FCrDNS alternative

[g.siang]

We are trying to whitelist Fitbit source IPs based on recommended approach FCrDNS. But AWS API Gateway appears not to be supporting this. Is there any other way to have some access control to the updates API with AWS API Gateway?

[LifeOmic-Dev]

I brought up a similar question a while back in this thread.  It doesn't seem like an alternative will be provided.

[g.siang]

Thanks for the advise. Using the signature header is one way but, the point of doing this earlier at the gateway level is to potentially block malicious attackers from hitting the backend with many invalid requests. So I am still looking for a viable alternative.

[g.siang]

I would appreciate if FitBit support team can advise.

[LifeOmic-Dev]

This wasn't a blocker for my team, but we also would have appreciated the additional layer of security.  I was just made aware of feature requests recently and created a request to address this issue: FCrDNS Alternative - Add API Keys to Subscriptions.