Use HTTP API exclusively. It’s 70% cheaper than REST API and faster to configure.
Don’t set up custom domains until you have paying customers. The default execute-api URL is ugly but free.
Skip WAF until you have traffic worth protecting (~1000 RPM sustained). WAF minimum is ~$5/month + $1/million requests.

Add custom domain when you have external API consumers or need stable URLs for partners.
Add WAF when you see bot traffic or abuse patterns in logs.
Consider REST API only if you now need request validation, API keys for usage plans (monetizing your API), or caching.

Trap	Impact	Fix
REST API “just in case”	3.5x cost vs HTTP API ($3.50 vs $1.00 per million)	Start HTTP API, migrate only specific routes that need REST features
Uncached Lambda authorizer	Authorizer invoked on EVERY request — doubles your Lambda bill	Set 300s TTL cache; a user making 20 requests/min triggers 1 authorizer call instead of 20
4xx from bad clients	You still pay for invalid requests	Add rate limiting early; monitor 4xx rate
REST API caching left on unused	$14.40/month minimum (0.5GB cache) even with zero hits	Only enable caching on routes with >100 RPM and cacheable responses

Don’t add API Gateway at all if you’re using a single Lambda behind CloudFront. Lambda function URLs are free and CloudFront handles caching/custom domains. API Gateway adds cost with no value for simple cases.
Skip request validation in API Gateway. Validate in your Lambda instead — it’s easier to test, debug, and change. API Gateway validation errors produce cryptic messages for your API consumers.
The 29-second timeout is actually your friend. If you’re hitting it, your architecture is wrong. Use it as a forcing function to move to async patterns (SQS + webhook) which scale better anyway.

Trigger ANY of these:

You need to monetize your API with usage plans and API keys for billing
You need WAF integration (bot protection, geo-blocking, rate limiting by IP)
You need request body validation at the gateway level (compliance requirement)
You have >50 routes and need VTL transforms to avoid Lambda invocations on simple mappings

If none apply at $10M ARR, you probably never need REST API.

references/api-gateway.md