What is the hard limit for the resources per REST api in Api Gateway? As per AWS docs https://docs.aws.amazon.com/apigateway/latest/developerguide/limits.html#api-gateway-execution-service-limits-table, default quota is 300 per api which can be increased on request.
My use is I have multiple versions of the apis which I am trying to add in single REST api in Api Gateway. Is there a hard limit at AWS beyond which they won't increase?
Related
How big can AWS API Gateway scale? I'm wondering how is it able to handle such large volumes of API requests? Under the hood it has to translate the request and see what endpoint its going and potentially do any validation on the headers so this takes some compute power. Is there any theoretical limit to how many requests a single endpoint can handle served through AWS API Gateway? Say I wanted to run an endpoint behind API Gateway - can it handle like 5,000,000,000,000 requests/second?
You may check the API Gateway account-level quotas here:
Amazon API Gateway quotas and important notes
Good Day,
Hiren
I've swagger JSON which I want to import on REST API Gateway, but I'm getting the message of
Maximum number of Resources for this API has been reached. Please contact AWS if you need additional Resources. when I import. What should I do, it says I need additional resources. Where I can add additional resources on API Gateway.
As per AWS docs, the default limit for Resources per API is 300. The error msg you have suggest that you are exceeding the limit.
Since the Resources per API limit can be increased (some limits can't), you have to request such an increase from AWS. The Increase account service quotas tutorial at AWS explains how to do it.
For a stage belonging to an API in AWS API Gateway I have the option to limit Default Method Throttling. Does this limit the total number of requests per second, or the number of requests from a particular client per second?
Default Method Throttling (like Account Level Throttling) is the total number of requests per second across everyone hitting your API.
Client-level limits are enforced with Usage Plans, based on api-keys.
For more detailed information about API Gateway throttling checkout:
https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-request-throttling.html
https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-api-usage-plans.html
If I create a public endpoint using AWS API Gateway, the entire world could access it. This would be a problem because the end point would trigger an AWS Lambda function. If we assume that I can't query a data source to determine the frequency that the incoming IP address queried the resource in the past, what would be the best practice for protecting this end point from abuse? Do I have any other security options?
I realize I could use a reCaptcha but this would still invoke the AWS Lambda function and would incur costs if done a million times over a short window of time.
A very simple way of protecting your API gateway
Use AWS Cloudfront with TTL 0 and pass custom headers from AWS Cloudfront to API gateway
Use AWS WAF with AWS Cloudfront
AWS API Gateway also handles some basic level of DDOS attacks.
Kindly also view these blogs for securing AWS API Gateway
https://aws.amazon.com/blogs/compute/protecting-your-api-using-amazon-api-gateway-and-aws-waf-part-i/
https://aws.amazon.com/blogs/compute/protecting-your-api-using-amazon-api-gateway-and-aws-waf-part-2/
You are probably looking for throttling limit configuration or usage plan definition:
To prevent your API from being overwhelmed by too many requests,
Amazon API Gateway throttles requests to your API using the token
bucket algorithm, where a token counts for a request. Specifically,
API Gateway sets a limit on a steady-state rate and a burst of request
submissions against all APIs in your account. In the token bucket
algorithm, the burst is the maximum bucket size.
When request submissions exceed the steady-state request rate and
burst limits, API Gateway fails the limit-exceeding requests and
returns 429 Too Many Requests error responses to the client. Upon
catching such exceptions, the client can resubmit the failed requests
in a rate-limiting fashion, while complying with the API Gateway
throttling limits.
As an API developer, you can set the limits for individual API stages
or methods to improve overall performance across all APIs in your
account. Alternatively, you can enable usage plans to restrict client
request submissions to within specified request rates and quotas. This
restricts the overall request submissions so that they don't go
significantly past the account-level throttling limits.
References:
https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-request-throttling.html
https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-create-usage-plans-with-console.html#api-gateway-usage-plan-create
I would like to have a policy on an API Gateway that would throttle requests based on a header value. For example, header value "AAA" would be allowed up to 10 requests per day, "BBB", 20 requests. Is this possible? How can I achieve this? Note: I am trying to avoid writing a lambda function for this purpose, because then I would need to keep state, etc.
API Gateway has Usage Plans, which support what you are attempting to do.
Each usage plan can have a throttling limit, which restricts requests per second and burst rate. Usage plans can also have quotas, which would allow you to add limits on requests per day.
API Gateway allows you to add API Keys to a usage plan. API Keys are sent HTTP header (x-api-key).
You can find more details in the Usage Plans for API Gateway launch blog and API Gateway Usage Plan docs.