An application will be exposed through an AWS Lambda function for hundreds of customers. Each customer must receive a configurable quota of requests over a specific time period, and quotas must reflect customer usage patterns (some customers need higher quotas for shorter periods). Which approach satisfies these requirements?

The correct approach leverages Amazon API Gateway's built-in usage plan and API key features. A REST API with a proxy integration efficiently routes requests to the Lambda function. Usage plans allow you to define specific request quotas (rate and burst) per customer, which can be tailored to their usage patterns. API keys, tied to these usage plans, provide a mechanism to identify and enforce these quotas for each customer or even individual users within a customer. Incorrect options: HTTP APIs in API Gateway do not support usage plans directly for quota enforcement as robustly as REST APIs; while they have throttling, it's not designed for per-customer quota management in the same way. Lambda function aliases and concurrency limits control the function's execution capacity, not request quotas from external clients. Function URLs also lack built-in per-customer quota enforcement. While an ALB with WAF can provide some rate limiting, it's more complex to configure and manage per-customer quotas dynamically compared to API Gateway's dedicated usage plans. WAF rules are generally for broader security, not fine-grained customer-specific quotas.