API Gateway throttling in AWS - Commands & Configuration

Introduction

API Gateway throttling helps control the number of requests your API can handle at once. It protects your backend from too much traffic and keeps your service stable.

When you want to limit how many requests a user can send to your API per second to avoid overload.

When you need to protect your backend services from sudden traffic spikes.

When you want to ensure fair usage among multiple users calling your API.

When you want to avoid extra costs caused by unexpected high traffic.

When you want to maintain consistent performance for all API users.

Config File - api-gateway-throttle.json

api-gateway-throttle.json

{
  "Type": "AWS::ApiGateway::Stage",
  "Properties": {
    "StageName": "prod",
    "RestApiId": "abc123xyz",
    "MethodSettings": [
      {
        "ResourcePath": "/*",
        "HttpMethod": "*",
        "ThrottlingRateLimit": 10,
        "ThrottlingBurstLimit": 20
      }
    ]
  }
}

This JSON configures an API Gateway stage named 'prod'.

RestApiId links to your API.

MethodSettings applies throttling to all resources and methods.

ThrottlingRateLimit sets the steady request limit per second (10 requests/sec).

ThrottlingBurstLimit allows short bursts up to 20 requests.

Commands

Creates a new API Gateway REST API named 'example-api'.

Terminal

aws apigateway create-rest-api --name example-api

Expected Output

{

    "id": "abc123xyz",

    "name": "example-api",

    "createdDate": "2024-06-01T12:00:00Z"

}

→

--name - Sets the name of the new API

Deploys the API to a stage named 'prod' so it can be accessed.

Terminal

aws apigateway create-deployment --rest-api-id abc123xyz --stage-name prod

Expected Output

{

    "id": "dep456def",

    "createdDate": "2024-06-01T12:05:00Z"

}

→

--rest-api-id - Specifies which API to deploy

→

--stage-name - Names the deployment stage

Sets the throttling rate limit to 10 requests per second for all methods in the 'prod' stage.

Terminal

aws apigateway update-stage --rest-api-id abc123xyz --stage-name prod --patch-operations op=replace,path=/methodSettings/*~1*/~1*/throttlingRateLimit,value=10

Expected Output

{

    "stageName": "prod",

    "methodSettings": {

        "*/*": {

            "throttlingRateLimit": 10

        }

    }

}

→

--patch-operations - Defines the update operation to change throttling settings

Verifies the throttling settings on the 'prod' stage.

Terminal

aws apigateway get-stage --rest-api-id abc123xyz --stage-name prod

Expected Output

{

    "stageName": "prod",

    "methodSettings": {

        "*/*": {

            "throttlingRateLimit": 10,

            "throttlingBurstLimit": 20

        }

    }

}

Key Concept

If you remember nothing else from this pattern, remember: throttling limits protect your API and backend by controlling how many requests can happen at once.

Common Mistakes

Setting throttling limits too high or too low without testing.

Too high limits can overload your backend; too low limits can block legitimate users.

Start with moderate limits and adjust based on real traffic and backend capacity.

Not applying throttling settings to all methods and resources.

Some API paths might remain unprotected and cause overload.

Use wildcard paths and methods (/* and *) to cover all API endpoints.

Forgetting to deploy the API after changing throttling settings.

Changes won't take effect until deployment, causing confusion.

Always deploy your API after updates to apply new settings.

Summary

Create an API Gateway REST API and deploy it to a stage.

Use update-stage command with patch operations to set throttling limits.

Verify throttling settings with get-stage to ensure protection is active.