Amazon API Gateway - Intentional attacks for costs raising

Question

I'm new to AWS and would like to deploy a microservice on Amazon Web Services. The function code shall be in AWS Lambda and this functions shall be triggered through AWS API Gateway.

My lambda functions itself are protected via authorization. Furthermore, the number of authorised requests are within the free tier.

Now my questions:

• Can unauthorised attacks to Amazon API Gateway let the costs explode?
• Can i prevent my Amazon API Gateway from such attacks?
• Can i set a costs limit and shut the API off, in case of too high bills?
• Are intentionally API attacks common?

Thanks

Answer 1

Can unauthorized attacks to Amazon API Gateway let the costs explode?

Yes. This can happen.

Can I prevent my Amazon API Gateway from such attacks?

You can use a web application firewall to reduce these malicious attacks using AWS WAF.

• Setup AWS CloudFront integrated with AWS WAF in front of API Gateway.
• Enabling API Keys in API Gateway so that direct access to API Gateway without the API Key is not possible. You can create use an API Key in Origin Headers in CloudFront so that for requests forwarded to API Gateway uses this API Key in headers.

Can I set a costs limit and shut the API off, in case of too high bills?

You can enable throttling so that very high peaks of traffic will be throttled for API Gateway reducing Cost Peaks (The negative side of this is that it affects the quality of service for real users). However, if you need to implement shutting down the API based on request rate, it's not directly supported with API Gateway. You need to do a custom implementation for this.

Are intentionally API attacks common?

I haven't seen much attacks for the APIs I deployed so far. Having said that it can be very subjective based on the nature of your business & etc. However, I have seen Bot based invocations more often. When you are using AWS WAF you can implement a Honey Pot easily to prevent these. Example code is available in AWS Labs in Github for Bad Bot Blocking to connect with WAF.