Step 1 of 9 · Intro

Protect a public API from a traffic surge

Absorb a viral spike at the edge so your quotas hold, and throttle the right clients.

How it works

• ›API Gateway uses a token bucket: once request submissions exceed the steady-state rate and burst limits, clients receive HTTP 429 Too Many Requests and should retry with backoff.
• ›Throttling can be set lower than the account limit per stage, per method, or per client through a usage plan. AWS describes these as best-effort targets, not guaranteed ceilings.
• ›CloudFront caches only GET responses. Writes and uncacheable requests always reach the origin.
• ›Limits come from AWS documentation (default quotas in us-east-1). Where AWS publishes no figure, such as how many requests a container or database handles, the lab states its assumption on the component.

What you'll build

1. A serverless backend at 2,000 requests a second
2. CloudFront in front for a 40,000 requests a second surge
3. What clients see when the throttle is exceeded
4. How to limit one noisy client without limiting everyone
5. A write-heavy surge
6. An empty edge cache
7. What CloudFront may cache
8. Throttling per stage or method