---
title: "Comment by Andrew Brown on \"The story of my (possibly) denial-of-wallet attack on AWS Serverless🕵🏻‍♂️\" | Hashnode"
description: "So this could be a good use case for CloudWatch Alarms with Anomaly Detection. Since Anomaly Detection uses a band instead of a set value so if something is rea"
url: "https://hashnode.com/posts/the-story-of-my-possibly-denial-of-wallet-attack-on-aws-serverless/5f272ee3bcc1a77423c40179/comment/5f2739519d473a7444cebda0"
---

[Discussion](https://hashnode.com/posts/the-story-of-my-possibly-denial-of-wallet-attack-on-aws-serverless/5f272ee3bcc1a77423c40179)

Comment [The story of my (possibly) denial-of-wallet attack on AWS Serverless🕵🏻‍♂️](https://hashnode.com/posts/the-story-of-my-possibly-denial-of-wallet-attack-on-aws-serverless/5f272ee3bcc1a77423c40179)

[Andrew Brown](https://hashnode.com/@iamcloud)

[Aug 2, 2020](https://hashnode.com/posts/the-story-of-my-possibly-denial-of-wallet-attack-on-aws-serverless/5f272ee3bcc1a77423c40179/comment/5f2739519d473a7444cebda0)

So this could be a good use case for CloudWatch Alarms with Anomaly Detection. Since Anomaly Detection uses a band instead of a set value so if something is really out of the ordinary you would get alerted and could automate remediation like a Honeypot.

[Chris Nagy](https://hashnode.com/@chris_the_nagy)

[Aug 2, 2020](https://hashnode.com/posts/the-story-of-my-possibly-denial-of-wallet-attack-on-aws-serverless/5f272ee3bcc1a77423c40179/comment/5f2739519d473a7444cebda0#reply-5f273af1bcc1a77423c401ac)

Yep, that's definitely an option here. I'm gonna dive into logging, as right now that area of mine is a bit _slippery_😅

But yes an anomaly detection would perform perfectly here, this is what it was made for AFAIK. How could you remediate an API Gateway attack?🤔 Rate limiting would work but that cuts off normal users too for a while. Better yet, update the WAF rules🕵🏻‍♂️