Configuring rate limiting on API endpoints

Question

Pulumi · Accepted Answer

Configuring rate limiting on API endpoints is a common requirement to prevent abuse and manage the load on the services. In a cloud environment, different providers offer various ways to implement rate limiting, usually via their API Gateway services. These services allow you to define and enforce policies that control the number of requests a user can make to your API within a given time period.

Here's an example of how you might use Pulumi to configure rate limiting on an AWS API Gateway. The following Pulumi program written in TypeScript illustrates the creation of an API Gateway with a stage. For rate limiting, we will create a `UsagePlan` and associate it with our deployed API stage, defining a fixed rate limit and burst capacity (maximum rate limit) for requests.

Before we get into the code, let me explain the key resources:

- `aws.apigateway.RestApi`: Represents your collection of resources and methods that can be invoked through HTTPS endpoints.
- `aws.apigateway.Resource`: Represents a logical part of your API that clients can call.
- `aws.apigateway.Method`: Defines the method (GET, POST, etc.) and integration with backend services like Lambda or HTTP endpoints.
- `aws.apigateway.Deployment`: Deploys your API to make it callable by clients.
- `aws.apigateway.Stage`: Represents a stage of deployment, like `prod` or `dev`.
- `aws.apigateway.UsagePlan`: Represents a usage plan with specified throttling and quota limits.

Now let's take a look at the TypeScript code for configuring rate limiting on the API endpoints:

```typescript
import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

// Create a new API Gateway
const api = new aws.apigateway.RestApi("myapi", {
    description: "This is my API for demonstration purposes",
});

// Create a resource under the API
const resource = new aws.apigateway.Resource("myresource", {
    restApi: api,
    parentId: api.rootResourceId,
    pathPart: "myresource",
});

// Create a GET method for the resource
const method = new aws.apigateway.Method("mymethod", {
    restApi: api,
    resourceId: resource.id,
    httpMethod: "GET",
    authorization: "NONE",
});

// Create a deployment of the API
const deployment = new aws.apigateway.Deployment("mydeployment", {
    restApi: api,
    // Note: Set `stageName` to `null` to prevent creating an implicit stage, since we'll create it explicitly below
    stageName: "prod",
});

// Create a stage, which is an addressable instance of the API. We'll attach the usage plan to this stage.
const stage = new aws.apigateway.Stage("mystage", {
    deployment: deployment,
    restApi: api,
    stageName: "prod",
});

// Create a usage plan with rate limiting
const usagePlan = new aws.apigateway.UsagePlan("myusageplan", {
    description: "A usage plan that limits the request rate.",
    // Throttle settings for limiting the request rate
    throttleSettings: {
        rateLimit: 1, // 1 request per second
        burstLimit: 2, // allows bursts of up to 2 requests
    },
});

// Associate the usage plan with the API stage
const usagePlanKey = new aws.apigateway.UsagePlanKey("myusageplankey", {
    keyId: stage.restApi.id,
    keyType: "API_KEY",
    usagePlanId: usagePlan.id,
});

// Export the API endpoint URL
export const endpointUrl = pulumi.interpolate`${deployment.invokeUrl}/${stage.stageName}`;

```

In this program, we start by creating a new API Gateway named `myapi`. Then, we create a resource endpoint under the API. Here we've named this endpoint `myresource`. After defining the resource, we create a method attached to it; specifically, we make it respond to `GET` requests (you could similarly create methods for POST, PUT, etc.).

With the API defined, we create a deployment (a snapshot of the API that can be called by users) and a stage named `prod`. The stage is an environment through which the deployment can be accessed.

Next, we implement rate limiting by creating a `UsagePlan`. Here, we define a rate limit of 1 request per second, with the capacity to allow short bursts of up to 2 requests at times.

Lastly, we associate the `UsagePlan` with our API's stage by creating a `UsagePlanKey` resource. To finish, we export the URL of the API endpoint so it can be easily accessed.

By deploying this Pulumi program, you would have an API with rate-limiting features on AWS. This helps in controlling traffic and protecting the backend services from being overwhelmed with too many requests.