Best Security Practices with Amazon Location Services API Keys

Question

Hey there, I have been playing around with the amazon location service api for a little bit now, and have been able to operate with the amazon location service maps pretty well using react/maplibreGL.

I am currently using the map as such:

            <Map
            mapStyle={`https://maps.geo.${region}.amazonaws.com/maps/v0/maps/${mapName}/style-descriptor?key=${apiKey}`}
            >
            </Map>

This works perfectly fine, and makes requests for tiles such as : https://maps.geo.us-{REGION}-2.amazonaws.com/maps/v0/maps/{MAP}/tiles/14/2738/6231?key={my key}

My main question, is that in a production environment, other than setting the referrer's as the front end's url, are there any concerns with the token being exposed to the end user in the query parameters? Or are there better practices regarding security here.

Giovanni Lauria · Accepted Answer

For the best security practices with Amazon Location Services API keys, the main recommendation is to avoid exposing the API keys directly on the client-side.

Instead, implement server-side proxying, where your client-side code makes requests to your server, and the server then forwards the requests to the Amazon Location Service API, including the API key. This way, the API key is never exposed to the client.

Additionally, you can leverage AWS Identity and Access Management (IAM) roles if your application is running on AWS infrastructure, which eliminates the need to embed API keys in your code. It's also crucial to restrict API key access based on specific criteria, rotate API keys regularly, monitor API usage, implement rate limiting, and keep your dependencies up-to-date.

Best Security Practices with Amazon Location Services API Keys

Relevant content