Partner cities must call a municipal REST API with throttling and API keys without the platform team managing custom reverse proxies. Which service should front the API?
Select an answer to reveal the explanation.
Short Explanation
API Gateway is the city’s permit window with a line quota and visitor badges (API keys). CloudFront caches content, Direct Connect is a fat pipe, and SNS is messaging—not a managed REST front door with throttle plans.
Full Explanation
Amazon API Gateway is the managed front door for partner cities calling a municipal REST API when the platform team needs throttling and API keys without building custom reverse proxies. API Gateway publishes REST endpoints, attaches usage plans and API keys, enforces stage-level throttles, and integrates with backends (Lambda, HTTP, AWS services) so partner onboarding is configuration rather than proxy fleet operations.
CloudFront alone without an origin API fails by concept because edge caching does not replace an application API layer with usage plans and request throttling semantics for partners. AWS Direct Connect circuits terminated on each partner laptop for every API call fails because Direct Connect is private network connectivity at site scale—not a per-laptop API front door with keys and throttles. Amazon SNS HTTP subscriptions as the only way to expose REST resources fails because SNS is a pub/sub messaging service, not a managed REST API gateway with partner API key plans.
Exam caveat: Partner REST + throttling + API keys → API Gateway usage plans. Do not confuse CDN (CloudFront), private networking (Direct Connect), or messaging (SNS) with an API management plane.
Operational check: Verify usage plans and API keys are issued per partner, throttle and quota limits match agreements, access logging captures caller identity, and backends are reached only through the gateway. If partners still hit ad-hoc proxies without keys, the managed control plane is missing.