luminousmen / luminousmen.com

2 stars 0 forks source link

https://luminousmen.com/post/aws-lambda-abuse #20

Open utterances-bot opened 4 years ago

utterances-bot commented 4 years ago

AWS Lambda abuse - Blog | luminousmen

We are investigating possible ways to keep our application on AWS Lambda up and running under DDoS attack.

https://luminousmen.com/post/aws-lambda-abuse

aardvarq commented 4 years ago

You've really missed some basic aspects to approaching endpoint security here.

Sponsored? Please be serious.

luminousmen commented 4 years ago

@aardvarq Let's be serious, You spent time writing that comment without saying anything. Are you talking about VPC? Or what are you talking about?

aussiearef commented 4 years ago

Sorry but there is too much faff in here. There are several third party services that can protect your endpoints against abusive users. Not all solutions have to be 100% based on AWS services.

aussiearef commented 4 years ago

@luminousmen Using API key is the least secure way of safe guarding APIs. In fact, AWS has provided multiple solutions for securing APIs such as Lambda authorisers and/or AWS Cognito.

luminousmen commented 4 years ago

@aussiearef, thanks for your comments! In the post, I don't talk about security in terms of unauthorized access. You are right - of course, there different ways to create authorization and authentication on/off AWS, but I'm talking about specific attacks - DDoS. As far as I know, Lambda authorizes and Cognito doesn't provide any protection from denial of service attacks, am I wrong?