How does AWS API Gateway handle rate limiting compared to Kong?

AWS API Gateway provides built-in usage plans and API keys with rate limits and quotas enforced at the AWS edge. Kong offers granular rate-limiting plugins (local and Redis-backed distributed rate limiting) configurable per consumer, route, or service.

Can AWS API Gateway run custom Lua scripts for security filtering?

No. AWS API Gateway does not support Lua. To implement custom inline inspection or security filtering, developers must invoke AWS Lambda request authorizers or proxy requests to backend compute.

What are the hidden costs of self-hosting Kong Gateway?

While Kong open source software has no licensing fee, self-hosting incurs infrastructure costs (EC2, Kubernetes nodes), operational overhead for patching, database maintenance (PostgreSQL/Cassandra for configuration storage), and monitoring setup.

Which gateway provides lower proxy latency?

Kong Gateway typically exhibits lower p99 latency overhead because it runs directly on optimized Nginx/OpenResty instances within your VPC or cluster, avoiding multi-tenant routing hops inherent in managed cloud services.

Kong API Gateway vs. AWS API Gateway: Technical & Cost Architecture Decision

Question: Should a software engineering team implement API rate limiting and security filtering using 'Kong API Gateway' or 'AWS API Gateway', considering proxy latency overhead, custom Lua plugin extensibility, and requests-per-month pricing models?

Prepared by the ChoiceScore Research Desk · Editor-approved for the curated library · Reviewed July 26, 2026

It depends Choice Score: 78/100

Direct answer

Choose Kong API Gateway if your engineering team requires ultra-low latency, custom Lua plugin extensibility, and multi-cloud portability, or AWS API Gateway if you prioritize a fully managed, serverless operational model within the AWS ecosystem.

Summary

Selecting an API gateway dictates your infrastructure cost scaling, operational burden, and extensibility for security policies and rate limiting. AWS API Gateway provides a fully managed, zero-maintenance service billed per request with generous free tier benefits, making it ideal for teams embedded in AWS. Conversely, Kong Gateway delivers exceptional proxy performance and granular customization via Lua plugins, suiting multi-cloud or high-throughput environments where custom logic is paramount.

Choice Score breakdown

Extensibility & Customization 90/100 — Kong excels via Lua and declarative configuration; AWS relies on native integrations and Lambda authorizers.
Operational Simplicity 85/100 — AWS API Gateway is fully managed with no servers to patch; Kong requires infrastructure deployment and maintenance.
Cost Efficiency at Scale 75/100 — AWS request-based pricing can scale steeply at high volumes; self-hosted Kong optimizes compute utilization.
Proxy Latency Overhead 82/100 — Kong's Nginx/OpenResty foundation offers minimal p99 latency overhead when properly tuned.

Best for / Not best for

Best for

Teams wanting zero infrastructure management (AWS API Gateway)
Engineers requiring custom Lua-based plugins for rate limiting and security (Kong)
Multi-cloud or hybrid architecture deployments (Kong)

Not best for

Organizations without dedicated platform engineers to manage self-hosted gateways (Kong)
Strict serverless shops with unpredictable multi-cloud requirements (AWS API Gateway)

Scenarios

High-Volume Enterprise Scale (100M Requests/Month) (40% likely)
An enterprise application handling 100 million requests per month with custom security filtering rules.
Serverless AWS-Centric Startup (45% likely)
An agile startup building entirely on AWS Lambda and DynamoDB with under 1 million monthly requests.
Hybrid Multi-Cloud Enterprise (15% likely)
A company deploying microservices across AWS, Azure, and on-premises Kubernetes clusters.

Calculations

Metric	Result	Formula
AWS API Gateway Estimated Monthly Cost	31.50 USD / month (excluding data transfer)	(total_requests - free_tier_requests) * cost_per_request
Kong Self-Hosted Infrastructure Cost	150.00 USD / month	instance_monthly_cost * required_replica_count
Estimated Proxy Latency Overhead Differential	-8 ms (Kong is faster)	kong_latency_ms - aws_latency_ms

Pros & cons

Pros

AWS API Gateway: Fully managed service requiring zero infrastructure provisioning, patching, or scaling overhead.
AWS API Gateway: Deep native integration with AWS IAM, Lambda, Cognito, and CloudWatch.
Kong API Gateway: Exceptional execution speed and low proxy latency via Nginx and OpenResty core.
Kong API Gateway: Powerful extensibility using custom Lua plugins for tailored security and rate-limiting rules.
Kong API Gateway: Multi-cloud and hybrid deployment flexibility without vendor lock-in.

Cons

AWS API Gateway: Request-based pricing can become expensive at massive enterprise traffic scales.
AWS API Gateway: Custom authorizers and security logic require external AWS Lambda calls, adding latency.
Kong API Gateway: Requires dedicated engineering effort to manage, upgrade, and monitor infrastructure nodes.
Kong API Gateway: Steeper initial learning curve for configuring declarative files, databases, and plugins.

Assumptions

AWS Free Tier Limit: 1,000,000 requests/month — Official AWS API Gateway pricing tier for REST and HTTP APIs during the initial free tier eligibility window.
Kong Infrastructure Baseline: 2 vCPU / 4 GB RAM instances — Standard production sizing recommendation for handling moderate API gateway traffic loads with SSL termination.
Custom Lua Extensibility: Required for bespoke security filtering — Kong supports native Lua execution in the request lifecycle; AWS requires external Lambda authorizers.

Practical next steps

Audit your current monthly API request volume and peak concurrency patterns.
Evaluate your cloud architecture strategy to determine if you are exclusively on AWS or multi-cloud.
Determine whether standard rate limiting and throttling suffice or if you require custom Lua scripting logic.
Calculate projected 12-month operational costs comparing managed AWS pricing vs. self-hosted compute instances.
Perform a proof-of-concept (PoC) measuring p99 proxy latency and developer onboarding velocity for your chosen gateway.

Methodology

Evaluated architectural trade-offs by analyzing official AWS pricing documentation, Kong product specifications, proxy latency characteristics, plugin extensibility models, and operational resource requirements to formulate a comprehensive comparison report.

Sources

Sources support specific claims; they do not replace our analysis. Read the research and source standards.

FAQ

How does AWS API Gateway handle rate limiting compared to Kong?: AWS API Gateway provides built-in usage plans and API keys with rate limits and quotas enforced at the AWS edge. Kong offers granular rate-limiting plugins (local and Redis-backed distributed rate limiting) configurable per consumer, route, or service.
Can AWS API Gateway run custom Lua scripts for security filtering?: No. AWS API Gateway does not support Lua. To implement custom inline inspection or security filtering, developers must invoke AWS Lambda request authorizers or proxy requests to backend compute.
What are the hidden costs of self-hosting Kong Gateway?: While Kong open source software has no licensing fee, self-hosting incurs infrastructure costs (EC2, Kubernetes nodes), operational overhead for patching, database maintenance (PostgreSQL/Cassandra for configuration storage), and monitoring setup.
Which gateway provides lower proxy latency?: Kong Gateway typically exhibits lower p99 latency overhead because it runs directly on optimized Nginx/OpenResty instances within your VPC or cluster, avoiding multi-tenant routing hops inherent in managed cloud services.

Related decisions

Disclaimers

Pricing figures for AWS API Gateway and cloud infrastructure are based on published public tiers and subject to change by respective cloud vendors.

Latency benchmarks and performance metrics can vary significantly based on payload size, SSL/TLS termination overhead, and underlying server configuration.