A city standardizes how partners and internal services talk to the permit platform: partners need a synchronous HTTP contract, while internal services should react asynchronously. Which design matches?
Select an answer to reveal the explanation.
Short Explanation
Partners like a clean front door—REST through API Gateway. Inside city hall, pass notes with events and queues so teams aren’t glued together.
Full Explanation
Publishing a REST API with Amazon API Gateway for external partners while using event buses or queues for asynchronous internal communication matches how a city should standardize permit-platform contracts. API Gateway works for partners because they typically need a synchronous HTTP interface with authentication, throttling, versioning, and a stable resource model they can integrate against. Internally, Amazon EventBridge, SNS, or SQS works because city services should react to permit events without waiting on each other’s synchronous call chains, which keeps teams loosely coupled and resilient when one internal dependency slows down. The dual surface—sync at the civic front door, async inside city hall—is the intentional design.
Exposing only raw SQS queue URLs to external partners and requiring long-poll for every update fails by concept because partners expect an HTTP API contract, not municipal queue internals, credentials, and polling semantics that couple them to your messaging topology. Requiring every internal service to call partners over public SSH tunnels with shared passwords fails because SSH tunnels are operationally fragile, hard to audit at scale, and the wrong protocol for service-to-partner application integration. Replacing both surfaces with a single tightly coupled EC2 fleet that partners RDP into fails because interactive remote desktop access is not an API, destroys loose coupling, and creates a dangerous shared operational surface for external parties.
Exam caveat: API Gateway still needs authorizers, usage plans, and private integration choices; “REST for partners” does not excuse weak auth or unbounded throttle. Operational check: document the partner OpenAPI contract separately from internal EventBridge/SQS event schemas, and verify that internal services never require partners to know queue URLs while partner calls remain synchronous HTTPS only.