Skip to content

AWS 2026-10-28 Tier 1

Read original ↗

AWS: How Revinate accelerated API adoption with Amazon API Gateway

Summary

AWS Architecture Blog customer case study. Revinate is a hospitality Customer Data Platform (CDP) that serves over 12,500 hotels and holds more than 1.25 billion guest profiles. Revinate needed to expose guest-profile and reservation data to hotel properties and partners through external APIs. Each new partner integration had needed manual provisioning and custom security work. The team compared self-managed, custom-built, and enterprise API-management platforms, and chose Amazon API Gateway plus the new managed API Gateway Portal (launched November 2025). The request path is: hotel consumer → CloudFront + WAF → API Gateway → a Lambda authorizer (OAuth 2.0 client-credentials against an external IdP, returns an IAM policy) → VPC Link → backend microservices on EKS → the CDP. The most reusable design content is the API Gateway → EKS integration decision. The team compared four options: NGINX ingress controller, AWS Load Balancer Controller Ingress, TargetGroupBinding (EKS pods registered directly in NLB target groups), and one LoadBalancer Service for each service. They chose TargetGroupBinding because it removes the ingress-controller hop. All gateway configuration (REST APIs, stages, usage plans, authorizers, and the authorizer Lambdas) is in Terraform. Usage plans and API keys give per-consumer throttling, quotas, and cost attribution. The post is a customer success story. Its outcomes are qualitative ("weeks to days" onboarding, "sub-second latency at scale"), and it gives no traffic, latency-percentile, or cost numbers.

Key takeaways

  1. Requirements first, then the build-vs-buy decision. The team mapped four business drivers (operational agility, faster partner onboarding, costs that grow with revenue, security/compliance) to four technical requirements: on-demand pricing with per-consumer cost attribution, authentication federation with the existing IdP, rate limiting, and threat protection + audit logging. It then scored self-managed, custom-built, and enterprise platforms against them. The shared problem of all three: they spend effort on non-differentiating capability. (Source: sources/2026-10-28-aws-how-revinate-accelerated-api-adoption-with-amazon-api-gateway)
  2. Four ways to connect API Gateway to EKS, scored on hops, cost, and lifecycle. (a) NGINX Ingress Controller: flexible routing and header rewrite, but an extra hop, self-managed upgrades and scaling, and non-AWS-native monitoring. (b) AWS Load Balancer Controller Ingress: AWS-managed LB lifecycle and path routing, but still API Gateway → LB → service. (c) TargetGroupBinding: pods bound directly to NLB target groups, the lowest latency, one NLB shared across many target groups, and fine-grained health-check control, but more complex setup and more AWS-specific. (d) One LoadBalancer Service per service: the simplest, but no path routing, one LB per service (costly at scale), limited observability, and TLS offload to configure. The team chose (c). See concepts/network-round-trip-cost. (Source: sources/2026-10-28-aws-how-revinate-accelerated-api-adoption-with-amazon-api-gateway)
  3. M2M auth with OAuth 2.0 client credentials and a Lambda authorizer. Partners authenticate machine-to-machine with the client-credentials grant against an external IdP. A Lambda authorizer takes the caller identity and returns an IAM policy, which API Gateway enforces before routing. The authorizer functions are also in Terraform. See concepts/oauth-token-lifecycle. (Source: sources/2026-10-28-aws-how-revinate-accelerated-api-adoption-with-amazon-api-gateway)
  4. Usage plans do three jobs: rate limiting, quotas, and cost attribution. Usage plans + API keys enforce per-consumer throttling and quota limits, which gives fair use across hotel properties and partners and protects the backend. The same per-key accounting attributes API cost to each consumer. See concepts/rate-limiting. (Source: sources/2026-10-28-aws-how-revinate-accelerated-api-adoption-with-amazon-api-gateway)
  5. Layered edge security. CloudFront (edge caching), WAF (web exploits, bots), Shield (DDoS), the API Gateway authorizer (authN/authZ), and throttling are independent layers in front of the EKS backend. CloudTrail gives the audit log and CloudWatch gives metrics. See concepts/defense-in-depth. (Source: sources/2026-10-28-aws-how-revinate-accelerated-api-adoption-with-amazon-api-gateway)
  6. The gateway is the single choke point for partner traffic. API Gateway is "the unified entry point" where auth, throttling, quotas, logging, and documentation governance are all applied. Future work extends the same choke point to inbound partner-push APIs. See patterns/central-proxy-choke-point. (Source: sources/2026-10-28-aws-how-revinate-accelerated-api-adoption-with-amazon-api-gateway)
  7. Terraform only for production. REST APIs, stages, usage plans, and authorizers are version-controlled Terraform. This gives peer review, environment consistency, and an audit trail for compliance. See concepts/infrastructure-as-code. (Source: sources/2026-10-28-aws-how-revinate-accelerated-api-adoption-with-amazon-api-gateway)
  8. A self-service developer portal is the adoption lever. The managed API Gateway Portal gives partner developers API discovery, interactive "try-it" docs, code samples, and subscription management. It also keeps documentation in one place, so there is no doc drift. Revinate reports onboarding went from weeks to days. See concepts/self-service-infrastructure. (Source: sources/2026-10-28-aws-how-revinate-accelerated-api-adoption-with-amazon-api-gateway)

Architecture

hotel property / partner (API consumer)
        │  OAuth2 client-credentials token
        ▼
CloudFront (edge cache) + AWS WAF (+ Shield)
        ▼
Amazon API Gateway (REST) ── usage plans / API keys: throttle, quota, cost attribution
        │   └─ Lambda authorizer ──► external IdP ──► returns IAM policy
        ▼  VPC Link (stays on AWS backbone)
NLB target groups ◄── TargetGroupBinding (AWS Load Balancer Controller)
        ▼
EKS pods (microservices) ──► Customer Data Platform
Observability: CloudWatch metrics/dashboards (+ 3rd-party streaming); audit: CloudTrail
IaC: Terraform for APIs, stages, usage plans, authorizers, authorizer Lambdas
Developer Portal: API Gateway Portal (discovery, try-it docs, subscriptions)

Systems / concepts / patterns extracted

Operational numbers

  • 12,500+ hotels; 1.25B+ guest profiles; $24B lifetime direct revenue (business-scale figures, not API traffic).
  • Partner onboarding: "weeks to days" (qualitative).
  • Latency: "sub-second latency at scale" for the TargetGroupBinding path. No percentiles are given.
  • Tiered pricing "from tens to hundreds of customers". No dollar figures.

Caveats

  • This is a customer success / vendor story co-written by AWS SAs and a product manager. All outcomes are qualitative.
  • No request rates, latency distributions, throttle values, authorizer cache TTL, or cost baselines are given.
  • The post does not explain how one NLB shared across target groups works with a VPC Link per application ("different applications will need individual NLB" is listed as a con).
  • The post says Lambda authorizers return IAM policies, but it does not say if authorizer-result caching is on, or what that does to revocation latency.
  • API Gateway caching and request/response transformation are future work, not part of the current design.

Source

Last updated · 854 distilled / 2,448 read