The idea is to offer a way for Clowder admins to configure ratelimits to the platforms that they manage.
See https://www.nginx.com/blog/rate-limiting-nginx/ for an example of how to configure these limits
This seems like the most obvious approach, given that NGINX is along the central entrypoint of traffic into the Clowder ecosystem.
Although NGINX configuration is notoriously complex, they do offer ratelimiting options there.
Pros:
Cons:
See https://github.com/sief/play-guard for a possible example of a generic plugin for handling this
This seems like a good idea if we can find a generic way to implement it.
That is, this is not a feasible approach if we need to add custom code to every API endpoint.
Pros:
Cons:
I looked into applying the ratelimit one level above NGINX, going to Amazon's Route53 which I believe currently handles our DNS resolution (among other things).
Sadly, it looks like Route53 applies its own ratelimiting, which is not necessarily configurable or even exposed to the user.