Search code examples
amazon-web-servicesaws-lambdaaws-sdkaws-security-group

How do we address/what are good practices for "serverless" resource abuse?


If I create a public endpoint using AWS API Gateway, the entire world could access it. This would be a problem because the end point would trigger an AWS Lambda function. If we assume that I can't query a data source to determine the frequency that the incoming IP address queried the resource in the past, what would be the best practice for protecting this end point from abuse? Do I have any other security options?

I realize I could use a reCaptcha but this would still invoke the AWS Lambda function and would incur costs if done a million times over a short window of time.


Solution

  • A very simple way of protecting your API gateway

    1. Use AWS Cloudfront with TTL 0 and pass custom headers from AWS Cloudfront to API gateway
    2. Use AWS WAF with AWS Cloudfront

    AWS API Gateway also handles some basic level of DDOS attacks.

    Kindly also view these blogs for securing AWS API Gateway

    https://aws.amazon.com/blogs/compute/protecting-your-api-using-amazon-api-gateway-and-aws-waf-part-i/

    https://aws.amazon.com/blogs/compute/protecting-your-api-using-amazon-api-gateway-and-aws-waf-part-2/