Best Security Practices with Amazon Location Services API Keys

0

Hey there, I have been playing around with the amazon location service api for a little bit now, and have been able to operate with the amazon location service maps pretty well using react/maplibreGL.

I am currently using the map as such:

            <Map
            mapStyle={`https://maps.geo.${region}.amazonaws.com/maps/v0/maps/${mapName}/style-descriptor?key=${apiKey}`}
            >
            </Map>

This works perfectly fine, and makes requests for tiles such as : https://maps.geo.us-{REGION}-2.amazonaws.com/maps/v0/maps/{MAP}/tiles/14/2738/6231?key={my key}

My main question, is that in a production environment, other than setting the referrer's as the front end's url, are there any concerns with the token being exposed to the end user in the query parameters? Or are there better practices regarding security here.

1 個回答
3
已接受的答案

For the best security practices with Amazon Location Services API keys, the main recommendation is to avoid exposing the API keys directly on the client-side.

Instead, implement server-side proxying, where your client-side code makes requests to your server, and the server then forwards the requests to the Amazon Location Service API, including the API key. This way, the API key is never exposed to the client.

Additionally, you can leverage AWS Identity and Access Management (IAM) roles if your application is running on AWS infrastructure, which eliminates the need to embed API keys in your code. It's also crucial to restrict API key access based on specific criteria, rotate API keys regularly, monitor API usage, implement rate limiting, and keep your dependencies up-to-date.

profile picture
專家
已回答 3 個月前
profile picture
專家
已審閱 3 個月前
profile picture
專家
已審閱 3 個月前
  • Yeah that is really what I figured, which is what brought me here. Server side proxying it is. Thanks!

您尚未登入。 登入 去張貼答案。

一個好的回答可以清楚地回答問題並提供建設性的意見回饋,同時有助於提問者的專業成長。

回答問題指南