API Gateway Comparison: AWS API Gateway vs Kong vs Nginx vs Traefik

An API gateway handles the cross-cutting concerns that every API needs: routing, authentication, rate limiting, logging, TLS termination, and request transformation. The question isn't whether to use one — it's which one fits your infrastructure and team.

---

Quick Decision Guide

---

AWS API Gateway

AWS offers two API Gateway products:

HTTP API with JWT authorizer (Terraform):

# terraform/api-gateway.tf
resource "aws_apigatewayv2_api" "main" {
  name          = "api"
  protocol_type = "HTTP"

  cors_configuration {
    allow_origins = ["https://app.yourproduct.com"]
    allow_methods = ["GET", "POST", "PUT", "DELETE", "OPTIONS"]
    allow_headers = ["Content-Type", "Authorization"]
    max_age       = 86400
  }
}

resource "aws_apigatewayv2_authorizer" "jwt" {
  api_id           = aws_apigatewayv2_api.main.id
  authorizer_type  = "JWT"
  identity_sources = ["$request.header.Authorization"]
  name             = "jwt-authorizer"

  jwt_configuration {
    audience = ["https://api.yourproduct.com"]
    issuer   = "https://your-tenant.auth0.com/"
  }
}

resource "aws_apigatewayv2_integration" "backend" {
  api_id             = aws_apigatewayv2_api.main.id
  integration_type   = "HTTP_PROXY"
  integration_uri    = "http://${aws_lb.backend.dns_name}/{proxy}"
  integration_method = "ANY"
  payload_format_version = "1.0"
}

resource "aws_apigatewayv2_route" "protected" {
  api_id             = aws_apigatewayv2_api.main.id
  route_key          = "ANY /api/{proxy+}"
  authorization_type = "JWT"
  authorizer_id      = aws_apigatewayv2_authorizer.jwt.id
  target             = "integrations/${aws_apigatewayv2_integration.backend.id}"
}

resource "aws_apigatewayv2_stage" "default" {
  api_id      = aws_apigatewayv2_api.main.id
  name        = "$default"
  auto_deploy = true

  default_route_settings {
    throttling_burst_limit = 5000
    throttling_rate_limit  = 1000
  }
}

Cost reality check:

• 100M requests/month: HTTP API = $100, REST API = $350
• At low scale (< 10M req/month), cost difference is negligible
• At high scale (> 1B req/month), consider self-hosted Kong or Nginx — much cheaper

---

Kong OSS

Kong is a Lua-based API gateway built on Nginx, extensible via plugins. Kong OSS is free; Kong Enterprise adds RBAC, dev portal, and analytics ($).

Docker Compose setup:

# docker-compose.yml
services:
  kong-db:
    image: postgres:16-alpine
    environment:
      POSTGRES_USER: kong
      POSTGRES_PASSWORD: kong
      POSTGRES_DB: kong
    volumes:
      - kong_db:/var/lib/postgresql/data

  kong-migrations:
    image: kong:3.7
    command: kong migrations bootstrap
    environment:
      KONG_DATABASE: postgres
      KONG_PG_HOST: kong-db
      KONG_PG_USER: kong
      KONG_PG_PASSWORD: kong
    depends_on: [kong-db]

  kong:
    image: kong:3.7
    environment:
      KONG_DATABASE: postgres
      KONG_PG_HOST: kong-db
      KONG_PG_USER: kong
      KONG_PG_PASSWORD: kong
      KONG_PROXY_LISTEN: 0.0.0.0:8000
      KONG_ADMIN_LISTEN: 0.0.0.0:8001
    ports:
      - "8000:8000"  # Proxy
      - "8001:8001"  # Admin API
    depends_on: [kong-migrations]

volumes:
  kong_db:

Configure a service, route, and plugins via Kong Admin API:

# Create a service (upstream)
curl -X POST http://localhost:8001/services \
  -d name=users-api \
  -d url=http://users-service:3001

# Create a route for the service
curl -X POST http://localhost:8001/services/users-api/routes \
  -d "paths[]=/api/users" \
  -d "methods[]=GET" \
  -d "methods[]=POST"

# Add JWT auth plugin
curl -X POST http://localhost:8001/services/users-api/plugins \
  -d name=jwt \
  -d "config.claims_to_verify=exp"

# Add rate limiting plugin
curl -X POST http://localhost:8001/services/users-api/plugins \
  -d name=rate-limiting \
  -d "config.minute=1000" \
  -d "config.hour=10000" \
  -d "config.policy=redis" \
  -d "config.redis_host=redis"

# Add request logging plugin
curl -X POST http://localhost:8001/plugins \
  -d name=file-log \
  -d "config.path=/tmp/kong.log"

Kong declarative config (DB-less mode, good for Kubernetes):

# kong.yaml
_format_version: "3.0"

services:
  - name: users-api
    url: http://users-service:3001
    routes:
      - name: users-route
        paths: [/api/users]
    plugins:
      - name: jwt
        config:
          claims_to_verify: [exp]
      - name: rate-limiting
        config:
          minute: 1000
          policy: redis
          redis_host: redis
          redis_port: 6379

  - name: payments-api
    url: http://payments-service:3002
    routes:
      - name: payments-route
        paths: [/api/payments]
        methods: [POST]
    plugins:
      - name: jwt
      - name: request-size-limiting
        config:
          allowed_payload_size: 1  # 1MB max

---

Nginx as API Gateway

Nginx is not purpose-built as an API gateway, but it's extremely fast and widely understood. For teams with Nginx expertise, using it as a gateway avoids learning another tool.

# /etc/nginx/conf.d/api-gateway.conf
upstream users_service {
    server users-service:3001;
    keepalive 32;
}

upstream orders_service {
    server orders-service:3002;
    keepalive 32;
}

# Rate limiting zone: 10 req/s per IP
limit_req_zone $binary_remote_addr zone=api_limit:10m rate=10r/s;

server {
    listen 80;
    server_name api.yourproduct.com;

    # JWT validation via auth subrequest
    location = /auth {
        internal;
        proxy_pass http://auth-service:3003/validate;
        proxy_pass_request_body off;
        proxy_set_header Content-Length "";
        proxy_set_header X-Original-URI $request_uri;
    }

    location /api/users {
        auth_request /auth;
        auth_request_set $auth_user_id $upstream_http_x_user_id;
        auth_request_set $auth_tenant_id $upstream_http_x_tenant_id;

        limit_req zone=api_limit burst=20 nodelay;

        proxy_pass http://users_service;
        proxy_set_header X-User-Id $auth_user_id;
        proxy_set_header X-Tenant-Id $auth_tenant_id;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        # Timeouts
        proxy_connect_timeout 5s;
        proxy_read_timeout 30s;
        proxy_send_timeout 30s;
    }

    location /api/orders {
        auth_request /auth;
        limit_req zone=api_limit burst=20 nodelay;
        proxy_pass http://orders_service;
        proxy_set_header Host $host;
    }

    # Health check (no auth)
    location /health {
        return 200 '{"status":"ok"}';
        add_header Content-Type application/json;
    }
}

Nginx rate limiting granularity:

# Per-user rate limiting (requires user ID from JWT in a header)
map $http_x_user_id $rate_limit_key {
    default $binary_remote_addr;  # Fall back to IP if no user ID
    ~.+     $http_x_user_id;
}
limit_req_zone $rate_limit_key zone=per_user:50m rate=100r/m;

---

Traefik for Kubernetes

Traefik integrates natively with Kubernetes — it reads IngressRoute custom resources and automatically discovers services. No Nginx config files to maintain.

# k8s/ingress-route.yaml
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: api-routes
  namespace: production
spec:
  entryPoints: [websecure]
  routes:
    - match: Host(`api.yourproduct.com`) && PathPrefix(`/api/users`)
      kind: Rule
      middlewares:
        - name: jwt-auth
        - name: rate-limit
      services:
        - name: users-service
          port: 3001

    - match: Host(`api.yourproduct.com`) && PathPrefix(`/api/orders`)
      kind: Rule
      middlewares:
        - name: jwt-auth
        - name: rate-limit
      services:
        - name: orders-service
          port: 3002
  tls:
    certResolver: letsencrypt

# k8s/middlewares.yaml
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: rate-limit
spec:
  rateLimit:
    average: 100
    period: 1m
    burst: 50
---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: jwt-auth
spec:
  forwardAuth:
    address: http://auth-service:3003/validate
    authResponseHeaders:
      - X-User-Id
      - X-Tenant-Id

---

Performance Comparison

Benchmarks (single-core, 100-byte response, ~2026 hardware):

In practice, backend latency (tens to hundreds of milliseconds) dominates. Gateway overhead rarely matters until you're handling > 10K req/s.

---

Cost Comparison (100M requests/month)

At high scale (> 1B requests/month), self-hosted Kong or Nginx is significantly cheaper than AWS API Gateway.

---

Working With Viprasol

We design and implement API gateway infrastructure — AWS API Gateway with Terraform, Kong in Kubernetes, Nginx reverse proxy configurations, and Traefik for Kubernetes-native routing. Gateway setup is foundational for any multi-service architecture.

→ Talk to our team about API infrastructure and microservices architecture.

---

See Also

• API Rate Limiting — rate limiting strategies beyond gateway configuration
• Microservices Architecture — when API gateways become necessary
• Kubernetes Security — securing Traefik and ingress controllers
• DevOps Best Practices — infrastructure-as-code for gateway config
• Cloud Solutions — API infrastructure and platform engineering