A company publishes a Regional API (API Gateway Regional endpoint) that should be used by six U.S.-based partners who each call the API once per day to submit sales figures. After deployment, the API is receiving 1,000 requests per second from 500 different IP addresses worldwide, likely from a botnet. The company wants to protect the API while keeping costs low. Which approach best secures the API?

The correct option directly addresses the requirements for security and cost-effectiveness. An AWS WAF web ACL associated with the API Gateway can be configured with an IP allow list, permitting only the six known partner IP addresses. This immediately blocks the botnet traffic. A usage plan with a request quota, combined with API keys, ensures that even authorized partners adhere to the "once per day" call limit, preventing abuse and keeping costs low by limiting API execution. The other options are less effective or more complex. CloudFront with WAF is suitable for global distribution and caching but adds unnecessary complexity and cost for a regional API with only six U.S.-based partners. Origin Access Identity (OAI) is for S3 origins, not API Gateway. Custom headers with API keys from CloudFront are not a standard or robust way to secure API Gateway. Allowing only partner IPs directly on the API Gateway via WAF is the most straightforward and cost-effective solution for this specific scenario.