AWS WAF securing CloudFront endpoint only.The following image describes methods to secure your API in API Gateway before and after this feature was made available. This new AWS WAF integration means that the method described in Part 2 is no longer necessary. In Part 2 of this series, I described how to use API keys as a shared secret between a CloudFront distribution and API Gateway to secure public access to your API in API Gateway. In Part 1 of this series, I described how to protect your API provided by API Gateway using AWS WAF. This new feature now enables you to provision any API Gateway endpoint and secure it with AWS WAF without having to configure your own CloudFront distribution to add that capability. Previously, if you wanted to secure your API in Amazon API Gateway with AWS WAF, you had to deploy a Regional API endpoint and use your own Amazon CloudFront distribution. Today, I’m excited to tell you about the Amazon API Gateway native integration with AWS WAF. Create an API key and add it to the usage plan.This post courtesy of Heitor Lessa, AWS Specialist Solutions Architect – Serverless Create a usage plan with a request limit and associate it with the API. Configure the API to require an API key on the POST method.Ĭreate an AWS WAF web ACL with a rule to allow access to the IP addresses used by the six partners. Create a resource policy with a request limit and associate it with the API. Add a custom header to the CloudFront distribution populated with an API key. Associate the web ACL with the CloudFront distribution. Create an AWS WAF web ACL with a rule to block clients that submit more than five requests per day. Configure API Gateway to ensure only the OAI can run the POST method.Ĭreate an Amazon CloudFront distribution with the API as the origin.

Configure CloudFront with an origin access identity (OAI) and associate it with the distribution.

Create an Amazon CloudFront distribution with the API as the origin.

Api gateway waf