The original author claims this is to prevent API gateway from leaking the true client IP.
So, it's set as a header, sent to a user owned proxy, then to the actual external endpoint.
On the other hand I think the receiving API Gateway will be able to see and log your AWS account identifier when you do this. So your IP may not be the only identifying information that needs to be obscured for this to actually work.
# Auto generate random X-Forwarded-For if doesn't exist.
# Otherwise AWS forwards true IP address in X-Forwarded-For header
x_forwarded_for = request.headers.get("X-Forwarded-For")
if x_forwarded_for is None:
x_forwarded_for = ipaddress.IPv4Address._string_from_ip_int(randint(0, MAX_IPV4))
The DOGE guy just stripped the comments out.You can take a look at plugins like IPRotate. We are currently working on bringing that into our product.
Even this example if you maxx out your usage of regions appears to only give (2,4 * num_regions) or let's say 70-80 ip's maximum. And they are AWS ip's, which means it is gonna be really easy to detect and block that traffic.
But if you know your target receives lots of traffic from AWS systems all around the world ... this is a good way to mimic that.