api-gateway

Add the rate-limiting plugin to a Kong service with minute and hour thresholds and set policy to redis for distributed enforcement across gateway nodes. Enable fault_tolerant so traffic is not blocked if Redis becomes unavailable.

Create a CognitoUserPoolsAuthorizer attached to your Cognito user pool and set authorizationType to COGNITO on each method. The gateway validates the JWT from the Authorization header before invoking the Lambda backend.

Kong suits Kubernetes environments needing declarative config and rich plugins, AWS API Gateway fits serverless Lambda backends with managed WAF and usage plans, and Nginx works for simpler reverse proxy needs with auth_request JWT validation.

No. The gateway should validate credentials and then strip the Authorization header, injecting user context via trusted headers like X-User-ID instead. This prevents raw tokens from propagating to internal services.

Skip a gateway for a single service with simple needs, where an Nginx reverse proxy suffices. For internal service-to-service communication, a service mesh is a better fit than routing traffic through a gateway.

Request bodies often contain PII and credentials, so logging them creates compliance and security risks. Log structured metadata like method, path, status, and duration instead, enabling body logging only for targeted debugging.