One client stuck in a loop used up all 30 reserved Lambda executions behind our token route. This is how we picked a WAF rate limit of 300 requests per 5 minute