Distributed Denial Of Service in Chi with Dynamodb

When building services in Chi that rely on Amazon DynamoDB, distributed denial of service (DDoS) risk arises from the intersection of client request patterns, DynamoDB capacity characteristics, and Chi routing behavior. Unlike traditional network-layer DDoS, application-layer concerns in this context revolve around consuming provisioned read/write capacity and driving up latency through inefficient access patterns, hot keys, or uncontrolled fan-out operations.

DynamoDB does not provide traditional network DDoS primitives, but a Chi application can unintentionally amplify load on a single table or partition under attack. For example, an endpoint that queries or scans without required filters can trigger strongly consistent reads or full table scans, consuming excess read/write capacity units (RCUs/WCUs). If the table uses on-demand capacity, rapid request bursts can increase cost and trigger throttling at the service level, which manifests as elevated 5xx errors to clients. With provisioned capacity, sustained high utilization can cause provisioned throughput exceptions, leading to request failures and retries that further increase load in a feedback loop.

Chi routes are often concise and expressive, which can encourage developers to attach multiple operations to a single route or to chain DynamoDB calls. An attacker sending many concurrent requests to such routes can generate many concurrent Lambda warm starts (if applicable) and many simultaneous DynamoDB operations, stressing account-level concurrency limits and table-level partitions. Uneven key design—such as using monotonically increasing timestamps as partition keys—can concentrate load on a single partition, causing throttling on that partition while other partitions remain idle. The combination of Chi’s fast request turnaround and DynamoDB’s per-partition limits makes it easier for a focused stream of requests to degrade availability for legitimate traffic.

In addition, unauthenticated or weakly authenticated endpoints can be targeted for cost exploitation, where an attacker forces expensive operations such as scans or queries with large result sets. Because DynamoDB pricing is tied to consumed capacity, repeated costly operations can inflate both latency and cost. Instrumentation and monitoring gaps between Chi request handling and DynamoDB CloudWatch metrics can delay detection, allowing an impactful DDoS pattern to persist before mitigation.

middleBrick can detect these application-layer DDoS risk patterns by scanning the Chi API surface, identifying endpoints that issue unbounded scans, lack effective rate limiting, or rely on hot key designs. Findings include severity-ranked guidance on indexing, partitioning strategies, and request validation to reduce the likelihood of availability degradation when the service is under heavy or abusive load.

Defending against DDoS-like impact in Chi with DynamoDB requires designing endpoints to use efficient key patterns, enforce usage boundaries, and fail gracefully. The following examples illustrate concrete, idiomatic approaches.

1. Use partition and sort keys to distribute load

Choose a partition key with high cardinality and distribute workloads across partitions. If natural keys are not sufficiently random, add a suffix to spread load.

open import db
open import web

let router = router do
  get "/orders/user/:userId" $ \req -> do
    let userId = param "userId" req
    -- Ensure high-cardinality suffix to avoid hot partitions
    let pk = "USER#" <> userId
    let query = Query' { keyConditionExpression = Just (pk =: userId && beginsWith sortKey "ORDER#")
                       , limit = Just 20
                       , other = mempty }
    resp <- runQuery "orders-table" query
    json resp

2. Enforce pagination and limit result set size

Prevent large scans and queries from consuming excessive capacity by using Limit and ExclusiveStartKey. Avoid scanning entire tables in request handling.

open import db

get "/search" $ \req -> do
  let maybeLastKey = paramMaybe "lastKey" req
  let limit = 50
  let baseQuery = Query' { keyConditionExpression = Nothing
                         , filterExpression = Nothing
                         , limit = Just limit
                         , exclusiveStartKey = maybeLastKey
                         , other = mempty }
  -- Use indexed queries instead of scans where possible
  results <- runQuery "items-table" baseQuery
  let nextKey = lastKey results
  json $ object ["data" .= results, "nextKey" .= nextKey]

3. Add application-level rate limiting and request validation

Reject malformed or excessive requests before they touch DynamoDB. Chi makes it straightforward to validate and bound requests.

open import web

post "/record" $ \req -> do
  body <- jsonBody req :: Handler Value
  let count = maybe 1 fromIntegral (body ^? key "count" . _Integer)
  if count <= 0 || count > 100
    then status badRequest >> json ("count must be between 1 and 100")
    else do
      -- Proceed with batched write using transaction or batchGetItem as appropriate
      resp <- runTransactionWrite "transactions-table" (write count)
      json resp

4. Use condition expressions and conditional writes to avoid lost updates

Prevent thundering herd update patterns by using conditional writes that encode versioning or expected state.

open import db

put "/reservation" $ \req -> do
  let item = Reservation { pk = "RES#123", version = 1, status = "confirmed" }
  let cond = version =. item.version
  success <- runConditionalPut "reservations-table" item cond
  if success
    then json "OK"
    else status conflict >> json "version conflict, please retry"

5. Monitor and set alarms on consumed capacity and error rates

Although not code, operational practices are essential: track ConsumedReadCapacityUnits and ConsumedWriteCapacityUnits in CloudWatch and configure alarms that trigger when utilization approaches provisioned limits or when 4xx/5xx rates increase.

By combining correct data modeling in DynamoDB with disciplined endpoint design in Chi, you reduce the surface that an attacker can exploit to degrade availability. middleBrick can surface misconfigurations and risky endpoint behaviors—such as missing pagination, lack of rate limiting, or scans on large tables—so you can address them before they impact availability under load.