Stop API Gateway Rate Limit Abuse Alerts Fast

You're getting rate limit abuse alerts, and they're driving you crazy

I know this error is infuriating. It shows up as 'Rate Limit Abuse Detected' in your AWS CloudWatch alarms, and suddenly your API starts returning 429 errors to legit users. You're not alone — this tripped me up the first time too, back when I ran a help desk blog and had to explain it to angry clients.

The fix is straightforward once you know where to look. Let's get into it.

The real fix: check your rate limit threshold and burst limit

First, log into the AWS Management Console and open API Gateway. Find your API, then go to the Stages tab. Click on the stage that's having issues (like 'prod' or 'v1').

Scroll down to Settings and look at these two numbers:

• Rate limit: This is how many requests per second your API can handle. The default is 10,000 requests per second. That's a lot for most apps.
• Burst limit: This is how many requests your API can handle in a short burst, like a spike. Default is 5,000 requests.

If you're seeing abuse alerts, it's often because your burst limit is set too low for your traffic pattern. For example, if you have a flash sale or a news post that goes viral, you'll get a sudden spike of 6,000 requests in one second. Your burst limit of 5,000 will trigger the alert.

Here's the command to check your current settings using the AWS CLI (if you prefer the command line):

aws apigateway get-stage --rest-api-id YOUR_API_ID --stage-name prod

And a quick way to increase the burst limit:

aws apigateway update-stage --rest-api-id YOUR_API_ID --stage-name prod --patch-operations op=replace,path=/settings/throttlingBurstLimit,value=10000

I set mine to 10,000 when I had a similar issue, and the alerts stopped immediately.

Why this works

API Gateway uses rate limiting to protect your backend from being overloaded. When a user or bot sends too many requests too fast, the gateway starts returning 429 errors and triggers an abuse alert. The problem is that the default burst limit often doesn't match real-world traffic patterns.

Think about it: your users don't arrive in a steady stream. They come in waves. A single user refreshing a page 10 times in 2 seconds can look like abuse to the system. But raising the burst limit to a reasonable level (based on your actual peak traffic) lets legitimate traffic through without triggering false alerts.

Also, check your WAF (Web Application Firewall) rules if you use them. Sometimes the WAF rate limiting is stricter than the API Gateway one. Go to the WAF console, find the web ACL attached to your API, and look at rate-based rules. The default is often 2,000 requests per 5 minutes per IP. That's easy to hit if you have shared IPs (like a corporate office behind a single public IP).

Less common variations of the same issue

1. Bot traffic from search engines

Googlebot and other crawlers can hit your API hard, especially if you have a lot of pages. I've seen this kill APIs that never had problems before. The fix is to add a rate limit exception for known crawler IPs in your WAF. You can find Google's IP ranges on their official page.

2. Mobile app retries gone wild

If your mobile app has a bug where it retries failed requests too aggressively, you'll get rate limit abuse alerts. Check your app's retry logic. Set a maximum of 3 retries with exponential backoff (like waiting 1 second, then 2, then 4).

3. DDoS attacks on the cheap

Some small attacks don't hit the 10,000 RPS limit but still set off your alerts because they target a single endpoint. In this case, use AWS Shield Advanced. Yes, it costs $3,000 a month, but if you're under a real attack, it's worth it. For the rest of us, the free tier of Shield with WAF rate limiting is enough.

How to prevent this from happening again

Here's what I do every time now:

1. Monitor your actual traffic for a week. Use CloudWatch metrics for API Gateway. Look at the Count metric and find your peak requests per second. Then set your burst limit to 1.5x that peak.
2. Set up a CloudWatch alarm on 429 errors. If you start getting real 429 errors (not just alerts), you'll know something is wrong. Set the alarm to trigger at 10% of your total requests.
3. Use a CDN like CloudFront in front of your API. CloudFront can cache responses and absorb a lot of traffic before it hits your API Gateway. This is a game-changer for rate limiting.
4. Test with a load testing tool. Use something like ab (Apache Benchmark) or k6 to simulate traffic and see where your limits break.

One last thing: if you're using a third-party API gateway (like Kong or Apigee), the same concepts apply. Check your rate limits, burst limits, and WAF rules. The fix is always the same — match your limits to your real traffic.

That's it. Go change those burst limits, and you'll stop seeing those abuse alerts. Trust me, it's the most common fix. If you still have issues after that, check your WAF and your app's retry logic. Good luck.