---
title: "Discussion on \"The story of my (possibly) denial-of-wallet attack on AWS Serverless🕵🏻‍♂️\" | Hashnode"
description: "Discussion on \"The story of my (possibly) denial-of-wallet attack on AWS Serverless🕵🏻‍♂️\". ...if it was an attack at all. might have been an innocent bot getting stuck in the muddy waters of IP-land\n\nThat's how my conversation in the Discord group ended on the topic. Long story short, today I went onto my personal website heyitschris.com w..."
url: "https://hashnode.com/posts/the-story-of-my-possibly-denial-of-wallet-attack-on-aws-serverless/5f272ee3bcc1a77423c40179"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [The story of my (possibly) denial-of-wallet attack on AWS Serverless🕵🏻‍♂️](https://not-blog.heyitschris.com/the-story-of-my-possibly-denial-of-wallet-attack-on-aws-serverless?utm_source=hashnode&utm_medium=feed)

...if it was an attack at all. might have been an innocent bot getting stuck in the muddy waters of IP-land That's how my conversation in the Discord group ended on the topic. Long story short, today I went onto my personal website heyitschris.com w...

Aug 2, 2020 · 6 min read · not-blog.heyitschris.com  
Read the article

-   [#aws](https://hashnode.com/tag/aws)
-   [#lambda](https://hashnode.com/tag/lambda)
-   [#serverless](https://hashnode.com/tag/serverless)
-   [#dynamodb](https://hashnode.com/tag/dynamodb)

## Written by

[Chris Nagy](https://hashnode.com/@chris_the_nagy)

@chris\_the\_nagy

  
[View profile](https://hashnode.com/@chris_the_nagy)

Building Clouds with a a bit of rain🌧

## Responses 2

Markdown supported · ⌘↵ to post

[Bolaji Ayodeji](https://hashnode.com/@bolajiayodeji)

[Aug 3, 2020](https://hashnode.com/posts/the-story-of-my-possibly-denial-of-wallet-attack-on-aws-serverless/5f272ee3bcc1a77423c40179/comment/5f27fbad9d473a7444cec299)

This is really amazing, thanks for sharing!

[Andrew Brown](https://hashnode.com/@iamcloud)

[Aug 2, 2020](https://hashnode.com/posts/the-story-of-my-possibly-denial-of-wallet-attack-on-aws-serverless/5f272ee3bcc1a77423c40179/comment/5f2739519d473a7444cebda0)

So this could be a good use case for CloudWatch Alarms with Anomaly Detection. Since Anomaly Detection uses a band instead of a set value so if something is really out of the ordinary you would get alerted and could automate remediation like a Honeypot.

[Chris Nagy](https://hashnode.com/@chris_the_nagy)

[Aug 2, 2020](https://hashnode.com/posts/the-story-of-my-possibly-denial-of-wallet-attack-on-aws-serverless/5f272ee3bcc1a77423c40179/comment/5f2739519d473a7444cebda0#reply-5f273af1bcc1a77423c401ac)

Yep, that's definitely an option here. I'm gonna dive into logging, as right now that area of mine is a bit _slippery_😅

But yes an anomaly detection would perform perfectly here, this is what it was made for AFAIK. How could you remediate an API Gateway attack?🤔 Rate limiting would work but that cuts off normal users too for a while. Better yet, update the WAF rules🕵🏻‍♂️