I'm setting up an AWS API Gateway + Lambda micro-service that will return non-sensitive but user-specific data.This means that the responses from the service can't be cached and served to multiple users.
There is a possibility that unauthorized third parties will hit this service and cause large spikes in resource usage.
Why does it have to be a client side request?
Pages on the main website are usually cached and served from CloudFront without sending each request to the origin server so it is impossible to make this request server-side for each user.
Ideas I've Had
Requiring an API key to be used to access the service.
This is unlikely to be the magic bullet because even if the key itself is hidden by making a call to a separate back-end script, all an unauthorized user would have to do is call the script instead of the API directly and they would get the same results.
Adding custom checks based on headers, origin etc. before sending a valid response from the API
These things can be spoofed relatively easily so it's by no means guaranteed to work but it might deter a lot of less motivated people.
Is there anything else that can be done to ensure that this service is only accessed by people actually viewing the website and not third party applications?