...
This seems like the most obvious approach, given that NGINX is already along the central entrypoint of traffic into the Clowder ecosystem.
...
I looked into applying the ratelimit one level above NGINX, going to Amazon's Route53 which I believe currently handles our can be used to handle DNS resolution (among other things).
Sadly, it looks like Route53 applies its own ratelimiting, which is not necessarily configurable or even exposed to the user.
...