Back to guides

Guide · Security

API Gateway Rate Limiting in AWS

Add rate limiting to your API with AWS API Gateway. Throttling, usage plans, and per-key limits.

Rate limits support Cost and Reliability gates—especially denial-of-wallet. Primary control: Cost Optimization

Throttle before Lambda pays the bill

API Gateway can reject excess traffic at the edge of your AWS API—no handler rewrite required. Account defaults alone are not a plan: a payments webhook behind Gateway with only defaults ate Lambda capacity when a partner replayed events in a loop. Stage throttle plus a usage plan per partner key stopped the storm.

Three layers that stack

Stage / account throttle — burst and steady rate (e.g. 1k req/s). Ceiling for everyone.

Usage plans — Free vs Pro quotas (requests per day) attached to API keys. Multi-tenant friendliness lives here.

Per-method overrides — tighten expensive routes (`POST /charge`) without starving read traffic.

Wire keys to plans; don't share one key across customers if you need fair quotas.

Prove it in CloudWatch

Watch `4XXError` / throttle-related metrics and 429 rates after you ship limits. Limits that never fire might be too high; sudden 429 storms on good clients mean you undershot. Tune from data, not guesses.

APRF Authentication and Infrastructure expect abuse controls on public surfaces—Gateway throttling is the AWS-native first control. Pair with Cloudflare or app-level limits when you need IP or path rules outside API keys.

Next: Cost Optimization

Open the related pillar specification for mandatory checks, artifacts, and pass conditions. Self-attest is optional.

View Cost OptimizationSelf-attest

Related

Frequently asked questions

How do I add rate limiting to AWS API Gateway?
Set throttle limits in API Gateway (Settings or per-stage). Create usage plans and attach to API keys for per-key limits. Monitor with CloudWatch.
What is a usage plan in API Gateway?
A usage plan defines throttle and quota limits. Attach it to API keys. Each key gets its own limits. Good for multi-tenant or tiered APIs.
How do I set per-API-key rate limits?
Create a usage plan with throttle and quota. Create API keys and attach them to the usage plan. Each key gets the plan's limits.