therefore enforce rules associated with how clients consume an API.

What Is AWS WAF?

AWS WAF (Web Application Firewall) is a Layer-7 security service designed to inspect HTTP/S traffic and determine whether requests should be allowed, blocked, counted, challenged, or presented with CAPTCHA.

Its primary concern is not:

“Which backend should receive this API call?”

Instead, WAF is asking:

“Should I allow this HTTP request through at all?”

For example:

Internet
   │
   ▼
AWS WAF
   │
   ├── Source IP?
   ├── Country?
   ├── SQL injection?
   ├── XSS?
   ├── Malicious bot?
   ├── Suspicious request?
   └── Excessive traffic?
   │
   ▼
Application / API

Major AWS WAF Features

AWS WAF provides capabilities such as:

Feature	AWS WAF
IP blocking
IP allowlists
Geo-blocking
Header inspection
URI inspection
Query-string inspection
Request-body inspection
Regex/string matching
SQL injection protection
Cross-site scripting protection
AWS Managed Rules
Custom security rules
Rate-based rules
Bot protection
CAPTCHA
Browser challenge
Request monitoring/counting

For example, an organization could create WAF rules that say:

IF request originates from blocked country
    → BLOCK

IF request contains SQL injection pattern
    → BLOCK

IF request originates from known malicious IP
    → BLOCK

IF suspicious client exceeds rate threshold
    → BLOCK / CHALLENGE

This is fundamentally different from API management.

AWS API Gateway vs. AWS WAF

The easiest way to understand the difference is to compare their responsibilities.

Capability	API Gateway	AWS WAF
Expose an API
Route API requests
REST API management
Authentication
Authorization
API keys
Usage plans
Client quotas
API throttling
Security rate-based rules
IP filtering	Limited via policies
Geo-blocking
SQL injection protection
XSS protection
Bot protection
CAPTCHA/challenge
Managed attack rules
Backend integration
Lambda integration
Request transformation
API lifecycle/deployment

There is, however, one area where the distinction can become confusing: rate limiting.

API Gateway Throttling vs. WAF Rate Limiting

Both services can limit requests, but they do so for different reasons.

API Gateway Throttling

API Gateway throttling is primarily concerned with API consumption and backend capacity.

For example:

Customer A
    │
    │ API Key
    │
    │ 100 requests/sec
    ▼
API Gateway

The business requirement might be:

Customer A should be permitted to consume approximately 100 requests per second.

You may also have different consumption limits for different customers or API products.

Basic Customer
      │
      └── Lower quota

Premium Customer
      │
      └── Higher quota

Enterprise Customer
      │
      └── Highest quota

This is API consumption management.

WAF Rate Limiting

WAF rate-based rules are primarily a security control.

Suppose one IP suddenly generates thousands of requests:

Suspicious Client
      │
      │
      │ 10,000 requests
      │
      ▼
    AWS WAF
      │
      ├── Rate threshold exceeded
      │
      └── BLOCK / CHALLENGE

The question WAF is answering isn’t:

“What API subscription does this customer have?”

Instead, it is:

“Does this traffic pattern represent something I should block or challenge?”

This makes WAF rate-based rules useful for mitigating abusive traffic, bots, scraping, credential attacks, and certain application-layer denial-of-service patterns.

A Simple Way to Remember the Difference

Think about the questions each service is trying to answer.

AWS WAF asks:

Is this request safe and acceptable?

It looks at things such as:

• Source IP
• Geography
• Request patterns
• SQL injection
• XSS
• Bots
• Suspicious request rates

API Gateway asks:

Who is calling my API,
what are they allowed to call,
how much may they consume,
and where should the request go?

It handles things such as:

• Authentication
• Authorization
• API keys
• Usage plans
• Quotas
• Throttling
• API routing
• Backend integration

API Gateway and WAF Are Usually Used Together

For a public-facing API, a stronger architecture uses both services.

                     Internet
                        │
                        ▼
                ┌───────────────┐
                │    AWS WAF    │
                │               │
                │ SQLi / XSS    │
                │ IP filtering  │
                │ Geo blocking  │
                │ Bot control   │
                │ Rate rules    │
                └───────┬───────┘
                        │
                        ▼
               ┌─────────────────┐
               │   API Gateway   │
               │                 │
               │ Authentication  │
               │ Authorization   │
               │ API Keys        │
               │ Usage Plans     │
               │ Throttling      │
               │ Routing         │
               └────────┬────────┘
                        │
                        ▼
                     Lambda
                        │
                        ▼
                    DynamoDB

This creates multiple layers of protection.

What Happens When a Request Arrives?

Conceptually, the security flow becomes:

Incoming Request
       │
       ▼
    AWS WAF
       │
       ├── Is source IP allowed?
       ├── Is geography allowed?
       ├── SQL injection?
       ├── XSS?
       ├── Malicious bot?
       └── Excessive traffic?
       │
       ▼
  API Gateway
       │
       ├── Who are you?
       ├── Are you authenticated?
       ├── Are you authorized?
       ├── Which API are you calling?
       ├── Are you within your quota?
       └── Where should this request go?
       │
       ▼
    Backend

This is a good example of defense in depth.

WAF performs application-layer traffic filtering before the request reaches the API-management and application layers.

API Gateway then applies API-specific controls before forwarding the request to the backend.

What About Authentication?

Another important distinction is that WAF is not an identity system.

You should not think of WAF as replacing IAM, Cognito, JWT validation, or an API authorizer.

Authentication might instead look like:

Internet
   │
   ▼
AWS WAF
   │
   │ Security filtering
   ▼
API Gateway
   │
   ├── Cognito
   ├── IAM
   ├── JWT
   └── Lambda Authorizer
   │
   ▼
Application

This separates three important security responsibilities:

WAF
 │
 └── Is the HTTP request acceptable?

API Gateway
 │
 └── Is the API request valid and permitted?

Application
 │
 └── Is the requested business operation allowed?

That separation becomes increasingly important in enterprise architectures.

Where Does CloudFront Fit?

For internet-facing applications, another common architecture introduces Amazon CloudFront:

Internet
   │
   ▼
CloudFront
   │
   ▼
AWS WAF
   │
   ▼
API Gateway
   │
   ▼
Lambda
   │
   ▼
DynamoDB

CloudFront provides global edge delivery and caching, while WAF provides Layer-7 filtering and API Gateway provides API management.

The responsibilities remain distinct:

CloudFront
     │
     └── Global delivery / edge

AWS WAF
     │
     └── Application security

API Gateway
     │
     └── API management

Lambda
     │
     └── Application logic

DynamoDB
     │
     └── Data

AWS vs. GCP Equivalent Services

For architects working across AWS and Google Cloud, the high-level mapping is:

The equivalent GCP architecture might therefore look like:

AWS                           GCP

Internet                     Internet
   │                            │
   ▼                            ▼
AWS WAF                    Cloud Armor
   │                            │
   ▼                            ▼
API Gateway            API Gateway / Apigee
   │                            │
   ▼                            ▼
Lambda                Cloud Run / Functions

Which One Should You Use?

The answer is usually not API Gateway or WAF.

If you need to expose and manage APIs, use API Gateway.

If you need to protect HTTP applications and APIs against malicious or unwanted traffic, use AWS WAF.

For important public-facing APIs, consider using both:

Internet
   │
   ▼
WAF
   │
   │ Security boundary
   ▼
API Gateway
   │
   │ API management boundary
   ▼
Application
   │
   │ Business authorization boundary
   ▼
Data

Each layer solves a different problem.

Final Takeaway

The simplest distinction is:

AWS WAF determines whether an HTTP request should be allowed to reach your application.

AWS API Gateway determines how an API request should be authenticated, authorized, controlled, and routed to a backend.

API Gateway is an API management service.

AWS WAF is an application security service.

Used together, they provide a much stronger architecture than either service provides by itself.


The post AWS API Gateway vs AWS WAF: Features, Differences and Architecture appeared first on AWS Security Architect.