Rate limiting requests to GCP APIs using Cloud Endpoints

Question

Pulumi · Accepted Answer

To rate limit requests to your GCP APIs using Cloud Endpoints, you will define a service configuration that includes a quota configuration and apply this to an Endpoints service.

A quota configuration enables you to control the rate at which applications can call your API. It uses a defined metric and sets limits on the number of requests an application can make within a specific time period, typically a minute or a day.

Firstly, ensure that you have the Cloud Endpoints API enabled for your GCP project and that you are using the Google Cloud SDK with Pulumi to manage your resource deployment.

Here's how you might define an Endpoints Service with a quota limit using Pulumi:

```typescript
import * as gcp from '@pulumi/gcp';

// Define the API Service for Endpoints. The configuration in openapiConfig sets
// rate limiting or quota on the service.
const apiService = new gcp.endpoints.Service('my-api-service', {
  serviceName: 'my-api-service.endpoints.my-project-id.cloud.goog', // Replace with your service name and project ID
  project: 'my-project-id', // Replace with your project ID
  openapiConfig: `swagger: "2.0"
info:
  title: "My API"
  description: "My API with rate limiting"
  version: "1.0.0"
host: "my-api-service.endpoints.my-project-id.cloud.goog" // Replace with your service name and project ID
schemes:
  - "https"
paths:
  "/myApiMethod":
    get:
      summary: "My API Method"
      operationId: "myApiMethod"
      x-google-quota:
        metricCosts:
          "read-requests": 1
      responses:
        "200":
          description: "A successful response"
      security:
        - api_key: []
securityDefinitions:
  api_key:
    type: "apiKey"
    name: "key"
    in: "query"
  `,
});

// Output the service name of the Cloud Endpoints API
export const serviceName = apiService.serviceName;
```

In the above Pulumi program:

- We import the `@pulumi/gcp` module to be able to work with GCP resources.
- We create an `endpoints.Service` resource with a name `'my-api-service'` which has an `openapiConfig`.
- `openapiConfig` includes the OpenAPI (Swagger) specification for your API, which is where you set the rate limiting configuration under the `x-google-quota` property.
- We've inserted a placeholder for the `serviceName` which includes both your specified API service host and your GCP project ID. You should replace these with your actual service name and project ID.
- We're associating a cost for every read operation to the `read-requests` metric. Here, a cost of `1` indicates that each API call to `/myApiMethod` increments the usage count for the `read-requests` metric by one. You need to have defined this custom metric in Cloud Monitoring for the quota management to work.
- `securityDefinitions` using an API key can be set up to secure access to your API.

After you have defined your service in Pulumi, you will deploy it using Pulumi CLI commands `pulumi up` to create and manage the infrastructure as code.

Keep in mind that actual application and enforcement of the rate limit also require that you have implemented and configured the Cloud Endpoints on a GCP service such as App Engine, Cloud Functions, or Cloud Run with proper deployment of the ESP (Extensible Service Proxy).

The above resource creation will not immediately rate limit your API until the Endpoints service is deployed and the OpenAPI specification is processed by GCP to enforce quotas.

Refer to the official [GCP documentation on Cloud Endpoints](https://cloud.google.com/endpoints/docs/openapi/limit-requests) for additional context on rate limiting and quota management.