What
Three configuration-choice rules: REST APIs that fit HTTP APIs, CloudFront behaviors with compression disabled, and WAF WebACLs associated with nothing.
Why
Each is a one-line configuration with a recurring price attached: HTTP APIs cost ~70% less per request than REST APIs; uncompressed CloudFront responses bill full data-transfer on bytes gzip/brotli would eliminate; an unassociated WebACL bills $5/mo plus per-rule charges for protecting nothing.
Details
- API Gateway REST API using only HTTP-API-compatible features (no API keys/usage plans/request validation etc.) — IaC + discovery; review severity. Extends
apigateway/ as CLDBRN-AWS-APIGATEWAY-2 (module has one rule today). Feature-compatibility detection is the research question — start conservative.
- CloudFront cache behavior with
Compress: false — IaC + discovery; extends cloudfront/ as CLDBRN-AWS-CLOUDFRONT-3.
- WAF WebACL with no resource associations — discovery; new
waf/ module, CLDBRN-AWS-WAF-1. Framed strictly as "unused resource," never as advice to reduce WAF protection.
What
Three configuration-choice rules: REST APIs that fit HTTP APIs, CloudFront behaviors with compression disabled, and WAF WebACLs associated with nothing.
Why
Each is a one-line configuration with a recurring price attached: HTTP APIs cost ~70% less per request than REST APIs; uncompressed CloudFront responses bill full data-transfer on bytes gzip/brotli would eliminate; an unassociated WebACL bills $5/mo plus per-rule charges for protecting nothing.
Details
apigateway/asCLDBRN-AWS-APIGATEWAY-2(module has one rule today). Feature-compatibility detection is the research question — start conservative.Compress: false— IaC + discovery; extendscloudfront/asCLDBRN-AWS-CLOUDFRONT-3.waf/module,CLDBRN-AWS-WAF-1. Framed strictly as "unused resource," never as advice to reduce WAF protection.