AWS API Gateway - Production Security Hardening

AWS WAF blocks attacks before they hit your Lambda functions and cost you money. REST APIs only - HTTP APIs are on their own because AWS loves feature parity. We've seen production systems get hammered by 50K+ requests/minute of SQL injection attempts (mostly ' OR '1'='1 and UNION SELECT garbage) until WAF was properly configured. That attack cost $4K in Lambda invocations before we realized what was happening.

Critical WAF rules that saved our ass:

• SQL Injection Protection - Catches UNION SELECT and similar garbage in query parameters
• XSS Filter - Blocks <script> tags and javascript: attempts
• Rate Limiting - 1000 requests per 5-minute window per IP (adjust for your traffic)
• Known Bad IPs - AWS managed rule set blocks Tor exit nodes and known botnets
• Size Restrictions - Reject requests over 1MB body size to prevent DoS attacks

WAF costs $1.00 per web ACL + $1.00 per rule + $0.60 per million requests. Sounds expensive until a single DDoS attack costs you $10K in API Gateway charges in one afternoon. Set up CloudWatch alarms for blocked request spikes - we learned this the hard way when 90% of our traffic was attack attempts and we didn't notice until the AWS bill arrived. "AllowedRequests" dropping below 50% of total requests is a good threshold for alarm.

Resource Policies (VPC and IP Whitelisting)

Resource policies are your kill switch. Lock down admin APIs to specific VPCs or IP ranges. That "internal only" API shouldn't be accessible from random coffee shop WiFi.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "execute-api:Invoke",
      "Resource": "arn:aws:execute-api:*:*:*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": ["203.0.113.0/24", "198.51.100.0/24"]
        }
      }
    }
  ]
}

Warning: This policy blocks everything except those IP ranges - test it thoroughly on a dev stage before deploying or you'll lock yourself out. I've seen engineers deploy this on prod, then panic when they can't access the API from home.

VPC endpoint restrictions work great for internal microservices. Private APIs never touch the internet - traffic stays within your VPC. Perfect for backend services that shouldn't be publicly accessible.

TLS Configuration That Doesn't Suck

API Gateway only supports TLS 1.2+ by default, which is good. But custom domain certificates require ACM certificates - don't upload your own certs, that's amateur hour.

Certificate pinning is possible but painful with CloudFront distribution changes. We've had clients implement it for high-security APIs, but expect mobile apps to break when certificates rotate. HSTS headers are easier and catch most downgrade attacks.

Edge-optimized endpoints terminate TLS at CloudFront edge locations, then re-encrypt to API Gateway. Regional endpoints terminate TLS once at the API Gateway service. Both are secure, but edge-optimized adds complexity and potential attack surface. Pick regional unless you actually need global performance.

Cold Start Mitigation During Traffic Spikes

Security incidents create the worst performance scenarios. DDoS attacks cause Lambda cold starts across your entire function fleet. Provisioned concurrency at $0.015 per GB-second keeps functions warm, but costs add up fast during sustained attacks.

Cold start reality check: Java functions can take 15+ seconds on first request (yes, really - we've measured 18 seconds for Spring Boot). Python and Node.js typically under 1 second but can spike to 3+ seconds with heavy dependencies. Go and Rust are fastest at 100-300ms unless you're importing half of GitHub. During an attack, everything cold starts simultaneously - that's when you discover your 5-second Lambda timeout is too aggressive and everything starts failing.

We've seen production systems handle 50K legitimate requests/minute fine, then collapse under 10K attack requests because every Lambda function went cold. Connection pooling to RDS becomes critical - opening database connections during cold start adds 2-3 seconds of latency.

Caching Strategy for Security-Sensitive APIs

API Gateway caching is tricky with authentication. Cache authenticated responses and you leak user data. Cache unauthenticated responses and attackers can poison your cache. The sweet spot is caching reference data that's the same for all users.

Cache invalidation becomes a security nightmare when you need to revoke access immediately. That cached user profile with "admin": true sticks around for up to 1 hour (default TTL) even after you revoke permissions. Manual cache flushing through the console works but takes 5-15 minutes to propagate across all regions. For sensitive operations like admin APIs or payment processing, skip the cache entirely or use very short TTLs (60 seconds max). We learned this when a terminated employee's admin access was cached for 45 minutes after we disabled their account.

Throttling Configuration That Actually Works

Default throttling is 10,000 requests per second across your entire AWS account. One bad API getting attacked can break everything else. Set method-level throttling on sensitive endpoints - authentication APIs shouldn't accept 1000 requests/second from a single IP.

{
  "burstLimit": 100,
  "rateLimit": 50
}

Per-client throttling requires usage plans with API keys. Works great for legitimate clients, useless against attackers who don't use keys. WAF rate limiting is better for attack mitigation, usage plans for business logic.

VPC Integration Performance Penalties

VPC Links add 100-300ms of latency and require Network Load Balancers ($16/month minimum). VPC cold starts are brutal - first request after idle can take 10+ seconds while ENIs warm up.

The VPC tax is real: Every security boundary adds latency. Internet → CloudFront → API Gateway → VPC Link → NLB → your service. That's 4-5 network hops minimum. Regional endpoints skip CloudFront but you lose edge caching. Pick your performance vs security tradeoffs consciously.

Edge vs Regional for Security Workloads

Edge-optimized endpoints cache responses at CloudFront edge locations. Great for performance, terrible for security logs. CloudFront logs show edge locations, not original client IPs. WAF logs are delayed 5-15 minutes from edge locations.

Regional endpoints give you real client IPs immediately and simpler security monitoring. All traffic hits one region, making it easier to analyze attack patterns. Edge-optimized makes sense for public APIs with global users, regional is better for internal APIs or when you need real-time security monitoring.

Cost difference matters at scale: CloudFront adds $0.085/GB for data transfer. At 1TB/month, that's $85 extra just for edge caching. If your security team needs real-time visibility, regional endpoints are worth the performance trade-off.