My application allows users to register for accounts using AWS Cognito. They can then consume protected resources accessible through API Gateway.
Can I impose rate-limiting constraints for Cognito user whoever tries to exploit the endpoint?
e.g.
limit: 10 req/sec
user-1 and user-2 submits concurrent requests
user-1: 5 req/sec user-2: 7 req/sec
I don't want the 2 req (5 + 7 - 10) from user-2 to be constrained by the limit.
API Keys and Usage Plans don't seem to cover the mentioned case, or am I missing something?