Question

A retail company runs a public product-catalog API behind an Application Load Balancer with AWS WAF attached. Security operations notices that a small set of source IPs is scraping the `/api/products` endpoint at very high request rates, degrading performance for legitimate users. Normal customers rarely exceed 100 requests per 5-minute window to that endpoint, while the scrapers generate thousands. The team wants to automatically throttle only the abusive clients targeting that specific path, without impacting other API paths or normal traffic. Which AWS WAF configuration best meets this requirement?

Accepted Answer

Create a rate-based rule scoped with a scope-down statement that matches the `/api/products` URI path, set the rate limit threshold, and set the action to Block.

Answer

Create an IP set of the known scraper IPs and add a rule that blocks them, then update the IP set manually as new scraper IPs appear.

Answer

Attach an AWS Shield Advanced layer 7 automatic mitigation to the ALB so it drops the excess requests to the catalog endpoint.

Answer

Configure a geographic match rule to block the countries where the scraper IPs originate for all requests to the ALB.