title: AWS AppSync DDoS protection. What are the alternatives?
body: <p>I have not seen a definitive answer over the internet related to how AppSync can deflect DDoS attacks. I am a newbie with regards to this, so please have patience</p>
  
  <p>Our context: We will be using AppSync with AWS Cognito for authentication, and it will only be used by us and a certain set of clients (so no public access). We will probably not need a custom domain, so no need to use CloudFront for the distribution, but if this is better for us from a protection point of view, we could also do that. And on another note, I am aware that the endpoint address of AppSync is autogenerated and probably hard to guess by an someone external, but I am still worried about it being accessible by the public, especially since maybe at some point we might want to be using the AppSync endpoint directly from our site and not from the backend.</p>
  
  <p>I have seen two things mentioned:</p>
  
  <ol>
  <li><p>There is no throttling like on API gateway (I am a bit unclear on how throttling works and how it protects you, I am assuming that there is a hard cap imposed to certain IPs that are requesting your endpoint excessively?)</p></li>
  <li><p>Since AppSync is pay per request, I saw that API gateway charges no fee if it is protected by AWS Cognito and the requests have failed authentication ( <a href="https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-pricing.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-pricing.html</a> ). I am wondering if the same case applied to AppSync, since we will be using AWS Cognito as well.</p></li>
  <li><p>Since we are talking about AWS Cognito, we would like to restrict access to our endpoint to only a few select IP addresses. I've read that AWS Cognito can whitelist an IP range, but can it also whitelist specific IP addresses ? (I think by putting /32 at the end of the IP range?)</p></li>
  <li><p>What is AppSync's interaction with AWS Shield and AWS WAF ?</p></li>
  </ol>
  
  <p>Thank you, and sorry for any stupidly looking questions.</p>