Explanation

Correct Answers: A and C

A. Create a usage plan with an API key that is shared with genuine users only.

• API Gateway usage plans allow you to throttle and meter API usage with API keys
• By distributing API keys only to legitimate users, you can block unauthorized access
• This is a serverless-friendly approach that works well with API Gateway

C. Implement an AWS WAF rule to target malicious requests and trigger actions to filter them out.

• AWS WAF (Web Application Firewall) can be integrated with API Gateway to filter malicious traffic
• You can create rules to block requests from known botnets, specific IP addresses, or patterns of malicious behavior
• This provides a security layer before requests even reach your Lambda functions

Why other options are incorrect:

B. Integrate logic within the Lambda function to ignore the requests from fraudulent IP addresses.

• While technically possible, this is not the best practice because:
  • It adds complexity to your business logic
  • The Lambda function still gets invoked, incurring costs
  • It's less efficient than blocking requests at the API Gateway/WAF level
  • Security logic should be implemented at the perimeter, not within application code

D. Convert the existing public API to a private API. Update the DNS records to redirect users to the new API endpoint.

• This would break the application since it's described as "publicly accessible"
• Private APIs are only accessible from within your VPC or via VPC endpoints
• This would prevent legitimate users from accessing the application

E. Create an IAM role for each user attempting to access the API. A user will assume the role when making the API call.

• This is impractical for a publicly accessible application
• IAM roles are designed for AWS services and authenticated AWS users, not anonymous public users
• This would require users to have AWS credentials, which is not feasible for a public API

Best Practices Summary

1. API Keys with Usage Plans: Control access and throttle requests
2. AWS WAF Integration: Filter malicious traffic at the edge
3. Consider AWS Shield: For DDoS protection
4. Rate Limiting: Implement throttling in API Gateway
5. Monitoring: Use CloudWatch metrics and AWS WAF logs to detect and respond to attacks