## Kong Gateway Configuration ### Rate Limiting Plugin ```yaml plugins: - name: rate-limiting config: minute: 100 hour: 1000 policy: redis redis_host: redis.internal fault_tolerant: true hide_client_headers: false - name: key-auth config: key_names: - api-key - x-api-key hide_credentials: true - name: cors config: origins: - "https://app.example.com" methods: - GET - POST - PUT - DELETE headers: - Authorization - Content-Type max_age: 3600 ``` ### JWT Authentication ```lua -- custom JWT validation plugin local jwt = require "resty.jwt" local _M = {} function _M.access(conf) local token = ngx.var.http_authorization if not token then return kong.response.exit(401, { message = "Missing token" }) end -- Remove "Bearer " prefix token = token:gsub("Bearer ", "") -- Verify JWT local jwt_obj = jwt:verify(conf.secret, token) if not jwt_obj.verified then return kong.response.exit(401, { message = "Invalid token" }) end -- Set headers for upstream ngx.req.set_header("X-User-ID", jwt_obj.payload.sub) ngx.req.set_header("X-User-Role", jwt_obj.payload.role) end return _M ``` ## AWS API Gateway with Terraform ```hcl resource "aws_api_gateway_rest_api" "api" { name = "production-api" endpoint_configuration { types = ["REGIONAL"] } } resource "aws_api_gateway_resource" "users" { rest_api_id = aws_api_gateway_rest_api.api.id parent_id = aws_api_gateway_rest_api.api.root_resource_id path_part = "users" } resource "aws_api_gateway_method" "users_get" { rest_api_id = aws_api_gateway_rest_api.api.id resource_id = aws_api_gateway_resource.users.id http_method = "GET" authorization = "COGNITO_USER_POOLS" authorizer_id = aws_api_gateway_authorizer.cognito.id } resource "aws_api_gateway_usage_plan" "standard" { name = "standard-plan" throttle_settings { burst_limit = 100 rate_limit = 50 } quota_settings { limit = 10000 period = "DAY" } } ``` ## Performance Optimization ``` CACHING STRATEGIES: ├── Edge: CloudFront / Cloudflare ├── Gateway: Redis/Memcached ├── Application: In-memory └── Cache Keys: URL + Auth context LOAD BALANCING: ├── Algorithm: Least connections ├── Health checks: /health every 10s ├── Sticky sessions: Optional └── Circuit breaker: Enabled ```