Which solution meets these requirements with the LEAST operational overhead?
Create an Amazon CloudFront distribution in front of the API Gateway Regional API endpoint with a maximum TTL of 24 hours.
Create a Regional AWS WAF web ACL with a rate-based rule. Associate the web ACL with the API Gateway stage.
Use Amazon CloudWatch metrics to monitor the Count metric and alert the security team when the predefined rate is reached.
Create an Amazon CloudFront distribution with Lambda@Edge in front of the API Gateway Regional API endpoint. Create an AWS Lambda function to block requests from IP addresses that exceed the predefined rate.
Explanations:
CloudFront can cache responses, but this does not prevent or mitigate HTTP flood attacks. Setting a max TTL of 24 hours would not address the security concern directly.
AWS WAF with a rate-based rule is specifically designed to mitigate HTTP flood attacks by limiting requests per IP. This requires minimal operational overhead.
CloudWatch metrics can monitor request count, but it does not automatically block or mitigate attacks. Alerts are useful, but they don’t stop the flood.
Lambda@Edge can block requests, but it adds complexity and overhead by requiring custom Lambda functions and doesn’t inherently provide as much protection as WAF.
I map out that the answer is:
Create a Regional AWS WAF web ACL with a rate-based rule. Associate the web ACL with the API Gateway stage.