Establish a usage plan with a restricted API key for authorized users.

Embed logic in the Lambda function to disregard requests originating from identified fraudulent IP addresses.

Deploy an AWS WAF rule to identify and mitigate malicious traffic.

Transform the public API into a private one, with DNS updates to guide users to the updated endpoint.

Assign unique IAM roles to users for API access, requiring role assumption during each API call.