12

I'm building a serverless application with AWS Lambda and API Gateway. In order to prevent DDOS attacks doing a large number of requests costing me lots of money, I've set up a usage plan with a request quota (e.g. 10K requests/month). This requires an API key to be passed as header by callers.

This seemingly works well, but I also need to enable CORS for this service. For that I need to allow for an unauthorized OPTIONS request ("CORS preflight" request) as browsers don't support sending any special header there. But then I can't seem to find a way for enforcing a quota and I'm back to square one: an uncontrolled number of those requests could cost an unforeseeable amount of money. Is there any way to exclude this possibility?

2 Answers 2

6
+100

To enforce a quota on OPTIONS requests, create a web ACL in AWS WAF & associate it to a stage of your API in API Gateway. Add a rate-based rule in the web ACL that blocks all OPTIONS requests beyond the rate limit you specify. Rules in web ACLs can be configured specifically for this, as shown below:

enter image description here enter image description here

For a screenshot-guided tutorial of this entire process, see my blog post.

10
  • Thanks a lot for the extensive response. This still would not prevent a distributed DOS attack, though. I take it there's no way to prevent that?
    – Gunnar
    Jul 9, 2020 at 12:50
  • @Gunnar Say a million bots attack your API. If you could detect that a DDoS attack is underway, would you shut down the entire API for everyone, or would you try to block just the bad actors? Obviously, you don't want to block legitimate customers just because some bad actors decided to play havoc with your API. So the only way to stop a DDoS attack is by blocking traffic from individual IPs. That's exactly how AWS's own automated WAF solution does it too — AWS WAF Security Automations.
    – Harish KM
    Jul 9, 2020 at 15:46
  • Ah, that's a great question, and I should have more clearly specified my use case. This is for a personal project, so in my case I'd indeed rather shut down the entire service for everyone, once reaching a given level of spending. As there's no way to cap spending like that, I looked into limiting requests, and I thought a usage plan would get me there, but then I noticed the OPTIONS loophole. Seems like WAF is as close as it gets to what I'd actually want.
    – Gunnar
    Jul 10, 2020 at 7:06
  • 1
    @Gunnar You can create an AWS budget specific to API Gateway. Have this budget send a notification to an SNS topic. Subscribe a Lambda function to this SNS topic. Shutdown your API from this Lambda function by setting your API's stage's method throttling limits to 0. For a detailed step-by-step guide to implement this entire process, please see my blog post.
    – Harish KM
    Jul 10, 2020 at 15:29
  • that sounds like a viable approach. Thank you so much, highly appreciating your extensive reply.
    – Gunnar
    Jul 10, 2020 at 18:13
4

You are not paying for any unauthorized calls to API-Gateway. AWS is picking up this charge. You are paying after the request is authorized and only if it does not exceed your usage plan.

So if somebody is doing a DDOS on your API without authentication it is free of charge.

If somebody is doing a DDOS with a valid api key you will only pay until your usage plan is exceeded.

Find more information here.

  • Requests are not charged for authorization and authentication failures.

  • Calls to methods that require API keys are not charged when API keys are missing or invalid.

  • API Gateway-throttled requests are not charged when the request rate or burst rate exceeds the preconfigured limits.

  • Usage plan-throttled requests are not charged when rate limits or quota exceed the preconfigured limits.

So make sure to have authentication enabled on your API and a usage plan in place for all the authenticated requests.

8
  • 2
    It's possible for someone to continuously send an unlimited number of HTTP OPTIONS requests to the API. CORS requires that OPTIONS should be unprotected, i.e., no authN & authZ. So OPTIONS requests will be billed as the API Gateway returns the stock/mock response of HTTP 200 with CORS headers for every incoming OPTIONS request!
    – Harish KM
    Jul 14, 2020 at 11:48
  • Hi Harish. Cors is not authenticated thats true. But you do not need to configure an independent CORS Route. See "Configuring CORS for an HTTP API" in the "Amazon API Gateway Developer Guide PDF". By enabling cors API-Gateway will answer to CORS requests and you will only pay if the users is later authenticated. By adding an manuell OPTIONS Route without authentication you can achieve a similar behaviour but I think in this case you will need to pay for the requests. You can still prevent to high cost by a usage plan. But just enabling cors without the manuell route is better Jul 14, 2020 at 13:10
  • 1
    The CORS for HTTP API documentation doesn't mention whether preflight requests to the API gateway are free or charged. BTW, Enabling CORS for a REST API is the same as adding an OPTIONS method manually with a mock backend. API Gateway does the same when you enable CORS through it, as seen here.
    – Harish KM
    Jul 14, 2020 at 18:30
  • 1
    "By enabling cors API-Gateway will answer to CORS requests and you will only pay if the users is later authenticated" -- @DominikHelps, do you have an authoritative source for this, or is this your interpretation? I'd love for this to be the case, but it's not clearly documented unfortunately.
    – Gunnar
    Jul 14, 2020 at 21:47
  • 1
    @DominikHelps I do 100% agree that this would be very desirable, but without clear indication in the official docs it's just a nice hope we have :)
    – Gunnar
    Jul 15, 2020 at 16:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.