How do I use AWS WAF to apply rate-based rules on an API Gateway REST API?

Resolution

Note: AWS WAF currently supports only API Gateway REST APIs.

To use AWS WAF to apply rate-based rules on a REST API, create a protection pack that includes a rate-based rule and associate with your REST API.

Create a web ACL

Complete the following steps.

1. Open the AWS WAF console.
2. In the navigation pane, choose AWS WAF.
3. Choose Resources & protection packs.
4. Choose Create protection pack.
5. To set up your protection pack, configure the following values:
   In the App category drop-down list, choose API & integration services.
6. Under Select resources to protect, choose Add resources.
7. Choose Add regional resources
8. Select your API from the list.
9. Under Choose protection pack, select Build your own pack from all of the protections AWS WAF offers.
10. In the right pane, select Custom rule and select next.
11. Select Rate-based rule and then next.
    For Action, choose Block.
    For Rule name, enter a name for the rule.
    For Rate limit, enter a number between 10 and 2,000,000,000.
    For Evaluation window, choose your evaluation window.
12. Under Rule configuration, for Request aggregation, select one of the following:
    Select Source IP address to set a rate limit based on the client IP field.
    -or- 
    Select IP address in header to set a rate limit based on the IP address in header.
    Note: If your traffic goes through a proxy or a content delivery network (CDN), then use IP address in header. For more information, see Using forwarded IP addresses in AWS WAF.
    For Scope of inspection and rate limiting, select one of the following:
    Select Consider all requests to create a rule for all requests that the web ACL inspects.
    -or-
    Select Only consider requests that match the criteria in a rule statement to apply a scope-down statement.
    For Name, enter a name for the web ACL.
    Choose Create rule.
13. Under Name and describe, enter a name for your protection pack.
14. Choose Create protection pack.

Related information

Aggregating rate-based rules in AWS WAF

The three most important AWS WAF rate-based rules

How do I use an aggregation key to configure a rate limit rule in AWS WAF?