I have an issue not sure how best to solve and isn't DDoS related. We issue our product partners with a rate limit of 10,000 API requests per hour, sometimes 50,000 API requests. That's fine for us, 3 requests a second~ barely volume worth stressing about, but sometimes the partners will fire off 500 concurrent API calls per second. I don't have to want to increase our network to cope with that volume so I'm looking at options to solve this headache which limits them to 20 requests maximum per second. (There's just no reason why they would ever need more -- they have bigger processing capacity than us.. I don't want to have to increase our costs if we can avoid it).

At the moment, I'm using AWS and Elastic Load Balancer so, I'm just thinking HAProxy just doesn't fit well within the existing network layout.

Additionally, i'm not sure if I should just be solving this with a simple nginx/redis lua script. If you have any recommendations I'd love to hear how other people solve this rate limiting/throttling problem.

Even if HAproxy isn't suitable, I'd like to hear the "HAProxy" solution for it...