API Gateway Cost Cuts: REST vs HTTP 2026

Updated: August 19, 2026

AWS API Gateway cost optimization comes down to five decisions: choosing HTTP API over REST API when you don't need the extra features (saves 71% per request), sizing or disabling the cache layer, moving long-tail data-transfer through CloudFront, turning off execution logging at INFO level in production, and cleaning up idle WebSocket connections. In this guide I'll walk through the 2026 pricing model, the traps that push teams from a $200/month bill to $12,000, and the Terraform and CLI snippets I lean on to keep gateway spend flat as traffic grows. If you also run Lambda behind these APIs, most of these levers compound nicely.

HTTP API is $1.00 per million requests vs REST API's $3.50. Migrate any endpoint that doesn't need API keys, WAF integration, or request validation.
API Gateway REST cache pricing is billed per hour whether or not you serve hits. A 237 GB cache costs $3,650/month, so downsize aggressively.
Data-transfer-out from API Gateway to the internet is $0.09/GB in us-east-1. Putting CloudFront in front drops it to $0.085/GB and adds free response caching.
CloudWatch execution logs at INFO level regularly cost more than the API Gateway invocations themselves. Switch to ERROR in production.
WebSocket API charges $0.25 per million connection-minutes. Forgotten mobile clients that reconnect every 30 seconds are the #1 bill spike source.
Private APIs via VPC Endpoints cost $7.20/month per endpoint per AZ. Consolidate across accounts or use REST regional if you're paying for three-AZ redundancy per service.

API Gateway pricing model in 2026

Amazon API Gateway is billed on four axes that most cost-optimization tutorials cover in isolation, but they bill together on your invoice: requests, data transfer, caching, and connections (for WebSockets). Every optimization below targets one of those axes. Understanding which is dominant in your bill is the first thing to do. Pull a Cost Explorer report grouped by USAGE_TYPE, filter by Service = API Gateway, then look at the top three line items. Most bills split roughly 60% requests, 25% cache, 10% data transfer, and 5% logs, but I've seen inverted profiles where cache is 80% because a team enabled 237 GB "just in case."

The 2026 headline prices in us-east-1 are:

HTTP API: $1.00 per million requests up to 300M, $0.90 thereafter
REST API: $3.50 per million up to 333M, tiered down to $1.51 at 20B+
WebSocket API: $1.00 per million messages + $0.25 per million connection-minutes
Cache: $0.020/hour for 0.5 GB up to $3.80/hour for 237 GB (that's $2,772/month for the largest cache)
Data transfer out: $0.09/GB (first 10 TB), $0.085/GB behind CloudFront

Regional pricing varies by roughly ±30%. Frankfurt and Sydney sit at the higher end; Ohio and Ireland at the lower. If you have multi-region APIs, this matters. A REST endpoint that costs $3.50/M in Oregon runs $4.25/M in São Paulo. Always check the official API Gateway pricing page before modeling. AWS quietly changed the WebSocket tier structure in Q3 2025, and I've seen calculators lag by months.

REST API vs HTTP API: when is the 71% saving safe?

HTTP API costs $1.00 per million requests; REST API costs $3.50. That's a 71% discount if you can migrate, and for most modern serverless workloads, you can. HTTP API was launched in 2019 specifically to strip out the enterprise features that made REST slow and expensive (SOAP, XML transformation, SDK generation) and keep only the ones a JSON microservice needs. In 2026 the feature gap has narrowed further: HTTP API now supports mTLS, JWT authorizers, custom domains, and CORS out of the box. But some things still only exist on REST.

Feature	HTTP API ($1.00/M)	REST API ($3.50/M)
Base per-million price	$1.00	$3.50
Lambda proxy integration	Yes	Yes
JWT authorizer	Yes (native)	Yes (via Lambda)
API keys & usage plans	No	Yes
AWS WAF integration	No (use CloudFront)	Yes
Request/response validation	No	Yes
Edge-optimized endpoint	No (use CloudFront)	Yes
Caching layer	No	Yes ($0.02–$3.80/hr)
Private endpoints (VPC)	No	Yes

The migration decision tree I use: if your API needs API keys for third-party partners, per-key throttling, or WAF rules attached directly to the API, stay on REST. Otherwise, migrate. WAF is the sneaky blocker. Many teams "need" it because compliance wrote it into a control, but attaching WAF to a CloudFront distribution in front of an HTTP API meets the same control at a lower blended cost. I hit this exact objection on a fintech project last year, and swapping the control interpretation shaved about $4,300/month.

Migration itself is one Terraform module change: swap aws_api_gateway_rest_api for aws_apigatewayv2_api with protocol_type = "HTTP". Route your Lambda integrations to aws_apigatewayv2_integration resources, and keep the same Lambda functions. Payload format v2.0 uses event.requestContext.http.method instead of event.httpMethod, so update handlers accordingly. That's the only real code change most teams face.

# Terraform: minimal HTTP API replacing a REST API
resource "aws_apigatewayv2_api" "orders" {
  name          = "orders-http-api"
  protocol_type = "HTTP"
  cors_configuration {
    allow_origins = ["https://app.example.com"]
    allow_methods = ["GET", "POST"]
  }
}

resource "aws_apigatewayv2_integration" "orders_lambda" {
  api_id                 = aws_apigatewayv2_api.orders.id
  integration_type       = "AWS_PROXY"
  integration_uri        = aws_lambda_function.orders.invoke_arn
  payload_format_version = "2.0"
}

resource "aws_apigatewayv2_route" "get_order" {
  api_id    = aws_apigatewayv2_api.orders.id
  route_key = "GET /orders/{id}"
  target    = "integrations/${aws_apigatewayv2_integration.orders_lambda.id}"
}

resource "aws_apigatewayv2_stage" "prod" {
  api_id      = aws_apigatewayv2_api.orders.id
  name        = "$default"
  auto_deploy = true
}

Why is my AWS API Gateway bill so expensive?

Nine times out of ten, it's one of four things. First, you're on REST when you could be on HTTP and paying 3.5x per request. Second, someone provisioned a cache tier. The smallest 0.5 GB cache is $14.40/month, the largest is $2,772/month, and both bill by the hour whether they're serving traffic or not. Third, you're getting hammered on data transfer out because your APIs return large JSON responses and there's no CloudFront in front. Fourth, you left execution logging at INFO in production, which for a busy API generates gigabytes of logs per hour at $0.50/GB ingestion plus storage.

A quick diagnostic script: pull the last 30 days of API Gateway usage grouped by USAGE_TYPE. If APIG3-Cache or APIG4-Cache lines are more than 25% of the bill, your cache is oversized. If DataTransfer-Out-Bytes is more than 15%, add CloudFront. If ApiGatewayHttpRequest volume is high but the endpoints are simple JSON reads, you're a candidate for HTTP API migration.

aws ce get-cost-and-usage \
  --time-period Start=2026-07-19,End=2026-08-19 \
  --granularity MONTHLY \
  --metrics UnblendedCost \
  --filter '{"Dimensions":{"Key":"SERVICE","Values":["Amazon API Gateway"]}}' \
  --group-by Type=DIMENSION,Key=USAGE_TYPE \
  --query 'ResultsByTime[0].Groups[*].[Keys[0],Metrics.UnblendedCost.Amount]' \
  --output table

If this reveals a bill spike, walk through our AWS bill spike triage playbook. The same process applies to API Gateway line items as to any other service.

Right-sizing the API Gateway cache

The API Gateway REST cache is the single most oversized resource I find in cost audits. Its pricing table is deceptive: developers see "0.5 GB cache" and enable it "just to help latency," not realizing the actual bill is per hour. A 237 GB cache running for a month costs $2,772, more than most teams spend on the entire API. And unlike RDS or ElastiCache, there's no scale-down window. You pay full price 24x7 whether traffic hits the cache or not.

Three rules I apply during audits:

Start at 0.5 GB, not 6.1 GB (the AWS console default). If your hit rate is above 60% at 0.5 GB, you rarely need more. Measure with the CacheHitCount and CacheMissCount CloudWatch metrics.
Cache per stage, not per API. You only need caching on prod. The dev and staging caches many teams enable via IaC modules are pure waste. Set cache_cluster_enabled = false in non-prod modules.
Prefer CloudFront caching over API Gateway caching for read-heavy public APIs. CloudFront cache is $0 for the storage. You pay only for cache-hit requests at $0.0075 per 10,000, cheaper than the API Gateway request itself.

The Terraform toggle to disable a cache in a stage that no longer needs it:

resource "aws_api_gateway_stage" "prod" {
  rest_api_id   = aws_api_gateway_rest_api.orders.id
  stage_name    = "prod"
  deployment_id = aws_api_gateway_deployment.prod.id

  cache_cluster_enabled = false
  # If you actually need cache, start small:
  # cache_cluster_enabled = true
  # cache_cluster_size    = "0.5"  # not "6.1"
}

Putting CloudFront in front of API Gateway

Honestly, this is my favorite lever because it saves money on two axes at once. First, data-transfer-out billed via CloudFront is $0.085/GB versus $0.09/GB direct, a 5% discount that compounds at scale. Second, CloudFront lets you cache 200 OK responses with a Cache-Control header for pennies compared to the API Gateway per-request charge. If your public API serves a GET /product/{id} endpoint hit by a mobile app fleet, CloudFront can absorb 90% of the traffic before it ever reaches your API Gateway invocation counter.

The setup is a CloudFront distribution with the API Gateway invoke URL as origin, an OAC (Origin Access Control) if the API accepts a signed header, and a cache policy that respects Cache-Control from the origin. Many CloudFront price-class optimizations apply here too. Pick PriceClass_100 if your users are US/EU only, saving another 15-40%.

resource "aws_cloudfront_distribution" "api" {
  enabled = true
  price_class = "PriceClass_100"

  origin {
    domain_name = replace(aws_apigatewayv2_api.orders.api_endpoint, "https://", "")
    origin_id   = "orders-api"
    custom_origin_config {
      http_port              = 80
      https_port             = 443
      origin_protocol_policy = "https-only"
      origin_ssl_protocols   = ["TLSv1.2"]
    }
  }

  default_cache_behavior {
    target_origin_id       = "orders-api"
    viewer_protocol_policy = "redirect-to-https"
    allowed_methods        = ["GET", "HEAD", "OPTIONS"]
    cached_methods         = ["GET", "HEAD"]
    cache_policy_id        = "4135ea2d-6df8-44a3-9df3-4b5a84be39ad" # CachingOptimized
    compress               = true
  }

  restrictions { geo_restriction { restriction_type = "none" } }
  viewer_certificate { cloudfront_default_certificate = true }
}

# On the Lambda side, return responses with a Cache-Control header:
# return { statusCode: 200, headers: { "Cache-Control": "public, max-age=300" }, body: JSON.stringify(product) }

WebSocket API cost traps and how to fix them

WebSocket APIs price on two axes: $1.00 per million messages and $0.25 per million connection-minutes. The connection-minute charge is the sneaky one. If a mobile app fleet with 100,000 concurrent connections stays connected 24x7, that's 100,000 × 60 × 24 × 30 = 4.32 billion connection-minutes per month = $1,080. Not catastrophic, but for chat apps where users hold connections open all day, this quickly overtakes REST/HTTP costs.

The failure mode I see most: a buggy mobile client that opens a WebSocket, silently loses network, and reconnects every 30 seconds. AWS bills each open connection minute regardless of activity, so each such client contributes 30-60x the connection-minutes of a well-behaved one. In my last project I found a single misbehaving Android build responsible for 22% of the bill. Detect these with:

# Find connections that reconnect suspiciously often
aws logs start-query \
  --log-group-name /aws/apigateway/orders-ws \
  --start-time $(date -u -v-1d +%s) \
  --end-time $(date -u +%s) \
  --query-string 'fields @timestamp, connectionId, sourceIp
                  | filter eventType = "CONNECT"
                  | stats count() as reconnects by sourceIp
                  | sort reconnects desc | limit 50'

Fixes: enable idle-connection timeouts (default is 10 minutes; drop to 5 for chat), send heartbeat pings from server side to force clients to prove liveness, and use $disconnect handlers to actively expire ghost connections in DynamoDB. For pub/sub patterns, AWS AppSync Events or IoT Core often work out cheaper than raw WebSocket APIs. It's worth benchmarking if messages are more than 10x connection minutes.

Taming CloudWatch execution and access logs

The default CloudWatch integration for API Gateway can generate more spend than the API itself. Execution logs at INFO level log the full request headers, body, response body, and IAM authorization details for every invocation. A busy API doing 500 req/s at ~2 KB per log entry generates 86 GB of logs per day. At $0.50/GB ingestion, that's $1,290/month in ingestion alone plus $0.03/GB-month storage.

Three fixes, in order of impact:

Set execution log level to ERROR in production. This alone cuts 90-95% of log volume. Keep INFO in dev/staging stages where volume is low.
Disable data tracing on production stages. Data tracing logs full request and response bodies. Useful for debugging, disastrous for PII compliance and cost.
Set a retention policy. The default is "never expire." Set retention_in_days = 30 on the log group; if compliance requires longer, ship to S3 Standard-IA at 1/25th the cost.

resource "aws_api_gateway_method_settings" "prod" {
  rest_api_id = aws_api_gateway_rest_api.orders.id
  stage_name  = aws_api_gateway_stage.prod.stage_name
  method_path = "*/*"
  settings {
    logging_level      = "ERROR"    # NOT "INFO"
    data_trace_enabled = false      # never true in prod
    metrics_enabled    = true
  }
}

resource "aws_cloudwatch_log_group" "apigw" {
  name              = "API-Gateway-Execution-Logs_${aws_api_gateway_rest_api.orders.id}/prod"
  retention_in_days = 30
}

For deeper log-cost surgery on the same account, our CloudWatch cost optimization guide covers subscription filters, log-metric filters, and moving high-cardinality logs to OpenSearch or S3.

Private APIs, VPC endpoints, and mTLS

Private REST APIs need a VPC Interface Endpoint (com.amazonaws.region.execute-api) to be reachable from inside the VPC. That endpoint costs $0.01/hour per AZ per endpoint, so $7.20/month per AZ, or $21.60/month for a 3-AZ setup. If ten teams each provision their own endpoint in the same VPC, that's $216/month for network plumbing you could have shared. Consolidate to a single VPC endpoint per VPC and grant cross-account access via resource policies on the API.

mTLS on custom domains is free (no per-request premium), but you pay the standard custom-domain price of $1.00 per domain per hour when the truststore is on S3 Standard. Move the truststore bundle to S3 Standard-IA (same latency for API Gateway's daily fetch, 45% cheaper storage). Refer to the API Gateway mTLS documentation for storage-class compatibility notes.

Terraform guardrails and budgets

Prevention beats reaction. Two guardrails I add to every API Gateway module:

A CloudWatch billing alarm scoped to API Gateway. Trip at 150% of trailing-30-day spend. This catches runaway loops (misconfigured retries, DDoS, a scheduler in a while(true) loop) before month-end.
A per-stage throttling budget. Set throttling_burst_limit and throttling_rate_limit on every stage, sized to actual peak plus 30%. This does two things: caps cost exposure per API, and gives you a clear signal (429 responses) when traffic actually exceeds forecast. You can raise the limit deliberately instead of discovering it in your bill.

resource "aws_api_gateway_method_settings" "throttle" {
  rest_api_id = aws_api_gateway_rest_api.orders.id
  stage_name  = aws_api_gateway_stage.prod.stage_name
  method_path = "*/*"
  settings {
    throttling_burst_limit = 500   # short-term burst
    throttling_rate_limit  = 200   # steady rate
    logging_level          = "ERROR"
  }
}

resource "aws_budgets_budget" "apigw" {
  name         = "api-gateway-monthly"
  budget_type  = "COST"
  limit_amount = "500"
  limit_unit   = "USD"
  time_unit    = "MONTHLY"

  cost_filter {
    name   = "Service"
    values = ["Amazon API Gateway"]
  }

  notification {
    comparison_operator        = "GREATER_THAN"
    threshold                  = 80
    threshold_type             = "PERCENTAGE"
    notification_type          = "ACTUAL"
    subscriber_email_addresses = ["[email protected]"]
  }
}

For teams that want programmatic enforcement, an Open Policy Agent rule that fails Terraform plans introducing a cache larger than 6.1 GB, or a logging_level = "INFO" on a stage named prod, catches the two most expensive mistakes before they merge. AWS also publishes cost anomaly detection for API Gateway specifically. Worth enabling from the Cost Anomaly Detection console.

Frequently Asked Questions

Is HTTP API cheaper than REST API?

Yes. HTTP API costs $1.00 per million requests vs $3.50 for REST, a 71% saving. HTTP API drops enterprise features like API keys, usage plans, direct WAF integration, and edge-optimized endpoints. If you don't need those, migrate.

Does API Gateway charge for 4xx and 5xx errors?

Yes. Both HTTP and REST APIs bill every request that reaches API Gateway regardless of the response status code, including 403 from authorizers and 429 from throttling. Only requests rejected before entering API Gateway (for example, blocked by a CloudFront WAF rule upstream) are free.

How much does API Gateway caching cost?

REST API caching bills per hour of provisioned cache, from $0.020/hr for 0.5 GB up to $3.80/hr for 237 GB, which works out to $14.40 to $2,772 per month. Cache is billed whether it serves any hits or not, and HTTP APIs do not support it.

Is CloudFront in front of API Gateway worth it?

Almost always, for public APIs. CloudFront cuts data-transfer to $0.085/GB, adds free response caching that offloads billable API Gateway requests, and gives you free AWS-managed WAF rules. The main downside is added TLS-handshake latency (~20 ms) at cold origins.

Why is my WebSocket API bill so high?

Connection-minutes are almost always the culprit. Each open WebSocket connection bills $0.25 per million minutes, so a fleet of 100,000 always-on mobile clients runs about $1,080/month. Buggy clients that reconnect every 30 seconds multiply this cost. Enforce idle timeouts and audit reconnect frequency by source IP.