Question

A company exposes a public REST API through Amazon API Gateway to several partner organizations. Each partner has purchased a different subscription tier, and the company must enforce a distinct monthly request quota and per-second rate limit for each partner while identifying which partner made each call. The solution should require minimal custom code. What should the solutions architect implement?

Accepted Answer

Create an API Gateway usage plan for each tier with the appropriate throttle and quota limits, generate an API key per partner, and associate each key with the correct usage plan.

Answer

Deploy an Application Load Balancer in front of API Gateway and configure listener rules that rate-limit traffic based on the partner's source IP address.

Answer

Place an Amazon SQS queue in front of the API and set a different maximum receive rate for each partner to control their throughput.

Answer

Write a Lambda authorizer that tracks each partner's request count in a DynamoDB table and rejects requests once a hard-coded monthly limit is exceeded.