Remote throttling

[gsproston-scottlogic]

May have to throttle user activity once the app is deployed.

[chriswilty]

AWS ECS can do this for us. Additionally, cloudfront and/or apigateway have throttling and other security measures we can enable.

https://docs.aws.amazon.com/elasticloadbalancing/latest/application/application-load-balancers.html https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-awswaf.html

[chriswilty]

This is now low priority, as our application is secured via Cognito auth. We would be able to spot bad actors via login names, although we will need to ensure the API layer (maybe load balancer?) logs username with each request, and configure that if currently missing.

[chriswilty]

Update

We are now logging username on successful token verification, which happens on every request to our API: these pass through CloudFront, as direct access to the load balancer is blocked.

We may wish to restrict unauthorized and authorized requests by applying throttling.