Is It Time To Consider Moving Past AWS API Gateway? 

Uptime SLA

Why it matters: API gateways are critical infrastructure that you can’t afford to have go down. Both vendors offer a robust three 9s SLA here to bolster confidence when offloading API runtime infrastructure management onto a third party.

• AWS offers a 99.95% SLA for AWS API Gateways.
• Kong offers a 99.95% SLA for Konnect AWS API Gateways. (Note: Kong is targeting increasing this to a 99.99% SLA in Q2 2025.)

Security and compliance

Why it matters: API gateways protect critical API assets and data, so they must be secure. Both vendors meet stringent security and compliance standards.

• AWS API Gateways are SOC 2 Type 2 compliant and have FedRAMP approval.
• Kong Dedicated AWS Cloud Gateways are also SOC 2 Type 2 compliant.

Deployment flexibility and intelligent routing

Why it matters: Deployment flexibility is essential for complying with data regulations and meeting stringent performance and high availability requirements. When working with multi-region deployments, you need to ensure consumers are being routed to the gateway that minimizes latency and performance impacts.

• AWS API Gateways can be spun up across multiple global AWS regions. However, more advanced routing like setting up a global edge DNS would require additional setup, management, and costs due to requiring additional AWS services like Route 53.
• Kong Dedicated API Gateways can be spun up across multiple AWS regions and regions in Azure and GCP. Kong has support for a smart Global DNS that provisions a DNS address that can communicate with all the clouds and regions where you’ve deployed cloud gateways. The smart DNS then automatically chooses the best region to use for each API request based on real-time performance and latency affinity. This means that implementing multi-cloud and multi-region connectivity is as easy as sending requests to the Smart Global DNS. Kong will also provision a DNS record per region if you need to selectively target a region.

Performance and scalability: Timeouts and payload limits

Why it matters: APIs are the backbone of modern applications. Performance bottlenecks and technical constraints at the gateway level will result in poor user experiences. 

Timeouts

• AWS API Gateway has a number of hard timeouts. Most importantly, there is a global 29-second timeout for all APIs which is quite limiting for long-running requests (e.g. when leveraging LLMs). Note: AWS recently announced the ability to request a longer timeout but is unclear on what it takes to be approved or what the new limit is. It also mentions an increase "might require a reduction in your account-level throttle quota limit."
• Kong has default but fully configurable timeouts that allow you to keep a connection open indefinitely and adapt to any use case.

Payload limits

• AWS severely limits payload size with a 10MB limit for HTTP APIs, which impacts organizations that need to move around larger amounts of data in API transactions.
• Kong offers much more flexibility here, with a default payload size limit of 128MB. But you can also configure Kong to not enforce a payload size limit at all. In this case, the only limitations would be the resources of the underlying node the gateway is running on.

Support for multiple API styles and protocols

Why it matters: When implementing an enterprise-wide API platform, platform teams want a solution that will not limit them when it comes to the kinds of APIs and data sources they can expose.

• AWS offers its most robust support for HTTP-based APIs and offers limited support for WebSocket APIs.
• Kong offers support for exposing multiple API styles and data sources, such as HTTP APIs, SOAP WebServices, WebSocket APIs, gRPC APIs, GraphQL APIs, Kafka event streams, and more. 

Advanced API gateway functionality

Why it matters: API platform rollouts won’t be successful if those platforms can't meet the needs of all stakeholders. AWS’ limitations around gateway policies will result in certain API security, reliability, and governance use cases not being satisfied without bringing on another. 

• AWS offers very barebones functionality around API security, authorization, rate limiting, and monitoring. AWS is primarily meant to be used for early-stage and simple HTTP and REST APIs use cases. Additional functionality can be added through lambda functions but that requires custom work and additional costs per execution of lambda function. 
• Kong comes with over 100 plugins that cover everything from advanced rate limiting, to OIDC auth, to AI prompt protection. The vast majority of API gateway policies you need will be handled by an out-of-the-box plugin, and, for anything not covered, you can use our plugin development kit to create your own. These custom plugins have no additional costs associated with execution. 

Advanced API security

Why it matters: A flexible and battle-tested security offering is a cornerstone of any enterprise API gateway. The offering should adhere to and remain up to date with industry standards and best practices while also being flexible enough to integrate with an organization’s identity and access management platform of choice.

• AWS has native support for authN and authZ when using their own tooling — AWS IAM (authZ) and AWS Cognito (authN) — but API security becomes a major headache beyond that. For example, if you want to work with third-party identity providers, you have to write custom lambda authorizers to integrate with those solutions. Not only does this result in more custom work, it results in more AWS spend, as each lambda execution incurs cost, and more concerningly, results in a significantly more error-prone approach to security.
• Kong supports industry-standard authorization flows and functionality, advanced rate limiting, threat protection, injection protection, and more. Also, Kong comes with out-of-the-box support for integration with OIDC-compliant, third-party identity providers.

Advanced analytics and debugging

One of the core benefits of implementing an enterprise gateway is increased visibility into all aspects of your API operations to easily identify long-term trends and reduce time to resolution for any incident.

• AWS API Gateway has support for capturing metrics and logs through an integration with AWS Cloudwatch and supports tracing through an integration with AWS Xray. However, organizations utilizing dedicated observability/SIEM tooling will be double charged as metrics and logs must first be imported into AWS Cloudwatch.
• Kong Konnect comes with advanced analytics solutions out of the box, advanced debugging and tracing solutions, and integrates with your chosen monitoring and observability solutions over the modern OTEL standard if you want to centralize all monitoring in something like Grafana, Datadog, Prometheus, etc.

Self-serve API gateway infrastructure

Why it matters: Federated platforms must offer distributed engineering teams, such as Rabobank’s, to self-serve their own API infrastructure. 

• AWS offers self-serve provisioning of AWS API gateway infrastructure. However, these gateways are all tied to a single control plane making it significantly more challenging to isolate teams and environments and build out a truly federated and multi-tenant API platform.
• Kong offers easy self-serve API gateway infrastructure, either self-hosted or managed by Kong in AWS, Azure, or GCP. Kong also has robust support for multi-tenancy through granular RBAC controls and fully isolated control planes that can be assigned to teams and/or development environments.

Self-serve service mesh infrastructure

Why it matters: Organizations often have multiple API runtime infrastructure requirements. While an API gateway may satisfy some of them, service mesh is the gold standard for service-to-service communication, and only Kong offers a platform that enables self-serve service mesh and API gateway provisioning.

• AWS used to offer a service mesh solution with AWS App Mesh, but this has since been deprecated. According to AWS: "New customer sign-ups and account upgrades are no longer available for AWS App Mesh."
• Kong offers — in addition to your AWS API gateways — Kong Mesh, an enterprise, turnkey service mesh solution for managing service-to-service communication. Your mesh runtime instances can be managed and governed in the same platform as your API gateway instances as well. 

Self-serve ingress controller infrastructure

Why it matters: Having an ingress controller that can be managed as part of your API platform means you can have confidence that your API platform will always offer the best possible Kubernetes runtime infrastructure.

• AWS offers an open source ingress controller. 
• Kong’s Kubernetes Ingress Controller is a best-in-class runtime solution for managing external access to your Kubernetes clusters. Like the API gateway and service mesh, these can also be managed from within the Konnect management console.

Developer portal and API consumer discovery

Why it matters: A developer portal should be considered table stakes for any enterprise-grade API platform, and AWS simply doesn’t have a solution here. If you want to speed up time to market and bolster the DevEx through beautifully documented, reusable APIs, Kong is your best bet.

• AWS does not offer a vendor-managed developer portal, but does offer an open source developer portal framework.
• Kong offers a best-in-class and highly customizable API developer portal that supports fine-grained customization, self-serve registration, OpenAPI and AsyncAPI documentation, and more.

Service catalog and internal API discovery

Why it matters: If you don’t know which APIs and services are running, how they are secured and made reliable, and who owns them, it’s impossible to know whether your API landscape is actually secure, reliable, and performant.

• AWS API Gateway does not offer a service catalog offering.
• Kong Konnect’s Service Catalog is a single source of truth for internal service discovery, inventory, and governance. You can see every API and service under Kong runtime management, discover APIs running behind third-party API infrastructure, and add important content to each service through integrations with third-party vendors such as PagerDuty, Datadog, and more.

Admin API

Why it matters: An Admin API is typically the first place organizations start when automating their API management operations. Without a properly documented, fully featured Admin API, infrastructure and platform teams will struggle to implement APIOps effectively.

• AWS has two separate reference APIs — one for REST APIs and the other for WebSocket and HTTP APIs. 
• Kong's Admin API works for all supported versions of Kong control planes and data planes, is well-documented, and is easy to start with.

Kubernetes operator

Why it matters: For teams that want to manage their API platform declaratively — just like they do the rest of their K8s infrastructure — a Kubernetes operator is essential. However, if the operator does not support all of the platform’s critical functionality, Kubernetes teams will never be able to make their APIOps truly Kube-native.

• AWS API Gateway does not offer a Kubernetes operator.
• Kong Gateway Operator is fully compliant with Kubernetes’ successor to the Ingress API — the Gateway API. By using the Kong Gateway Operator with the Gateway API, you are able to fully automate the lifecycle management of the Kong Gateway and Ingress Controller within Kubernetes.

Non-Kubernetes declarative config

Why it matters: While declarative config via the Kubernetes operator is one way to do declarative management, it’s not the only way. Kong gives platform teams the ability to automate their API platform however works best for their organization.

• AWS does not offer a solution for this.
• Kong’s comprehensive CLI tool, decK, gives non-Kubernetes teams the ability to still manage APIOps declaratively. decK is a purpose-built tool that makes it easy to incorporate APIops across Kong’s entire platform, regardless of the deployment environment.