I have an API Gateway set up with GCP. I am looking for a way to track the number of requests for each parameter specified in the API request.
For example the api receives 1200 GET requests for api.example.com/ex?special=true and 300 GET request for api.example.com/ex?counter=11 I'm looking for a way to see the metrics (number of requests) for each parameter (so special would be 1200 and counter would be 300).
Is logging the solution?
Related
Can I limit my API Gateway request limitation?
For example
URL A with path like this :
aaaaaaaa.com/predict
I set URL A only can be requested 1000 per day and the same URL with another path like this :
aaaaaaaa.com/calling
/calling only can be requested 500 per day
So, can I set a path with a limited request?
I wrote an article with Cloud Endpoint and it's the same thing with API Gateway (simply a managed version of Cloud Endpoint).
If you want to limit the requests per day AND per requester, you need to add API keys to differentiate all the requesters. And the requester need to use it to indicate in which quota the request if counted.
Take care, an API identify a project. If you have several requesters, you need several API keys, each one in a different project. Else, if you put all in the same project, it's the same project which will be identified, and thus the same quota decreased.
Can API Gateway be configured to allow a maximum of (for example) 100KB bodies in a POST call for a given HTTP/REST endpoint?
Max for Amazon API Gateway is 10MB and 6MB for Lambda, but I want the other direction. I want to enforce a maximum size lower than the default at the API Gateway layer before it gets to my lambda.
And would any rejected requests be considered part of the billable total requests?
For a stage belonging to an API in AWS API Gateway I have the option to limit Default Method Throttling. Does this limit the total number of requests per second, or the number of requests from a particular client per second?
Default Method Throttling (like Account Level Throttling) is the total number of requests per second across everyone hitting your API.
Client-level limits are enforced with Usage Plans, based on api-keys.
For more detailed information about API Gateway throttling checkout:
https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-request-throttling.html
https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-api-usage-plans.html
If I create a public endpoint using AWS API Gateway, the entire world could access it. This would be a problem because the end point would trigger an AWS Lambda function. If we assume that I can't query a data source to determine the frequency that the incoming IP address queried the resource in the past, what would be the best practice for protecting this end point from abuse? Do I have any other security options?
I realize I could use a reCaptcha but this would still invoke the AWS Lambda function and would incur costs if done a million times over a short window of time.
A very simple way of protecting your API gateway
Use AWS Cloudfront with TTL 0 and pass custom headers from AWS Cloudfront to API gateway
Use AWS WAF with AWS Cloudfront
AWS API Gateway also handles some basic level of DDOS attacks.
Kindly also view these blogs for securing AWS API Gateway
https://aws.amazon.com/blogs/compute/protecting-your-api-using-amazon-api-gateway-and-aws-waf-part-i/
https://aws.amazon.com/blogs/compute/protecting-your-api-using-amazon-api-gateway-and-aws-waf-part-2/
You are probably looking for throttling limit configuration or usage plan definition:
To prevent your API from being overwhelmed by too many requests,
Amazon API Gateway throttles requests to your API using the token
bucket algorithm, where a token counts for a request. Specifically,
API Gateway sets a limit on a steady-state rate and a burst of request
submissions against all APIs in your account. In the token bucket
algorithm, the burst is the maximum bucket size.
When request submissions exceed the steady-state request rate and
burst limits, API Gateway fails the limit-exceeding requests and
returns 429 Too Many Requests error responses to the client. Upon
catching such exceptions, the client can resubmit the failed requests
in a rate-limiting fashion, while complying with the API Gateway
throttling limits.
As an API developer, you can set the limits for individual API stages
or methods to improve overall performance across all APIs in your
account. Alternatively, you can enable usage plans to restrict client
request submissions to within specified request rates and quotas. This
restricts the overall request submissions so that they don't go
significantly past the account-level throttling limits.
References:
https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-request-throttling.html
https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-create-usage-plans-with-console.html#api-gateway-usage-plan-create
I would like to have a policy on an API Gateway that would throttle requests based on a header value. For example, header value "AAA" would be allowed up to 10 requests per day, "BBB", 20 requests. Is this possible? How can I achieve this? Note: I am trying to avoid writing a lambda function for this purpose, because then I would need to keep state, etc.
API Gateway has Usage Plans, which support what you are attempting to do.
Each usage plan can have a throttling limit, which restricts requests per second and burst rate. Usage plans can also have quotas, which would allow you to add limits on requests per day.
API Gateway allows you to add API Keys to a usage plan. API Keys are sent HTTP header (x-api-key).
You can find more details in the Usage Plans for API Gateway launch blog and API Gateway Usage Plan docs.