Hardening a ~3-billion-events/month client-side threat-detection pipeline on AWS
Amazon API Gateway
AWS Lambda
Amazon Kinesis
Amazon CloudWatchBrowser-security telemetry from Feroot’s clients’ websites — up to roughly 3 billion events a month — enters the platform through Amazon API Gateway. VeUP’s engineering review centered that front door as the pipeline’s control point: left-shifting load management, entitlement enforcement, and observability to the API edge so the platform stops paying its streaming and analytics tiers to process traffic it will ultimately reject.
The challenge
The customer’s detection platform serves compliance-driven use cases — PCI-DSS 4.0.1, HIPAA online-tracking, GDPR, CCPA/CPRA — by ingesting browser telemetry at volumes where a single customer project can spike to half a billion events in a month. The expensive failure mode discovered in review: overage and out-of-entitlement traffic was being rejected only after it had already traversed — and been paid for through — the ingest Lambda, the Kinesis streams, and the consumer tier. At 3-billion-events/month scale, every check that happens deep in the pipeline instead of at the edge is a recurring tax.
The solution
VeUP mapped the verified production path — Amazon API Gateway fronting an AWS Lambda ingest function onto Amazon Kinesis Data Streams (ingest and enriched streams), ~15–20 Lambda consumers, Amazon OpenSearch Service aggregates, and Kinesis Data Firehose backing raw events to Amazon S3 for replay — and re-centered the design on the API edge. The target pattern moves entitlement enforcement and per-customer throttling into API Gateway itself: usage plans and keys expressing each customer’s contracted volume, request validation and rejection before any downstream compute runs, and burst absorption configured at the gateway rather than discovered in the shard metrics. Edge observability — per-stage, per-customer CloudWatch metrics at the API tier — gives the platform its earliest and cheapest signal of anomalous load, feeding the same FinOps-per-ARN discipline VeUP scoped across the pipeline.
Production outcomes
| KPI | Result |
|---|---|
| Scale carried | Up to ~3 billion browser events/month entering through the API Gateway front door, with single projects spiking to ~0.5 billion — the edge tier of a production compliance-detection pipeline. |
| Economic control point | Entitlement and throttling left-shifted to the gateway in the target pattern — rejected traffic stops consuming Lambda, Kinesis, and OpenSearch spend before the rejection, bending cost per ingested event downward. |
| Reliability criteria | Success criteria set as near-zero throttled or dropped legitimate events at peak with sub-60–90-second freshness — the edge absorbing bursts so the streaming tier scales for real work. |
| Lessons & continuation | In high-volume ingest, the API edge is the FinOps lever: every entitlement check, throttle, and validation moved to API Gateway is paid once instead of at every downstream tier — and edge metrics give the earliest warning a customer project is about to become a hot spot. |
Amazon Kinesis Data Streams
Amazon Kinesis Data Firehose
Amazon S3 (replay store)
Amazon OpenSearch Service