Best Security Practices with Amazon Location Services API Keys

0

Hey there, I have been playing around with the amazon location service api for a little bit now, and have been able to operate with the amazon location service maps pretty well using react/maplibreGL.

I am currently using the map as such:

            <Map
            mapStyle={`https://maps.geo.${region}.amazonaws.com/maps/v0/maps/${mapName}/style-descriptor?key=${apiKey}`}
            >
            </Map>

This works perfectly fine, and makes requests for tiles such as : https://maps.geo.us-{REGION}-2.amazonaws.com/maps/v0/maps/{MAP}/tiles/14/2738/6231?key={my key}

My main question, is that in a production environment, other than setting the referrer's as the front end's url, are there any concerns with the token being exposed to the end user in the query parameters? Or are there better practices regarding security here.

1 Antwort
3
Akzeptierte Antwort

For the best security practices with Amazon Location Services API keys, the main recommendation is to avoid exposing the API keys directly on the client-side.

Instead, implement server-side proxying, where your client-side code makes requests to your server, and the server then forwards the requests to the Amazon Location Service API, including the API key. This way, the API key is never exposed to the client.

Additionally, you can leverage AWS Identity and Access Management (IAM) roles if your application is running on AWS infrastructure, which eliminates the need to embed API keys in your code. It's also crucial to restrict API key access based on specific criteria, rotate API keys regularly, monitor API usage, implement rate limiting, and keep your dependencies up-to-date.

profile picture
EXPERTE
beantwortet vor 3 Monaten
profile picture
EXPERTE
überprüft vor 3 Monaten
profile picture
EXPERTE
überprüft vor 3 Monaten
  • Yeah that is really what I figured, which is what brought me here. Server side proxying it is. Thanks!

Du bist nicht angemeldet. Anmelden um eine Antwort zu veröffentlichen.

Eine gute Antwort beantwortet die Frage klar, gibt konstruktives Feedback und fördert die berufliche Weiterentwicklung des Fragenstellers.

Richtlinien für die Beantwortung von Fragen