Rate limiting CDN

[VishnuRa5]

I am trying to implement rate limiting at the CDN level in AEMaaCS.

I am testing this in an RDE using rules referenced in the Adobe documentation. However:

• The rate limit is not being triggered

• I tried multiple variations

• I expected a 429 Too Many Requests response, but never received it

• Is 429 the default HTTP error returned when a CDN rate limit is exceeded?

• Is there already a default rate limit applied at the CDN layer in AEMaaCS?

https://experienceleague.adobe.com/en/docs/experience-manager-cloud-service/content/security/traffic...

kind: "CDN"
version: "1"
data:
  trafficFilters:
    rules:
    - name: limit-requests-client-ip
      when:
        reqProperty: tier
        matches: "author|publish"
      rateLimit:
        limit: 60
        window: 10
        penalty: 300
        count: all
        groupBy:
          - reqProperty: clientIp
      action: block

Any suggestions for fine-tuning the rate-limit configuration, and is there a recommended way to test it?

Thankyou very much !!

[gkalyan]

@VishnuRa5 

Adobe's default for all custom blocking rules (including WAF and rate limits) is 406 Not Acceptable

In order to receive 429, you need to add it in the "action". like below.

action:

type: block

status: 429

RDEs do not sync CDN rules from Git, You must push them manually to environment config using Adobe I/O CLI. 

Also, try hitting the page with curl instead of directly from the browser to to see if the rule is triggering.