---
title: Rate Limiting: Token Bucket vs Leaky Bucket on AWS WAF and API Gateway
description: Token buckets allow bursts and leaky buckets smooth traffic. WAF rate rules and API Gateway usage plans implement neither perfectly, but both matter for layered defense.
url: https://www.joinhorizon.co/blog/rate-limiting-token-bucket-leaky-bucket-aws-waf-apigw/
datePublished: 2026-06-12T00:00:00.000Z
dateModified: 2026-10-28T00:00:00.000Z
author: palaniappan-p
category: Cloud Architecture
tags: engineering-guide, api-gateway, security, aws
---

# Rate Limiting: Token Bucket vs Leaky Bucket on AWS WAF and API Gateway

> Token buckets allow bursts and leaky buckets smooth traffic. WAF rate rules and API Gateway usage plans implement neither perfectly, but both matter for layered defense.

**June 2026**: Layer **edge** (CloudFront + WAF), **API** (Gateway throttling), and **app** (ElastiCache token bucket) limits. Attackers hit the cheapest layer first.

## Symptom → mechanism → AWS control

| Production symptom                 | Mechanism                   | AWS control                                          |
| ---------------------------------- | --------------------------- | ---------------------------------------------------- |
| Burst traffic triggers scale storm | No burst allowance          | API Gateway throttle burst limit > steady rate       |
| Scrapers exhaust backend           | Per-IP unlimited requests   | WAF rate-based rules, CloudFront geo restrictions    |
| Legitimate clients throttled       | Leaky bucket too aggressive | Token bucket with per-API-key quotas via Usage Plans |

**Opinionated take:** Layer token-bucket limits at API Gateway for product quotas and WAF rate rules for abuse. Never rely on Lambda concurrency alone.

> **Benchmark pattern (hypothetical workload):** API Gateway HTTP API throttling 5K steady / 10K burst (token bucket), absorbs 30-second spike to 12K RPS; WAF rate-based rule blocks at 2K req/5min/IP for abuse, combined saves $1.4K/month vs unthrottled Lambda scale-out.

## Algorithms

| Algorithm    | Behavior                        | AWS analog                 |
| ------------ | ------------------------------- | -------------------------- |
| Token bucket | Allows bursts up to bucket size | API GW burst limits        |
| Fixed window | Count per window                | WAF rate-based rule        |
| Fixed window | Simple counter per minute       | WAF classic rate rule      |

**Opinionated take:** Combine **WAF IP rate limit** with **per-API-key usage plan**. Do not rely on Lambda concurrency alone.

## AWS services map

| Need                          | Service                              | Skip when                                 |
| ----------------------------- | ------------------------------------ | ----------------------------------------- |
| Per-API steady + burst limits | API Gateway throttling + Usage Plans | Internal VPC traffic behind NLB           |
| Per-IP abuse blocking         | WAF rate-based rules                 | Single-tenant B2B with fixed IP allowlist |
| Edge rate limiting            | CloudFront + WAF at edge             | gRPC internal mesh traffic                |

## What to do this week

1. Set account-level API Gateway throttle guardrails.
2. Add WAF rate rule on `/login` and expensive GraphQL paths.
3. Implement app-level bucket in Redis for partner APIs.

## More in This Track

Part of the **Engineering Guides** library (June 2026).

- Previous: [Part 1](https://www.joinhorizon.co/blog/oauth2-introspection-vs-jwt-validation-cognito-api-gateway/)
- Next: [Part 3](https://www.joinhorizon.co/blog/grpc-graphql-protobuf-api-contracts-aws/)
- Browse tracks: [Engineering Guides hub](https://www.joinhorizon.co/resources/engineering-guides/)

## What this guide doesn't cover

For API Gateway REST vs HTTP, see the [canonical API Gateway post](https://www.joinhorizon.co/blog/aws-api-gateway-patterns-rest-http-websocket/).

## FAQ

### Can Lambda reserved concurrency replace WAF and API Gateway throttles?
No. Attackers hit the cheapest layer first. Layer CloudFront plus WAF at the edge, API Gateway usage plans for product quotas, and an app-level Redis bucket for partner APIs. Lambda concurrency is a last backstop, not a rate-limit design.

### When should I use a token bucket versus a leaky bucket?
Token buckets allow bursts (API Gateway burst vs steady). Leaky buckets smooth output. WAF rate-based rules are neither: they count requests per IP over a fixed evaluation window (1, 2, 5, or 10 minutes). Legitimate clients need burst headroom; scrapers need per-IP WAF caps. Do not pick one layer and skip the others.

### When is a WAF per-IP rule the wrong control?
Single-tenant B2B with a fixed IP allowlist, or internal VPC traffic behind an NLB. Also skip edge WAF on gRPC mesh traffic that never faces the internet.

### What could go wrong if burst is set equal to the steady rate?
A 30-second legitimate spike becomes a scale storm or a 429 storm. Set burst above steady on the usage plan, and put abuse caps on /login and expensive GraphQL paths separately.

---

*Source: https://www.joinhorizon.co/blog/rate-limiting-token-bucket-leaky-bucket-aws-waf-apigw/*