Popular gateways (Kong, AWS API Gateway, Nginx) in Microservices - System Design Guide

Problem Statement

When multiple microservices serve different parts of an application, clients face complexity in managing many endpoints, inconsistent security, and lack of centralized control. Without a unified entry point, it becomes hard to enforce policies, monitor traffic, and handle failures gracefully.

Solution

API gateways act as a single entry point that routes client requests to appropriate microservices. They handle cross-cutting concerns like authentication, rate limiting, logging, and load balancing centrally, simplifying client interactions and improving system manageability.

Architecture

┌───────────────┐       ┌───────────────┐       ┌───────────────┐
│               │       │               │       │               │
│    Clients    ├──────▶│  API Gateway  ├──────▶│ Microservices │
│               │       │ (Kong, AWS,   │       │  (Service A,  │
│               │       │  Nginx)       │       │   Service B)  │
└───────────────┘       └───────────────┘       └───────────────┘

This diagram shows clients sending requests to a centralized API Gateway, which routes them to the appropriate microservices.

Trade-offs

✓ Pros

→

Centralizes security and access control, reducing duplicated effort across services.

→

Simplifies client-side logic by exposing a single endpoint.

→

Enables monitoring, logging, and rate limiting in one place.

→

Supports protocol translation and request aggregation.

✗ Cons

→

Introduces a single point of failure if not highly available.

→

Adds latency due to an extra network hop and processing.

→

Can become complex to configure and maintain at scale.

Use when you have multiple microservices with diverse clients needing unified access, especially at scale above hundreds of requests per second.

Avoid if your system has only one or two services with simple access patterns or very low traffic under 100 requests per second.

Real World Examples

Netflix

Uses Nginx as an API gateway to route requests to various backend services, enabling centralized authentication and traffic management.

Amazon

Uses AWS API Gateway to expose serverless microservices with built-in security, throttling, and monitoring.

Shopify

Uses Kong to manage API traffic, enforce policies, and provide analytics across their microservices ecosystem.

Alternatives

Service Mesh

Operates at the service-to-service communication layer inside the cluster rather than at the client-to-service edge.

Use when: Choose when you need fine-grained control over internal service communication, observability, and security.

Backend for Frontend (BFF)

Creates separate backend services tailored to each client type instead of a single gateway.

Use when: Choose when different clients require highly customized APIs or data aggregation.

Summary

API gateways provide a single entry point to multiple microservices, simplifying client interactions.

They centralize common features like security, monitoring, and traffic control.

Popular gateways include Kong, AWS API Gateway, and Nginx, each suited for different environments and needs.

Practice

1. Which of the following is a primary role of API gateways like Kong, AWS API Gateway, or Nginx in microservices?

easy

A. Control and protect communication between services

B. Store large amounts of data

C. Run backend business logic

D. Replace databases in microservices

Solution

1. Step 1: Understand the role of API gateways

   API gateways act as a control point for requests between clients and microservices, managing traffic and security.

2. Step 2: Compare options with gateway functions

   Storing data, running business logic, or replacing databases are not typical gateway roles.

3. Final Answer:

   Control and protect communication between services -> Option A

4. Quick Check:

   Gateway role = Control communication [OK]

Hint: Gateways manage traffic and security, not data storage [OK]

Common Mistakes:

• Confusing gateways with databases
• Thinking gateways run business logic
• Assuming gateways store data

2. Which syntax correctly defines a route in Kong's configuration to forward requests to a service?

easy

A. routes:\n - name example-route\n path: '/example'\n service: example-service

B. routes:\n - name: example-route\n paths: ['/example']\n service: example-service

C. routes:\n - name: example-route\n paths: '/example'\n service: example-service

D. routes:\n - example-route:\n paths: ['/example']\n service: example-service

Solution

1. Step 1: Review Kong route syntax

   Kong routes use a list with keys: name, paths (as a list), and service.

2. Step 2: Identify correct YAML structure

   routes:\n - name: example-route\n paths: ['/example']\n service: example-service correctly uses a list with dash, keys with colons, and paths as a list.

3. Final Answer:

   routes:\n - name: example-route\n paths: ['/example']\n service: example-service -> Option B

4. Quick Check:

   Kong route syntax = routes:\n - name: example-route\n paths: ['/example']\n service: example-service [OK]

Hint: YAML lists need dashes and keys with colons [OK]

Common Mistakes:

• Missing colon after keys
• Using string instead of list for paths
• Incorrect indentation or dash placement

3. Given this Nginx configuration snippet, what happens when a client requests /api/users?

location /api/ {
  proxy_pass http://backend-service/;
}

medium

A. The request is forwarded to http://backend-service/users

B. The request returns a 404 error

C. The request is blocked by Nginx

D. The request is forwarded to http://backend-service/api/users

Solution

1. Step 1: Understand Nginx proxy_pass behavior with trailing slash

   When proxy_pass URL ends with a slash, Nginx replaces the matching location prefix with the proxy URL path.

2. Step 2: Apply to given example

   Location prefix is /api/, proxy_pass is http://backend-service/, so /api/ is replaced by /, forwarding /users to backend-service.

3. Final Answer:

   The request is forwarded to http://backend-service/users -> Option A

4. Quick Check:

   Trailing slash in proxy_pass removes location prefix [OK]

Hint: Trailing slash in proxy_pass removes location prefix [OK]

Common Mistakes:

• Assuming full path is appended
• Confusing proxy_pass with or without trailing slash
• Thinking request is blocked or 404

4. You configured AWS API Gateway with a resource path /items and a GET method, but requests to /items return 403 Forbidden. What is the most likely cause?

medium

A. The backend service URL is incorrect

B. The API Gateway does not support GET methods

C. The GET method is not deployed or enabled in the stage

D. The client IP is blocked by AWS firewall

Solution

1. Step 1: Check AWS API Gateway method deployment

   Methods must be deployed and enabled in the stage to accept requests.

2. Step 2: Understand 403 Forbidden meaning in API Gateway

   403 often means method exists but is not authorized or deployed, not backend URL or IP block.

3. Final Answer:

   The GET method is not deployed or enabled in the stage -> Option C

4. Quick Check:

   403 = method not deployed/enabled [OK]

Hint: Deploy methods in stage to avoid 403 errors [OK]

Common Mistakes:

• Assuming backend URL causes 403
• Thinking API Gateway disallows GET
• Blaming client IP blocking without evidence

5. You want to use Kong to route requests to two microservices: serviceA at /serviceA and serviceB at /serviceB. Which configuration approach ensures correct routing and avoids path conflicts?

hard

A. Create two routes with the same path ['/service'] for both services

B. Create one route with path ['/'] forwarding to both services

C. Use a single route with no path and rely on backend to differentiate

D. Create two routes with paths ['/serviceA'] and ['/serviceB'], each linked to their respective services

Solution

1. Step 1: Understand routing by path in Kong

   Kong routes requests based on path prefixes to the correct service.

2. Step 2: Avoid path conflicts by using distinct paths

   Separate paths like '/serviceA' and '/serviceB' ensure requests go to the right service without overlap.

3. Final Answer:

   Create two routes with paths ['/serviceA'] and ['/serviceB'], each linked to their respective services -> Option D

4. Quick Check:

   Distinct paths = correct routing [OK]

Hint: Use unique paths per service to avoid conflicts [OK]

Common Mistakes:

• Using same path for multiple services
• Relying on backend to route without gateway paths
• Using root path for all services