Test and operate APIs
Monitor API abuse
Observe authorization failures, unusual object access, expensive requests, credential use, business-flow spikes, and configuration changes.
8 minute lesson
A single denied request may be noise. A pattern across accounts, objects, or regions may be an active attack.
Log safe actor, credential, operation, target, result, cost, and correlation identifiers. Build alerts around meaningful deviations and high-impact actions. Give responders a way to revoke credentials and limit operations quickly.
One failed invoice lookup is normal. One token reading sequential invoice IDs across 40 accounts is a stronger object-access signal.
Tune the signal with known traffic before paging anyone. The alert should show why the pattern is unusual and give the responder a reversible containment action with a named owner.
Generate a normal access pattern and a cross-account enumeration pattern. Prove the second creates one actionable alert with actor, targets, request IDs, owner, and a tested revocation step.
Lesson completed