gRPC, GraphQL, Protobuf, and API Contracts on AWS
Quick summary: Protobuf on the wire saves bytes, and GraphQL saves round trips until resolvers N+1 your Aurora cluster. ALB gRPC, AppSync, and consumer-driven contracts with Pact.
Key Takeaways
- Protobuf on the wire saves bytes, and GraphQL saves round trips until resolvers N+1 your Aurora cluster
- As of June 2026, ALB supports gRPC over HTTP/2 to targets, and health checks need gRPC-specific config
- AppSync hosts GraphQL with resolver mapping to Lambda/DynamoDB
- Idempotency keys HTTP header at API Gateway plus a DynamoDB store is required for payment mutations regardless of protocol
- Benchmark protobuf vs JSON on your hottest endpoint, and measure CPU, not just bytes
Table of Contents
As of June 2026, ALB supports gRPC over HTTP/2 to targets, and health checks need gRPC-specific config. AppSync hosts GraphQL with resolver mapping to Lambda/DynamoDB.
Symptoms, mechanisms, and AWS controls
| Production symptom | Mechanism | AWS control |
|---|---|---|
| GraphQL N+1 resolver latency | Sequential data fetches per field | AppSync pipeline resolvers, batch loaders |
| Proto breaking changes in prod | Unversioned contract evolution | Buf breaking-change CI, ALB gRPC with versioned packages |
| Large JSON payloads | Text serialization overhead | gRPC + protobuf on NLB/ALB HTTP/2, API Gateway REST for external |
My recommendation: gRPC/protobuf east-west, REST/JSON north-south, and GraphQL only when multiple clients need different field shapes. Don’t put GraphQL across your microservices mesh.
Protocol choice
| Protocol | Wins | AWS surface |
|---|---|---|
| gRPC + protobuf | Streaming, typed contracts | ALB → ECS/EKS |
| GraphQL | Flexible reads | AppSync |
| REST + JSON | Ubiquitous | API Gateway HTTP API |
N+1 problem: GraphQL runs resolvers per field. Batch with DataLoader pattern or AppSync pipeline resolvers.
Schema evolution
Protobuf: reserve fields, never reuse numbers. GraphQL: deprecate fields before removal. Run Pact consumer contracts in CI for internal microservices.
Idempotency keys
HTTP Idempotency-Key header at API Gateway plus a DynamoDB store is required for payment mutations regardless of protocol.
AWS services map
| Need | Service | Skip when |
|---|---|---|
| Internal typed RPC | ECS/EKS gRPC behind ALB HTTP/2 | Public browser clients needing REST |
| Federated GraphQL | AppSync | Simple CRUD with no client-driven queries |
| Contract governance | Protobuf + Schema Registry on MSK | Two-service integration with shared DTO |
What to do this week
- Benchmark protobuf vs JSON on your hottest endpoint, and measure CPU, not just bytes.
- Trace GraphQL resolver count per query in AppSync logs.
- Add breaking-change check in CI for
.protofiles.
More in this track
Part of the Engineering Guides library (June 2026).
- Previous: Part 2
- Next: Part 4
- Browse tracks: Engineering Guides hub
What this guide doesn’t cover
OAuth is covered in part 1 of the API track.
Frequently asked questions
When should I not put GraphQL on the service mesh?
Does ALB gRPC health checking work like HTTP?
How do I evolve protobuf without breaking consumers?
Do I still need idempotency keys on gRPC mutations?
AWS Cloud Architect & AI Expert
AWS-certified cloud architect and AI expert with deep expertise in cloud migrations, cost optimization, and generative AI on AWS.
