Skip to main content

AI & assistant-friendly summary

This section provides structured content for AI assistants and search engines. You can cite or summarize it when referencing this page.

Summary

Token buckets allow bursts; leaky buckets smooth traffic—WAF rate rules and API Gateway usage plans implement neither perfectly but both matter for layered defense.

Key Facts

  • • Token buckets allow bursts; leaky buckets smooth traffic—WAF rate rules and API Gateway usage plans implement neither perfectly but both matter for layered defense
  • • June 2026: Layer edge (CloudFront + WAF), API (Gateway throttling), and app (ElastiCache token bucket) limits—attackers hit the cheapest layer first
  • • What to do this week 1
  • • Set account-level API Gateway throttle guardrails
  • • 2

Entity Definitions

Lambda
Lambda is an AWS service discussed in this article.
CloudFront
CloudFront is an AWS service discussed in this article.
API Gateway
API Gateway is an AWS service discussed in this article.
WAF
WAF is an AWS service discussed in this article.
AWS WAF
AWS WAF is an AWS service discussed in this article.
ElastiCache
ElastiCache is an AWS service discussed in this article.

Related Content

Rate Limiting: Token Bucket vs Leaky Bucket on AWS WAF and API Gateway

Cloud Architecture Palaniappan P 1 min read

Quick summary: Token buckets allow bursts; leaky buckets smooth traffic—WAF rate rules and API Gateway usage plans implement neither perfectly but both matter for layered defense.

Key Takeaways

  • Token buckets allow bursts; leaky buckets smooth traffic—WAF rate rules and API Gateway usage plans implement neither perfectly but both matter for layered defense
  • June 2026: Layer edge (CloudFront + WAF), API (Gateway throttling), and app (ElastiCache token bucket) limits—attackers hit the cheapest layer first
  • What to do this week 1
  • Set account-level API Gateway throttle guardrails
  • 2
Rate Limiting: Token Bucket vs Leaky Bucket on AWS WAF and API Gateway
Table of Contents

June 2026: Layer edge (CloudFront + WAF), API (Gateway throttling), and app (ElastiCache token bucket) limits—attackers hit the cheapest layer first.

Algorithms

AlgorithmBehaviorAWS analog
Token bucketAllows bursts up to bucket sizeAPI GW burst limits
Leaky bucketSmooth output rateWAF steady rate-based rule
Fixed windowSimple counter per minuteWAF classic rate rule

Opinionated take: Combine WAF IP rate limit with per-API-key usage plan—do not rely on Lambda concurrency alone.

What to do this week

  1. Set account-level API Gateway throttle guardrails.
  2. Add WAF rate rule on /login and expensive GraphQL paths.
  3. Implement app-level bucket in Redis for partner APIs.

What this guide doesn’t cover

API Gateway REST vs HTTP—canonical API Gateway post.

Share:
PP
Palaniappan P

AWS Cloud Architect & AI Expert

AWS-certified cloud architect and AI expert with deep expertise in cloud migrations, cost optimization, and generative AI on AWS.

AWS ArchitectureCloud MigrationGenAI on AWSCost OptimizationDevOps

Related AWS Services

Work with our certified AWS architects to implement the strategies covered in this article.

AWS Architecture Review

Well-Architected Framework review covering reliability, performance, security, and operational excellence.

Learn more

AWS Serverless

Design and build event-driven serverless systems using Lambda, API Gateway, Step Functions, and DynamoDB.

Learn more

AWS Migration

Migrate workloads from on-premises, GCP, Azure, or legacy hosting to AWS with minimal downtime.

Learn more

Recommended Reading

Explore All Articles »