Front-end web and mobile services: choosing the right one

The services at a glance

The Front-End Web and Mobile category of the exam covers three services. Each one handles a different stage of building a web or mobile app: exposing the back end, building and hosting the app, and testing it on real devices. Each service name links to its own tutorial.

Service	What it does
Amazon API Gateway	The managed front door for REST (Representational state transfer)A style of web API in which resources are named by URLs and handled with standard HTTP methods, such as GET, PUT, and DELETE, and the server keeps no session state between requests. Amazon API Gateway builds REST APIs.Glossary entry, HTTP (Hypertext Transfer Protocol)The protocol that web browsers and APIs use to send requests, such as GET and POST, and receive responses. On its own it is not encrypted; HTTPS adds TLS.Glossary entry, and WebSocket API (Application programming interface)A defined way for one program to ask another for data or actions, such as a set of HTTPS requests and responses. Every AWS service is controlled through its API, which the console, the CLI, and the SDKs call for you.Glossary entry, with authorization, ThrottlingLimiting how many requests a client can make in a period. A throttled request is rejected, often with HTTP status 429 or a throttling error, and should be retried later with backoff.Glossary entry, caching, and WAF
AWS Amplify	Git-based hosting with continuous deployment, plus code-first back ends for auth, data, storage, and functions
AWS Device Farm	Tests Android, iOS, and web apps on real devices and desktop browsers hosted by AWS

How they fit together

A typical serverless web or mobile app:

The front end is built and hosted with Amplify Hosting, or with S3 and CloudFront.
Users sign in with Amazon Cognito.
The app calls an API Gateway API, authorized by a Cognito user pool, which invokes Lambda functions that read and write DynamoDB.
Before each release, Device Farm runs the tests on many real phones and browsers.

To serve the front end and the API from one host name (no cross-origin requests), use one CloudFront distribution with path-based cache behaviors: the private S3 bucket through OAC (Origin access control)The recommended way to let a CloudFront distribution read from a private S3 bucket: CloudFront signs its requests, and the bucket policy allows only that distribution. It replaces the older origin access identity (OAI).Glossary entry as the default origin, and a Regional API VPC endpointA private connection from a VPC to an AWS service or another endpoint service without crossing the internet. Gateway endpoints, for Amazon S3 and DynamoDB, are route table targets; interface endpoints are network interfaces that use AWS PrivateLink.Glossary entry for /api/*. An edge-optimized endpoint would add a second, API Gateway-managed CloudFront layer.

Reverse mindmap: from the question to the service

Front-end web and mobile: which service?

Expose the back end
- REST API in front of Lambda leads to API Gateway
- Cheapest simple API leads to API Gateway HTTP API
- Real-time two-way messages leads to API Gateway WebSocket API
- API keys and usage plans per customer leads to API Gateway REST API
- App and API on one host name leads to One CloudFront distribution, S3 and Regional API origins
Build and host the app
- Front-end team, full-stack app fast leads to Amplify
- Deploy on every Git commit leads to Amplify Hosting
- Preview each pull request leads to Amplify Hosting
Test the app
- Many real phones and tablets leads to Device Farm
- Reproduce a bug on one device model leads to Device Farm remote access
- Selenium on desktop browsers leads to Device Farm

Commonly confused pairs

If the choice is between	Choose the first when	Choose the second when
API Gateway or ALB	You need an API with auth, throttling, usage plans, or serverless back ends	You need to balance HTTP traffic across EC2 instances or containers
API Gateway or AppSync	You want REST, HTTP, or WebSocket APIs	You want a managed GraphQL API
REST API or HTTP API	You need API keys, caching, WAF, request validation, or private endpoints	You want the simplest, lowest-cost API
Amplify Hosting or S3 with CloudFront	A front-end team wants Git-based CI/CD (Continuous integration and continuous delivery)Practices in which every code change is built and tested automatically (continuous integration) and kept ready to release, often deploying it automatically through a pipeline (continuous delivery or deployment).Glossary entry with little setup	You want full control of the bucket and the distribution
Device Farm or CloudWatch Synthetics	Testing an app on real devices before release	Monitoring a live site or API with scripted checks
Device Farm or Distributed Load Testing on AWS	Testing app behavior on real devices	Load testing a back end with thousands of simulated users

Key takeaways

API Gateway exposes and protects back-end APIs; Amplify builds and hosts the app; Device Farm tests it on real devices.
"REST API in front of Lambda" points to API Gateway; "front-end developers, Git-based hosting" points to Amplify; "test on real phones" points to Device Farm.
REST APIs have the most features; HTTP APIs are cheaper; WebSocket APIs are two-way.