I'd advise to set a classic rate limiting on the front load balancers, something like 6k requests per minute per IP. This works really well to stop clients fro

I'd advise to set a classic rate limiting on the front load balancers, something like 6k requests per minute per IP. This works really well to stop clients from doing this sort of things in the first place. Client devs get 429 errors for spamming the shit out of your server, they add some sleep to spread out the requests a bit. Everybody wins. You will never hear any complaint about it, it's infinitely easier for the customer to add a sleep than to figure out how to contact your support.