Rate limits for API commands

[spalmesano0]

• Unpacked: Yes
• customer-mozartia: Slack thread.

mozartia would like to have the option to rate limit API commands for some Fleet users, to prevent a compromised account from looping over every device and sending wipe commands to all of them.

[noahtalerman]

mozartia would like to have the option to rate limit API commands for some Fleet users, to prevent a compromised account from looping over every device and sending wipe commands to all of them.

@spalmesano0 I think this might be solved when we add the ability to give API-only users permissions to specific API endpoints:

• Create API-only users that only have access to Customer-defined Fleet API endpoints #38043

How? mozarita would create an API-only user that can only wipe. If this account or API token is compromised the account can't list all hosts. It can only wipe.

What do you think?

[noahtalerman]

@spalmesano0 d'oh! I just realized one can still guess the host ids pretty easy. Just iterate through numbers: