title: AWS WAF How to rate limit path by IP below the minimum of 2000 requests/minute
body: <p>I have a path (mysite.com/myapiendpoint for sake of example) that is both resource intensive to service, and <strong>very</strong> prone to bot abuse. I need to rate limit access to that specific path to something like 10 requests per minute per client IP address. How can this be done?</p>
  <p>I'm hosting off an EC2 instance with CloudFront and AWS WAF in front. I have the standard &quot;Rate Based Rule&quot; enabled, but its 2,000 requests per minute per IP address minimum is absolutely unusable for my application.</p>
  <p>I was considering using API Gateway for this, and have used it in the past, but its rate limiting as I understand it is not based on IP address, so bots would simply use up the limit and legitimate users would constantly be denied usage of the endpoint.</p>
  <p>My site does not use sessions of any sort, so I don't think I could do any sort of rate limiting in the server itself. Also please bear in mind my site is a one-man-operation and I'm somewhat new to AWS :)</p>
  <p>How can I limit the usage per IP to something like 10 requests per minute, preferably in WAF?</p>
  <h3>[Edit]</h3>
  <p>After more research I'm wondering if I could enable header forwarding to the origin (running node/express) and use a rate-limiter package. Is this a viable solution?</p>