Recommendations
1 min
Api Gateway
Modify "default method throttling" for values that make sense for the specific scenario.
Add a WAF Acl to block/allow/throttle specific components (has a cost).
Specify "resource policy" for whitelisting or blacklisting IPs.
Cloudfront
Add geo restrictions, if need be.
Add a WAF Acl to block/allow/throttle specific components (has a cost).