AWS announced a new feature this week that lets you enable WAF protection for Cognito user pools. And one of the things you can do with this is to implement geo-fencing and IP allow/deny lists. Geo-fencing and IP allow/deny lists are usually implemented in the frontend as well as the backend APIs. But users (and …
How to setup geofencing and IP allow-list for Cognito user pool Read More »
AWS AppSync added support for Lambda authorizers on 30th July 2021 and it made it much easier to implement group-based authorization with 3rd party identity services. Group-based auth with AppSync and Cognito I previously wrote about how you can secure multi-tenant applications with AppSync and Cognito. Where you can use custom attributes to capture the tenant …
Update 21/06/2020: following lots of feedback and questions on Twitter, I have updated the post to include a few more options. Quite a few clients have asked me “Hey Yan, what API Gateway auth method should I use for this REST API?” so I thought I’d share my answer with everyone here. This is the …
When you deploy an API to API Gateway, throttling is enabled by default in the stage configurations. By default, every method inherits its throttling settings from the stage. Having built-in throttling enabled by default is great. However, the default method limits – 10k req/s with a burst of 5000 concurrent requests – matches your account …
The API Gateway security risk you need to pay attention to Read More »
Threats to the security of our serverless applications take many forms, some are the same old foes we have faced before; some are new; and some have taken on new forms in the serverless world. As we adopt the serverless paradigm for building cloud-hosted applications, we delegate even more of the operational responsibilities to our …
Security in serverless world from Yan Cui
This year’s version of NDC Oslo has a strong security theme throughout,and one of Troy Hunt’s talks – 50 Shades of AppSec – was one of the top-rated talks at the conference based on attendee feedbacks. Sadly I missed the talk whilst at the conference but having just watched it on Vimeo it left me …
NDC Oslo 15 – Takeaways from “50 Shades of AppSec” Read More »
By continuing to use the site, you agree to the use of cookies. more information
The cookie settings on this website are set to "allow cookies" to give you the best browsing experience possible. If you continue to use this website without changing your cookie settings or you click "Accept" below then you are consenting to this.