AWS API Gateway vs Kong: Managed vs Self-Hosted (2026)
By API7.ai Team
Last updated: August 2026
AWS API Gateway and Kong take opposite approaches to running an API gateway — a fully managed, AWS-only serverless service versus a self-hosted gateway you can deploy anywhere. This guide compares architecture, deployment, protocols, plugins, security, pricing, and lock-in so you can pick the right fit.
AWS API Gateway is a fully managed, serverless service that is the easiest path for APIs already inside AWS, with no infrastructure to run but no multi-cloud option. Kong is a self-hosted NGINX/OpenResty gateway with hundreds of plugins and broad protocol support that runs on any platform. The decision comes down to managed AWS convenience versus deployment flexibility and extensibility.
- APIs already running inside AWS with Lambda: AWS API Gateway
- Multi-cloud, on-prem, or Kubernetes deployment: Kong
- gRPC / L4 proxying and a broad plugin ecosystem: Kong
AWS API Gateway vs Kong at a glance
AWS API Gateway leads on managed, zero-ops convenience inside AWS; Kong leads on deployment flexibility, protocol coverage, and a large plugin ecosystem you can run anywhere.
| Dimension | AWS API Gateway | Kong |
|---|---|---|
| Best for | Zero-ops APIs inside the AWS ecosystem | Flexible, self-hosted gateway on any platform |
| Model & runtime | Fully managed, serverless AWS service | Self-hosted NGINX/OpenResty (Lua) |
| Deployment | AWS-only (regional / edge-optimized) | ✓ Any cloud, on-prem, K8s |
| Protocols | REST, HTTP, WebSocket (no gRPC/TCP/UDP) | ✓ HTTP, gRPC, TCP, TLS, UDP, WS |
| Extensibility | No plugins; Lambda authorizers + VTL | ✓ Hundreds of plugins |
| License | Proprietary managed service | Apache-2.0 core + Enterprise |
| Pricing | Usage-based (per call + data transfer) | OSS free; Enterprise/Konnect custom |
What is AWS API Gateway?
AWS API Gateway is a fully managed, serverless AWS service for REST, HTTP, and WebSocket APIs, acting as a front door to AWS backends like Lambda with usage-based pricing.
AWS API Gateway is a fully managed, serverless AWS service for creating, publishing, and securing REST, HTTP, and WebSocket APIs at scale. It acts as a front door to AWS backends such as Lambda and is billed per request, with no infrastructure to operate.
Model
Managed serverless AWS service
License
Proprietary
Best for
Zero-ops APIs inside AWS
Pros
- Fully managed — no servers, scaling, or patching to run
- Tight integration with Lambda, IAM, Cognito, WAF, and CloudWatch
- Native developer portals, API keys, usage plans, and caching (REST)
- Usage-based pricing with a 12-month free tier for new accounts
Cons
- AWS-only — no on-prem or multi-cloud deployment
- REST/HTTP/WebSocket only; no native gRPC, TCP, or UDP
- No plugin system — custom logic means Lambda authorizers and VTL
- High lock-in: configs, authorizers, IAM, and VTL are AWS-specific
What is Kong?
Kong is a self-hosted API gateway built on NGINX/OpenResty (Lua) with hundreds of plugins, broad protocol support, and an Apache-2.0 core that runs on any cloud, on-prem, or Kubernetes.
Kong is a self-hosted API gateway built on NGINX/OpenResty (Lua), backed by PostgreSQL or run DB-less, with hundreds of plugins for authentication, rate limiting, and traffic control. It deploys on any cloud, on-prem, or Kubernetes, with an Apache-2.0 open-source core.
Architecture
NGINX/OpenResty (Lua) + PostgreSQL / DB-less
License
Apache-2.0 core + Enterprise
Best for
Flexible, self-hosted gateway
Pros
- Runs anywhere: cloud, on-prem, hybrid, Kubernetes, Docker
- Hundreds of plugins; custom plugins in Lua, Go, JS, or Python
- Broad protocol support: HTTP, gRPC, TCP, TLS, UDP, WebSocket
- Open-source core (Apache-2.0) avoids cloud lock-in
Cons
- Self-hosted: you own scaling, upgrades, and the datastore
- PostgreSQL dependency in traditional mode (Cassandra removed in 3.4)
- OIDC, developer portal, and RBAC are Enterprise-only
- Enterprise / Konnect pricing is custom (contact sales)
Architecture: managed service vs self-hosted gateway
AWS API Gateway is a serverless service AWS operates for you with no access to internals; Kong is software you deploy and run yourself, with full control over the gateway and its plugins.
AWS API Gateway is fully managed: AWS handles scaling, patching, and availability, and you configure APIs through its console, SDKs, or CloudFormation. The trade-off is control — there is no plugin system and no way to inspect or modify gateway behavior beyond what AWS exposes. Custom logic runs as Lambda authorizers or VTL mapping templates, each a deployed AWS resource with its own cost and latency.
Kong is self-hosted on NGINX/OpenResty. In traditional mode it stores configuration in PostgreSQL (Cassandra support was removed in Kong Gateway 3.4); it can also run DB-less from a declarative file, or in hybrid mode with separate control-plane and data-plane nodes. That gives teams full control and broad extensibility, at the cost of operating the gateway — and, in traditional mode, a database — yourself.
Pricing
AWS API Gateway is usage-based per request plus data transfer; Kong's open-source core is free to run, while Kong Enterprise and Konnect use custom, usage-based pricing from Kong sales. Model both against your own traffic.
AWS API Gateway bills per call with no servers to pay for. REST APIs start at $3.50 per million calls and tier down to $2.80 (next 667 million) and $2.38 (beyond 1 billion), plus $0.09/GB data transfer out; HTTP APIs start at $1.00 per million requests, and WebSocket APIs bill per message and connection-minute. A 12-month free tier covers the first million calls per month for new accounts. Costs scale with traffic, and Lambda execution and CloudWatch logging are extra.
Kong's open-source core is free under Apache 2.0 — you pay only for the compute and database you run it on. Kong's commercial offerings (Kong Enterprise and the Konnect platform) use custom, usage-based pricing: the Konnect Plus tier is billed per gateway and Enterprise is "custom pricing, billed annually," with no fixed public figure — you get a quote from Kong sales. Compare both models against your expected request volume and required features.
AWS API Gateway vs Kong: feature comparison
Across architecture, deployment, protocols, plugins, security, and pricing, the two trade off managed AWS convenience versus self-hosted flexibility and extensibility.
| Feature | AWS API Gateway | Kong |
|---|---|---|
| Architecture | Fully managed, serverless AWS service; no infrastructure to run, no access to internals | Self-hosted NGINX/OpenResty (Lua); PostgreSQL, DB-less, or hybrid (control-plane/data-plane) modes |
| Deployment | AWS-only; regional or edge-optimized endpoints; no on-prem or multi-cloud | On-prem, multi-cloud, hybrid, Kubernetes, Docker; Konnect SaaS control plane |
| Protocols | REST, HTTP, and WebSocket APIs; no native gRPC, TCP, or UDP | HTTP/HTTPS, gRPC/gRPCS, TCP/TLS, UDP, and WebSocket (WS/WSS) |
| Throughput / limits | Default 10,000 RPS per account per Region across API types (+5,000 burst); increasable on request | NGINX-based, no fixed service cap; throughput depends on your nodes and plugin chain |
| Extensibility | No plugin system; custom logic via Lambda authorizers and VTL mapping templates | Hundreds of out-of-the-box plugins; some (e.g. OIDC) require Enterprise |
| Custom development | Lambda functions (any supported runtime) + VTL templates; tied to the AWS toolchain | Custom plugins in Lua, Go, JavaScript, or Python |
| Security & auth | IAM, Amazon Cognito, Lambda authorizers; AWS WAF integration; request throttling | Key auth, JWT, OAuth2, ACLs, mTLS; OpenID Connect (OIDC) is Enterprise-only |
| Observability | CloudWatch metrics and logs, AWS X-Ray tracing — all AWS-native | Prometheus, OpenTelemetry, logging plugins; some integrations are Enterprise |
| Developer portal | Native managed developer portals for your APIs | Kong Dev Portal for API docs and onboarding (Enterprise) |
| Config & CI/CD | AWS CDK, SAM, CloudFormation; first-class AWS pipelines, awkward for non-AWS tooling | decK declarative config, Kong Ingress Controller, Konnect GitOps workflows |
| Pricing model | Usage-based: REST from $3.50/million calls (tiered) + $0.09/GB out; HTTP APIs from $1.00/million | OSS core is free (you run the infra); Kong Enterprise / Konnect use custom, usage-based pricing |
| Lock-in | High — APIs, authorizers, IAM, and VTL templates are AWS-specific | Low for OSS core (Apache-2.0); Enterprise-only features tie you to Kong Inc. |
When to choose AWS API Gateway vs Kong
Choose AWS API Gateway for zero-ops APIs already inside AWS; choose Kong for multi-cloud or on-prem deployment, broad protocol support, and a large plugin ecosystem.
Choose AWS API Gateway if you…
- Your stack is already on AWS with Lambda-backed or AWS-native backends
- You want zero infrastructure to manage and usage-based billing
- You don't need gRPC/L4 proxying, a plugin system, or multi-cloud portability
Choose Kong if you…
- You need to run the gateway on any cloud, on-prem, or Kubernetes
- You want a broad plugin ecosystem and multi-protocol routing
- You prefer an open-source core and want to avoid cloud lock-in
Bottom line: if your stack lives in AWS and you want nothing to operate, AWS API Gateway is the path of least resistance; if you need to run anywhere, proxy more protocols, or extend the gateway with plugins, Kong is the more flexible choice. If you're weighing open-source, self-hosted gateways more broadly, Apache APISIX is another option worth a look — see Apache APISIX vs Kong.
Frequently asked questions
Related comparisons
AWS API Gateway vs Azure API Management · Kong vs Tyk · Apache APISIX vs Kong · All gateway comparisons
Ready to get started?
For more information about full API lifecycle management, please contact us to Meet with our API Experts.
