## Comparing Kong API Platform and AWS API Gateway

AWS offers its own out-of-the-box API gateways. For many AWS teams, AWS API Gateways are a natural place to start when beginning their API management and API gateway journeys. However, as API practices and programs begin to scale, many organizations begin to look beyond AWS due to major limitations, feature gaps, performance issues, and cost-effectiveness challenges.

What some organizations don’t know is that Kong, like AWS, has an AWS-native API platform offering that provides self-serve dedicated cloud gateways in AWS cloud (deployed and managed in Kong’s AWS VPC), the ability to use AWS cloud spend to acquire the Kong API platform for AWS, and comes with many important products and features that AWS currently lacks.

To help your evaluation process, we’ve written this in-depth comparison and guide that walks through the major differences between the two solutions as they pertain to core, enterprise API management, and API platform use cases.

We’ve organized this blog by covering how AWS and Kong compare across three core sets of requirements when building out your API Platform and API program:

1. - Cloud-ready API gateways
2. - Advanced gateway functionality
3. - Federated API platform

We hope this is helpful. Please [reach out](https://konghq.com/contact-sales)reach out if you have any questions.

## AWS-native cloud gateways

**Why it matters: **While both solutions offer self-serve AWS-cloud-ready API gateways, AWS will require you to be locked into AWS only on a go-forward basis. Kong offers all of the benefits on the AWS side, while also opening up the possibility to go multi-cloud with self-serve support for Azure and GCP cloud gateways as well.

• - **AWS** offers easy, self-serve API gateway provisioning — all hosted in your AWS cloud region(s) of choice. AWS allows you to deploy fully managed AWS API Gateways inside of your own VPC.
• - **Kong** also offers easy, self-serve API gateway infrastructure that can be spun up in your AWS cloud region of choice, inside of Kong’s VPC, with the ability to expose the gateway publicly or privately and optionally, securely connect to your AWS APIs and services through a transit gateway. Kong also offers the same functionality for both Azure and GCP.

## Uptime SLA

**Why it matters:** API gateways are critical infrastructure that you can’t afford to have go down. Both vendors offer a robust three 9s SLA here to bolster confidence when offloading API runtime infrastructure management onto a third party.

• - **AWS** offers a 99.95% SLA for AWS API Gateways.
• - **Kong** offers a 99.95% SLA for Konnect AWS API Gateways. (Note: Kong is targeting increasing this to a 99.99% SLA in Q2 2025.)

## Security and compliance

**Why it matters:** API gateways protect critical API assets and data, so they must be secure. Both vendors meet stringent security and compliance standards.

• - **AWS **API Gateways are SOC 2 Type 2 compliant and FedRAMP Authorized with a Provisional Authority to Operate (P-ATO).
• - **Kong **Dedicated AWS Cloud Gateways are SOC 2 Type 2 compliant. Note: Kong Enterprise Edition can be deployed on FedRAMP-authorized cloud services like AWS GovCloud.

## Deployment flexibility and intelligent routing

**Why it matters: **Deployment flexibility is essential for complying with data regulations and meeting stringent performance and high availability requirements. When working with multi-region deployments, you need to ensure consumers are being routed to the gateway that minimizes latency and performance impacts.

• - **AWS** API Gateways can be spun up across multiple global AWS regions. However, more advanced routing like setting up a global edge DNS would require additional setup, management, and costs due to requiring additional AWS services like Route 53.
• - **Kong** Dedicated API Gateways can be spun up across multiple AWS regions *and* regions in Azure and GCP. Kong has support for a smart Global DNS that provisions a DNS address that can communicate with all the clouds and regions where you’ve deployed cloud gateways. The smart DNS then automatically chooses the best region to use for each API request based on real-time performance and latency affinity. This means that implementing multi-cloud and multi-region connectivity is as easy as sending requests to the Smart Global DNS. Kong will also provision a DNS record per region if you need to selectively target a region.

## Performance and scalability: Timeouts and payload limits

**Why it matters:** APIs are the backbone of modern applications. Performance bottlenecks and technical constraints at the gateway level will result in poor user experiences. 

### Timeouts

• - **AWS** API Gateway has a number of hard timeouts. Most importantly, there is a global 29-second timeout for all APIs which is quite limiting for long-running requests (e.g. when leveraging LLMs). Note: AWS [recently announced the ability to request a longer timeout](https://aws.amazon.com/about-aws/whats-new/2024/06/amazon-api-gateway-integration-timeout-limit-29-seconds/)recently announced the ability to request a longer timeout but is unclear on what it takes to be approved or what the new limit is. It also mentions an increase "might require a reduction in your account-level throttle quota limit."
• - **Kong** has default but *fully configurable* timeouts that allow you to keep a connection open indefinitely and adapt to any use case.

### Payload limits

• - **AWS** severely limits payload size with a 10MB limit for HTTP APIs, which impacts organizations that need to move around larger amounts of data in API transactions.
• - **Kong** offers *much more* flexibility here, with a default payload size limit of 128MB. But you can also configure Kong to not enforce a payload size limit at all. In this case, the only limitations would be the resources of the underlying node the gateway is running on.

## Support for multiple API styles and protocols

**Why it matters: **When implementing an enterprise-wide API platform, platform teams want a solution that will not limit them when it comes to the kinds of APIs and data sources they can expose.

• - **AWS** offers its most robust support for HTTP-based APIs and offers limited support for WebSocket APIs.
• - **Kong** offers support for exposing multiple API styles and data sources, such as HTTP APIs, SOAP WebServices, WebSocket APIs, gRPC APIs, GraphQL APIs, Kafka event streams, and more. 

## Advanced API gateway functionality

**Why it matters**: API platform rollouts won’t be successful if those platforms can't meet the needs of all stakeholders. AWS’ limitations around gateway policies will result in certain API security, reliability, and governance use cases not being satisfied without bringing on another. 

• - **AWS** offers very barebones functionality around API security, authorization, rate limiting, and monitoring. AWS is primarily meant to be used for early-stage and simple HTTP and REST APIs use cases. Additional functionality can be added through lambda functions but that requires custom work and additional costs per execution of lambda function. 
• - **Kong** comes with over 100 plugins that cover everything from advanced rate limiting, to OIDC auth, to AI prompt protection. The vast majority of API gateway policies you need will be handled by an out-of-the-box plugin, and, for anything not covered, you can use our plugin development kit to create your own. These custom plugins have no additional costs associated with execution. 

## Advanced API security

**Why it matters: **A flexible and battle-tested security offering is a cornerstone of any enterprise API gateway. The offering should adhere to and remain up to date with industry standards and best practices while also being flexible enough to integrate with an organization’s identity and access management platform of choice.

• - **AWS** has native support for authN and authZ when using their own tooling — AWS IAM (authZ) and AWS Cognito (authN) — but API security becomes a major headache beyond that. For example, if you want to work with third-party identity providers, you have to write custom lambda authorizers to integrate with those solutions. Not only does this result in more custom work, it results in more AWS spend, as each lambda execution incurs cost, and more concerningly, results in a significantly more error-prone approach to security.
• - **Kong** supports industry-standard authorization flows and functionality, advanced rate limiting, threat protection, injection protection, and more. Also, Kong comes with out-of-the-box support for integration with OIDC-compliant, third-party identity providers.

## Advanced analytics and debugging

**Why it matters: **One of the core benefits of implementing an enterprise gateway is increased visibility into all aspects of your API operations to easily identify long-term trends and reduce time to resolution for any incident.

• - **AWS** API Gateway has support for capturing metrics and logs through an integration with AWS Cloudwatch and supports tracing through an integration with AWS Xray. However, organizations utilizing dedicated observability/SIEM tooling will be double charged as metrics and logs must first be imported into AWS Cloudwatch.
• - **Kong** Konnect comes with advanced analytics solutions out of the box, advanced debugging and tracing solutions, and integrates with your chosen monitoring and observability solutions over the modern OTEL standard if you want to centralize all monitoring in something like Grafana, Datadog, Prometheus, etc.

## Self-serve API gateway infrastructure

**Why it matters:** Federated platforms must offer distributed engineering teams, such as Rabobank’s, to self-serve their own API infrastructure. 

• - **AWS** offers self-serve provisioning of AWS API gateway infrastructure. However, these gateways are all tied to a single control plane making it significantly more challenging to isolate teams and environments and build out a truly federated and multi-tenant API platform.
• - **Kong** offers easy self-serve API gateway infrastructure, either self-hosted or managed by Kong in AWS, Azure, or GCP. Kong also has robust support for multi-tenancy through granular RBAC controls and fully isolated control planes that can be assigned to teams and/or development environments.

## Self-serve service mesh infrastructure

**Why it matters: **Organizations often have multiple API runtime infrastructure requirements. While an API gateway may satisfy some of them, service mesh is the gold standard for service-to-service communication, and only Kong offers a platform that enables self-serve service mesh and API gateway provisioning.

• - **AWS** used to offer a service mesh solution with AWS App Mesh, but this has since been deprecated. [According to AWS](https://aws.amazon.com/blogs/containers/migrating-from-aws-app-mesh-to-amazon-ecs-service-connect/?sc_icampaign=aware_serviceconnect-migration&sc_ichannel=ha&sc_icontent=awssm-1933077_aware&sc_iplace=ribbon&trk=cc67cc72-77dc-41ba-aebb-2d8c6d81ad5b~ha_awssm-1933077_aware~ha_awssm-1933077_aware)According to AWS: "New customer sign-ups and account upgrades are no longer available for AWS App Mesh."
• - **Kong** offers — in addition to your AWS API gateways — Kong Mesh, an enterprise, turnkey service mesh solution for managing service-to-service communication. Your mesh runtime instances can be managed and governed in the same platform as your API gateway instances as well. 

## Self-serve ingress controller infrastructure

**Why it matters:** Having an ingress controller that can be managed as part of your API platform means you can have confidence that your API platform will always offer the best possible Kubernetes runtime infrastructure.

• - **AWS** offers an open source ingress controller. 
• - **Kong**’s Kubernetes Ingress Controller is a best-in-class runtime solution for managing external access to your Kubernetes clusters. Like the API gateway and service mesh, these can also be managed from within the Konnect management console.

## Developer portal and API consumer discovery

**Why it matters: **A developer portal is table stakes for any enterprise-grade API platform. Organizations need a portal that accelerates time to market by supporting multiple API protocols, works across clouds and runtimes, enables self-service onboarding, and provides unified analytics to drive API reuse and governance.

• - **AWS** offers a managed developer portal, but it only supports REST APIs in a single AWS Region and is tightly coupled to AWS-native services like Cognito for identity and CloudWatch for analytics.
• - **Kong** offers a best-in-class, cloud-agnostic developer portal with broad IdP support, centralized analytics, support for multiple API protocols, OpenAPI and AsyncAPI documentation, and more.

## Service catalog and internal API discovery

**Why it matters: **If you don’t know which APIs and services are running, how they are secured and made reliable, and who owns them, it’s impossible to know whether your API landscape is actually secure, reliable, and performant.

• - **AWS** API Gateway does not offer a service catalog offering.
• - **Kong** Konnect’s Service Catalog is a single source of truth for internal service discovery, inventory, and governance. You can see every API and service under Kong runtime management, discover APIs running behind third-party API infrastructure, and add important content to each service through integrations with third-party vendors such as PagerDuty, Datadog, and more.

## Admin API

**Why it matters: **An Admin API is typically the first place organizations start when automating their API management operations. Without a properly documented, fully featured Admin API, infrastructure and platform teams will struggle to implement APIOps effectively.

• - **AWS** has two separate reference APIs — one for REST APIs and the other for WebSocket and HTTP APIs. 
• - **Kong**'s Admin API works for all supported versions of Kong control planes and data planes, is well-documented, and is easy to start with.

## Kubernetes operator

**Why it matters: **For teams that want to manage their API platform declaratively — just like they do the rest of their K8s infrastructure — a Kubernetes operator is essential. However, if the operator does not support all of the platform’s critical functionality, Kubernetes teams will never be able to make their APIOps truly Kube-native.

• - **AWS** API Gateway does not offer a Kubernetes operator.
• - **Kong** Gateway Operator is fully compliant with Kubernetes’ successor to the Ingress API — the Gateway API. By using the Kong Gateway Operator with the Gateway API, you are able to fully automate the lifecycle management of the Kong Gateway and Ingress Controller within Kubernetes.

## Non-Kubernetes declarative config

**Why it matters:** While declarative config via the Kubernetes operator is one way to do declarative management, it’s not the only way. Kong gives platform teams the ability to automate their API platform however works best for their organization.

• - **AWS** does not offer a solution for this.
• - **Kong**’s comprehensive CLI tool, decK, gives non-Kubernetes teams the ability to still manage APIOps declaratively. decK is a purpose-built tool that makes it easy to incorporate APIops across Kong’s entire platform, regardless of the deployment environment.