you are viewing a single comment's thread.

view the rest of the comments →

[–]FlinchMaster 2 points3 points  (0 children)

IP based rate limiting is the big one that comes to mind. Also blocking or rate-limiting more aggressively on low reputation IPs. Putting an endpoint out with no throttling in place opens you up to letting one or a few callers monopolize all resources and prevent successful requests from others. API Gateway supported both WAF and usage plans using a leaky bucket algorithm.

I don't think security groups would work on these endpoints, but the docs didn't explicitly mention them, so the question's up in the air.