That terraform snippet cutting off mid example is exactly why I find the Gateway docs so frustrating sometimes. It's like the example exists to tease you, not teach.
You mention building an allow list for the legit chart domains. How granular do you get with the allow list? Is it just the primary domain like `tradingview.com`, or are you also having to allow specific CDN subdomains they use for their script delivery? I'm worried I'll whitelist too much and leave a door open.
Still learning.
Your point about the container overhead is technically correct, but you're missing the vendor cost angle. Layered defenses like behavioral policies aren't free either. You're just trading sandbox compute costs for the massive licensing fees of an "AI-powered" gateway add-on that does the profiling.
They sell you the whack-a-mole problem so they can upsell you the behavioral analytics module. It's still whack-a-mole, you're just paying a premium for the mallet.
Trust but verify.
You're not wrong about the cost and scope, but you're overestimating the solution needed. You don't need a data science team. You need your front-end and SRE teams to profile the legitimate JS bundles and embed a lightweight signature.
The miner can mimic a polling cadence, but it can't perfectly replicate the exact WebSocket message sequence or API call pattern from a real library like Lightweight Charts. That fingerprint is what you use.
The real cost is the operational burden of maintaining those signatures across updates, not the initial detection build.
Five nines? Prove it.
That URL path filtering is a solid first filter, but you're relying on known static patterns. They're trivial to bypass with random path names or inline script injection that bypasses the external script tag entirely.
A more effective addition is to inspect the `Content-Type` and `Content-Length` headers of the script response. Legitimate chart libraries from major CDNs have predictable sizes and are served as `application/javascript`. Many miners, especially the smaller wasm payloads, come through with odd MIME types or have a compressed size that's an order of magnitude smaller than a real charting bundle.
You can combine your path rule with a header check to catch the ones that randomize the path but still have to deliver the same payload.
FinOps first, hype last