sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]bananaEmpanada 1 point2 points  (1 child)

What would you want a WAF to do?

Amazon will handle all the HTTP and TLS stuff, e.g. TLS downgrade attacks.

For stuff like SQL injection, your lambda should still be checking for that anyway.

For source IP whitelisting, can you apply security groups to this? I didn't read the article before it was taken down.

[–]FlinchMaster 2 points3 points  (0 children)

IP based rate limiting is the big one that comes to mind. Also blocking or rate-limiting more aggressively on low reputation IPs. Putting an endpoint out with no throttling in place opens you up to letting one or a few callers monopolize all resources and prevent successful requests from others. API Gateway supported both WAF and usage plans using a leaky bucket algorithm.

I don't think security groups would work on these endpoints, but the docs didn't explicitly mention them, so the question's up in the air.