How to limit traffic to S3?

Question

I want to restrict the number of downloads per IP address within a specific time frame for my S3 URLs. For example, each IP should only be allowed to download 5 times within 1 minute. Any requests exceeding this limit should be denied.
Currently, I haven't found a similar configuration. Is it possible to implement such restrictions with S3?

Yaniv Rozenboim · Accepted Answer

No, not directly in S3.

However, you can serve your bucket content from a CloudFront distribution (AWS's CDN service) and associate AWS WAF to your distribution with rate-limit based rules per source IP address.

Riku_Kobayashi · Answer

Hello.

Such settings cannot be made with S3 alone.  
If you introduce CloudFront and WAF, you can introduce rate-based rules, so I think you can set things like download limits at 1-minute intervals.  
https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statement-type-rate-based.html

AWS WAF recently added the ability to set rate-based rules in 1-minute intervals.  
https://aws.amazon.com/about-aws/whats-new/2024/03/aws-waf-rate-based-rules-configurable-time-windows/?nc1=h_ls

How to limit traffic to S3?

Add your answer

Relevant content