Wondering what attacks might look like in the following scenario.
I have a web service that pings an AWS lambda (behind API gateway), which makes a couple of transactions (sends email, adds to mailing list), and then POSTs a request to an API. This API is not secured with https, yet. The API is secured with an IP whitelist. The API also expects an authorization token in the request, which is passed through the HTTP Authorization Header.
So my question is, since the web service only POSTs a requests to the lambda service, then the lambda server POSTs the API, would a user be able to follow that traffic and find the API endpoint? Also is there anyway that a malicious user could sniff outgoing traffic from the lambda endpoint?
FWIW - there is no extremely sensitive information in the API, but there is some user data. This will get locked down with HTTPS before entering production, I'm just curious to know what potential attack vectors exists here.