A public API receives an unusually large number of HTTP requests from the same source IP.
Limit the rate without changing the application code.
Which rule is most appropriate?
Configure an AWS WAF rate-based rule to count requests over a time window and limit sources that exceed the threshold.
Detailed explanation
MFA strengthens authentication but does not implement source-IP HTTP rate control.
MFA strengthens authentication but does not implement source-IP HTTP rate control.
Lifecycle rules manage S3 objects and do not control web requests.
Lifecycle rules manage S3 objects and do not control web requests.
A KMS key policy controls key use and does not inspect or rate-limit HTTP traffic.
A KMS key policy controls key use and does not inspect or rate-limit HTTP traffic.
A rate-based rule aggregates requests over a time window and can block or otherwise control a source that exceeds the limit.
A rate-based rule aggregates requests over a time window and can block or otherwise control a source that exceeds the limit.
Check official documentation
Compare the following points with the official documentation.
AWS WAF rate-based ruleの公式説明を確認する。
What to confirm
HTTP層のレート制御をWAFへ対応付けられる。
Key points
- AWS WAF
- Rate-based rule
- HTTP request rate
Notes
- Environment: AWS公式WAFドキュメントの確認
- Confirm current AWS service behavior in the official documentation.
Foundation review
Application-layer control
WAF operates on web requests, unlike KMS or storage lifecycle features.
Threshold action
A rate rule can block, count, or otherwise handle traffic after the configured limit is exceeded.