MDAA TS Docs
    Preparing search index...

    Interface RateLimitConfig

    Rate limiting configuration for DDoS and abuse protection.

    Rate-based rules help protect against DDoS and authenticated denial-of-service by automatically blocking IP addresses (and, optionally, individual users) that exceed a request threshold within a time window.

    IMPORTANT: Rate-based rules are evaluated before the IP allowlist rule so that an abusive but allowlisted IP (or token) is still blocked. The allowlist rule's terminating Allow action would otherwise short-circuit evaluation before any rate rule could fire. Built-in rules reserve priorities 0 (per-IP), 1 (per-user), and 2 (IP allowlist); assign any wafRules priorities of 3 or higher (10+ recommended).

    https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statement-type-rate-based.html

    // Block IPs making more than 1000 requests per minute
    rateLimit: {
      limit: 1000,
      evaluationWindowSec: 60,
    }

    // Opt out of rate limiting entirely
    rateLimit: { enabled: false }
    interface RateLimitConfig {
        enabled?: boolean;
        evaluationWindowSec?: 600 | 300 | 60 | 120;
        limit?: number;
        perUser?: PerUserRateLimitConfig;
        priority?: number;
    }
    Index

    Properties

    enabled? evaluationWindowSec? limit? perUser? priority?

    Properties

    enabled?: boolean

    Whether per-IP rate limiting is enabled. Rate limiting is on by default; set this to false to opt out (for example, when rate limiting is managed centrally via AWS Firewall Manager).

    true
    evaluationWindowSec?: 600 | 300 | 60 | 120

    Time window in seconds for counting requests. AWS WAF counts requests within this sliding window to determine if the limit is exceeded.

    300 (5 minutes)

    60, 120, 300, 600

    limit?: number

    Maximum requests allowed per IP within the evaluation window. When exceeded, the IP is blocked until the request rate drops below the limit.

    2000

    10

    2000000000

    perUser?: PerUserRateLimitConfig

    Per-user (Authorization header) rate limiting. Adds a second rate-based rule keyed on the bearer token so a single authenticated client cannot exhaust capacity even from many IPs. Applied only to REGIONAL-scoped WAFs (API Gateway).

    - per-user rate limiting enabled with default limits on REGIONAL scope
    priority?: number

    Priority for the per-IP rate limit rule in the WAF rule evaluation order. Lower numbers are evaluated first. Must be unique across all rules. Evaluated before the IP allowlist rule (priority 2) so abusive allowlisted IPs are still blocked.

    0

    Settings

    Member Visibility

    On This Page

    Properties