My organisation is adding a firewall to our test stacks, using AWS WAF. We'd like to whitelist all traffic from the SDKs we've built to facilitate requests between our services.
We thought of doing this using a custom 'X-' request header, and then using AWS WAF's regex match conditions to check it against a 'non-trivial-to-guess' pattern.
I understand that this would give a very minimal level of protection; the idea is to prevent random browsing from search engines or easy access for anyone who knows the URL(s). That is, we don't need or expect to protect against informed or motivated attackers this way.
I can't find any precedent for this online. Are there any similar examples out there, or any better ways to achieve something similar to our goals? (Not meaningful security, but a first modicum of confidence in the request's origin)