Does AWS ALB support rate limiting?

Question

Does AWS ALB support rate limiting? 
I'm curious about whether ALB offers a feature similar to limiting the number of requests a client can make per second. Alternatively, can this functionality only be achieved through WAF or API Gateway?

Accepted Answer

Hi Kerokero,

ALB (Application Load Balancer) does not have a native rate limiting feature as you have asked in your questions.

However, there are a few ways to achieve rate limiting functionality with ALB. Let me share bit more details on that.

- Use WAF (Web Application Firewall) to configure rate-based rules. WAF allows defining rules to limit the number of requests from an IP address or for a specified time period. The rules can be associated with an ALB to filter and throttle traffic.

- Use API Gateway in front of the ALB. API Gateway supports configuring usage plans and throttling limits on a per-method or per-resource level. The throttled traffic from API Gateway can then be routed to the ALB.

- Implement custom rate limiting logic at the application level. For example, count the number of requests at the origin server level using a caching service like Redis. Return 429 (Too Many Requests) response if the request rate exceeds the configured limit.

Hope it helps

Answer

Hi There

The best way would be to use WAF (Web Application Firewall) to rate limit requests. WAF allows you to create rate-based rules that limit requests based on attributes like IP address.

https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statement-type-rate-based.html

Does AWS ALB support rate limiting?

Conteúdo relevante