CODEWITHSUNDEEP
amazon-web-servicesaws-api-gateway
Vlad K
Vlad K

Reputation: 2851

AWS API Gateway: limit requests from a single IP

Does AWS API Gateway allows limiting a number of requests from a single IP?

I'm building a public API and would like to prevent it from being abused by establishing a limit on a number of times the API can be called from a single IP address (like 100 requests per minute).

Thanks,

Upvotes: 43

Views: 25530

Answers (2)

Señor Carranza
Señor Carranza

Reputation: 83

Check this guide for implementing WAF Rate Based Rules, which act based on source IP.

To implement WAF Rate Based rules you can do the following:

  1. Open the AWS WAF console.

  2. Select Web ACLs.

  3. Select the web ACL and then select the Rules tab.

  4. Select Add rules.

  5. Select Add my own rules and rule groups.

  6. Select Rule builder for the Rule type.

  7. Enter a Name and select Rate-based rule as the Type.

  8. Enter the following parameters for the Request rate details:

    • Rate limit: Enter a number between 100 and 20,000,000. This is the maximum number of requests allowed for every IP in a 5-min period.
    • Evaluation Window: This is the amount of time to count requests against the aggregation criteria. Example: count all requests from IP x for 60 seconds or 5 minutes
    • Request Aggregation: This is how AWS WAF will aggregate the request together. For example, all requests from a specific IP or to a given URI.
      • To aggregate requests from the same source IP, choose Source IP address.
    • Criteria to count request towards rate limit: You can chose "Consider all requests" or "Only consider requests that match the criteria in a rule statement". If you choose "Only consider requests that match the criteria in a rule statement", you can define the criteria to match. For example, match a specific URI to implement rate limiting for the given URI from the same source IP.

  9. In the Action section, select Block.

  10. Select Add rule. Move the rule to the correct priority for your use case and then select Save.

API Gateway also does have the ability to throttle requests. However, it is based on API Keys and not source IP. For more information on API Gateway throttling the links below may be helpful.

Upvotes: 2

Piyush Patil
Piyush Patil

Reputation: 14543

AWS API Gateway does not offer the functionality that you are looking for but there is a workaround.

What you can do is Integrate AWS API gateway with AWS Cloud Front and use AWS Web Application Firewall Rules to limit the API call from a Specific IP address.

Check this Guide for implementing the WAF. http://docs.aws.amazon.com/waf/latest/developerguide/tutorials-rate-based-blocking.html

Upvotes: 34

Related Questions