WAF and gateway at the front
Put a WAF and an API Gateway in front of the App Servers, so bots and bursts are stopped before they cost you capacity.
Filter traffic at the edge: a WAF drops bots, and a Gateway caps what is left.
Move up when#
Bots take a large share of requests and load the App Servers.
Logins spike from bots, or a burst from one client crowds out the rest.
You want one place to see and cap API traffic.
The Design#
Drag to pan. Hold Ctrl or Cmd and scroll to zoom.
| Where | Setting | Value | Why |
|---|---|---|---|
| WAF | Paranoia level | 2 | A middle level blocks most bots and few shoppers. Higher levels block more real users and cost more CPU. |
| API Gateway | Rate limit | 1000 | Set a little above the peak you want to serve, so a burst past it fails as throttled at the edge instead of reaching the servers. |
| App Server | Instance size | small | It sees only traffic the WAF and Gateway let through. |
| Database | Instance size | small | Protected by both layers in front of it. |
Research this Design needs: Web application firewall, API gateway, Web application firewall, Load balancing, API gateway.
Users hit the WAF first, then the API Gateway, then the App Server and the Database. The WAF's Paranoia level sets how aggressive it is. The Gateway's Rate limit caps requests a second.
Why it works#
The WAF blocks a share of bots, so the App Server never spends CPU on them. A higher paranoia level blocks more bots, costs more CPU per request, and blocks more real users too, which is where the caption's errors come from. The Gateway's limit sits a little above the peak you want to serve. Requests past it fail as throttled at the edge and never reach the servers. Each layer protects the one behind it.
What it costs#
Both layers add a hop to every request. A paranoia level that is too high blocks shoppers, which costs more than the bots did. A rate limit caps volume and cannot tell a bot from a shopper, so it does not replace the WAF. The Gateway bills per request, so it is cheap at low volume and a real line on the bill at high volume. Under attack mode blocks nearly all junk and some real users, so use it only while an attack lasts.
In Quorum#
Place a WAF after Web application firewall, and an API Gateway after API gateway. Rate limiting adds a token bucket for bursts, and Bot management challenges a client instead of blocking it. See WAF and bot management and API gateway patterns. The next rung is Auth and TLS at the gateway.