VIA-615 AJ/AS/SB implement rate limit for using content api

ankur-jain-nhs · ankur-jain-nhs · commit 57ba501c60f7 · 2025-11-28T12:14:25.000Z
- add toNumber type converter to configs
- add the additional environment variable to only the cache hydrator lambda, as it is the only component that calls the content api
diff --git a/infrastructure/environments/dev/main.tf b/infrastructure/environments/dev/main.tf
@@ -1,15 +1,18 @@
 module "deploy_lambda" {
   source = "../../modules/deploy_lambda"
 
-  prefix                            = local.prefix
-  nodejs_version                    = local.node_version
-  cache_lambda_zip_path             = local.cache_lambda_zip_path
-  application_environment_variables = local.application_environment_variables
-  log_retention_in_days             = local.log_retention_in_days
-  default_tags                      = local.default_tags
-  alerting_sns_topic_arn            = module.deploy_monitoring.alerting_sns_topic_arn
-  account_id                        = data.aws_caller_identity.current.account_id
-  region                            = local.region
+  prefix                = local.prefix
+  nodejs_version        = local.node_version
+  cache_lambda_zip_path = local.cache_lambda_zip_path
+  application_environment_variables = merge(local.application_environment_variables,
+    {
+      CONTENT_API_RATE_LIMIT_PER_MINUTE = 120,
+  })
+  log_retention_in_days  = local.log_retention_in_days
+  default_tags           = local.default_tags
+  alerting_sns_topic_arn = module.deploy_monitoring.alerting_sns_topic_arn
+  account_id             = data.aws_caller_identity.current.account_id
+  region                 = local.region
 }
 
 module "deploy" {
diff --git a/infrastructure/environments/preprod/main.tf b/infrastructure/environments/preprod/main.tf
@@ -1,15 +1,18 @@
 module "deploy_lambda" {
   source = "../../modules/deploy_lambda"
 
-  prefix                            = local.prefix
-  nodejs_version                    = local.node_version
-  cache_lambda_zip_path             = local.cache_lambda_zip_path
-  application_environment_variables = local.application_environment_variables
-  log_retention_in_days             = local.log_retention_in_days
-  default_tags                      = local.default_tags
-  alerting_sns_topic_arn            = module.deploy_monitoring.alerting_sns_topic_arn
-  account_id                        = data.aws_caller_identity.current.account_id
-  region                            = local.region
+  prefix                = local.prefix
+  nodejs_version        = local.node_version
+  cache_lambda_zip_path = local.cache_lambda_zip_path
+  application_environment_variables = merge(local.application_environment_variables,
+    {
+      CONTENT_API_RATE_LIMIT_PER_MINUTE = 1200,
+  })
+  log_retention_in_days  = local.log_retention_in_days
+  default_tags           = local.default_tags
+  alerting_sns_topic_arn = module.deploy_monitoring.alerting_sns_topic_arn
+  account_id             = data.aws_caller_identity.current.account_id
+  region                 = local.region
 }
 
 module "deploy" {
diff --git a/infrastructure/environments/prod/main.tf b/infrastructure/environments/prod/main.tf
@@ -1,15 +1,18 @@
 module "deploy_lambda" {
   source = "../../modules/deploy_lambda"
 
-  prefix                            = local.prefix
-  nodejs_version                    = local.node_version
-  cache_lambda_zip_path             = local.cache_lambda_zip_path
-  application_environment_variables = local.application_environment_variables
-  log_retention_in_days             = local.log_retention_in_days
-  default_tags                      = local.default_tags
-  alerting_sns_topic_arn            = module.deploy_monitoring.alerting_sns_topic_arn
-  account_id                        = data.aws_caller_identity.current.account_id
-  region                            = local.region
+  prefix                = local.prefix
+  nodejs_version        = local.node_version
+  cache_lambda_zip_path = local.cache_lambda_zip_path
+  application_environment_variables = merge(local.application_environment_variables,
+    {
+      CONTENT_API_RATE_LIMIT_PER_MINUTE = 1200,
+  })
+  log_retention_in_days  = local.log_retention_in_days
+  default_tags           = local.default_tags
+  alerting_sns_topic_arn = module.deploy_monitoring.alerting_sns_topic_arn
+  account_id             = data.aws_caller_identity.current.account_id
+  region                 = local.region
 }
 
 module "deploy" {
diff --git a/infrastructure/environments/test/main.tf b/infrastructure/environments/test/main.tf
@@ -6,8 +6,9 @@ module "deploy_lambda" {
   cache_lambda_zip_path = local.cache_lambda_zip_path
   application_environment_variables = merge(local.application_environment_variables,
     {
-      ELIGIBILITY_API_ENDPOINT = "${module.deploy_fake_api.application_url}/",
-      APIM_AUTH_URL            = "${module.deploy_fake_api.application_url}/oauth2/token"
+      ELIGIBILITY_API_ENDPOINT          = "${module.deploy_fake_api.application_url}/",
+      APIM_AUTH_URL                     = "${module.deploy_fake_api.application_url}/oauth2/token",
+      CONTENT_API_RATE_LIMIT_PER_MINUTE = 120,
   })
   log_retention_in_days  = local.log_retention_in_days
   default_tags           = local.default_tags
diff --git a/src/_lambda/content-cache-hydrator/handler.ts b/src/_lambda/content-cache-hydrator/handler.ts
@@ -147,6 +147,7 @@ const runContentCacheHydrator = async (event: ContentCacheHydratorEvent) => {
   let failureCount: number = 0;
   let invalidatedCount: number = 0;
 
+  const rateLimitDelayMillis: number = 1000 / ((await config.CONTENT_API_RATE_LIMIT_PER_MINUTE) / 60);
   for (const vaccine of vaccinesToRunOn) {
     const status = await hydrateCacheForVaccine(
       vaccine,
@@ -155,6 +156,7 @@ const runContentCacheHydrator = async (event: ContentCacheHydratorEvent) => {
     );
     invalidatedCount += status.invalidatedCount;
     failureCount += status.failureCount;
+    await new Promise((f) => setTimeout(f, rateLimitDelayMillis)); // sleep
   }
 
   log.info({ context: { failureCount, invalidatedCount } }, "Finished hydrating content cache: report");
diff --git a/src/utils/config.ts b/src/utils/config.ts
@@ -19,6 +19,7 @@ export interface AppConfig {
 
   // Environment Variables in Lambda
   CONTENT_API_ENDPOINT: URL;
+  CONTENT_API_RATE_LIMIT_PER_MINUTE: number;
   ELIGIBILITY_API_ENDPOINT: URL;
   CONTENT_CACHE_PATH: string;
   CONTENT_CACHE_IS_CHANGE_APPROVAL_ENABLED: boolean;
@@ -73,6 +74,11 @@ class Config {
   private ttlExpiresAt: number = Date.now() + Config.CACHE_TTL_MILLIS;
   static readonly CACHE_TTL_MILLIS: number = 300 * 1000;
 
+  private static readonly toNumber = (value: string): number | undefined => {
+    const num = Number(value);
+    if (!Number.isNaN(num)) return num;
+    return undefined;
+  };
   private static readonly toUrl = (value: string): URL => new URL(value);
   private static readonly toBoolean = (value: string): boolean | undefined => {
     const lower = value.toLowerCase();
@@ -83,17 +89,14 @@ class Config {
   static readonly converters: Record<string, (value: string) => ConfigValue> = {
     APIM_AUTH_URL: Config.toUrl,
     CONTENT_API_ENDPOINT: Config.toUrl,
+    CONTENT_API_RATE_LIMIT_PER_MINUTE: Config.toNumber,
     ELIGIBILITY_API_ENDPOINT: Config.toUrl,
     NBS_URL: Config.toUrl,
     NHS_LOGIN_URL: Config.toUrl,
     CONTENT_CACHE_IS_CHANGE_APPROVAL_ENABLED: Config.toBoolean,
     NHS_APP_REDIRECT_LOGIN_URL: Config.toUrl,
     IS_APIM_AUTH_ENABLED: Config.toBoolean,
-    MAX_SESSION_AGE_MINUTES: (value: string) => {
-      const num = Number(value);
-      if (!Number.isNaN(num)) return num;
-      return undefined;
-    },
+    MAX_SESSION_AGE_MINUTES: Config.toNumber,
   };
 
   /**
diff --git a/test-data/config/builders.tsx b/test-data/config/builders.tsx
@@ -9,6 +9,7 @@ class ConfigBuilder {
   constructor() {
     this._configValues = {
       CONTENT_API_ENDPOINT: randomURL(),
+      CONTENT_API_RATE_LIMIT_PER_MINUTE: randomInteger(10000, 100000),
       ELIGIBILITY_API_ENDPOINT: randomURL(),
       CONTENT_API_KEY: randomString(10),
       ELIGIBILITY_API_KEY: randomString(10),
