API Gateway

Role: API management and security enforcement layer

• Authentication/authorization (OAuth, JWT, API keys)
• Rate limiting and DDoS protection
• Request/response transformation
• API versioning and lifecycle management
• Compliance logging and audit trails
• Integration with enterprise identity providers

Choose API Gateway when…

• Exposing public/partner APIs and need built-ins: API keys, JWT/IAM auth, quotas, per-consumer throttling, request/response shaping, stages/versions.
• Serverless front doors (Lambda, Step Functions) or simple HTTP backends; want to avoid running proxies.
• You need WebSocket APIs without managing infra.
• You’ll sell/monetize or tightly govern API consumption.

Application Load Balancer (ALB)

Role: Layer 7 HTTP/HTTPS traffic distribution

• Content-based routing (path based, host based, headers)
• SSL termination and certificate management
• Health checks and failover