ThrottlingException: Rate exceeded

What it means

Throttling is a healthy response to load, not a fault: a service is protecting itself by refusing work it cannot absorb. The reason it is confusing on Lambda is that two entirely different throttles produce similar-looking messages, and only one of them leaves anything in your function's logs.

The first is a Lambda invocation throttle. The account's concurrency limit or the function's reserved concurrency is reached, and Lambda declines to start another execution. Your function does not run. There is no START, no REPORT, and nothing whatsoever in the log group — the evidence lives in the Throttles metric and in whatever called you. Notably this is not counted in the Errors metric either, since no invocation occurred, which is why a throttled function can look completely healthy on an errors dashboard while dropping traffic.

The second is a downstream throttle: your handler ran, called DynamoDB or KMS or STS, and that service refused. This one does appear in your logs, with a stack trace, inside a normal invocation. The fix is on your side of the call — fewer calls, better caching, or lower concurrency — rather than on Lambda's.

Two multiplication effects cause most downstream throttling. Concurrency multiplies call rate: a function making three API calls per invocation, running at 200 concurrent executions, is making six hundred concurrent calls, and a limit that was ample in testing is reached immediately at scale. And control-plane APIs have much lower limits than data-plane ones — sts:AssumeRole and GetSecretValue are the usual offenders — so calling them once per invocation rather than caching them at module scope reaches a quota long before your actual work does. The retry-then-fail sequence in the logs, and a duration inflated by backoff you never see, are what make that visible.

What it looks like in CloudWatch

This is the shape the failure arrives in: the lines of one invocation scattered among everything else the log group received at the same moment.

The panel on the right is generated by running the excerpt on the left through the same parser that powers the free web stitcher — it is what the tool actually produces for this input, not an illustration of it.

How to confirm it from the logs

Where the message appears settles which kind you have. A throttle inside an invocation — between START and REPORT, with an SDK stack trace — is a downstream service refusing your call. A Lambda invocation throttle produces no log lines at all, because the function never ran; it appears only in the Throttles metric and in the caller's own error.

For the downstream kind, look at whether retries are visible. Most AWS SDKs retry throttles automatically with backoff, so a single logged Rate exceeded usually means the SDK had already exhausted its attempts. Also check the duration on the REPORT line — invocations that spend seconds longer than usual are often paying for silent retries you never see.

Causes, most likely first

Fixes

jsimport { SecretsManagerClient, GetSecretValueCommand }
  from "@aws-sdk/client-secrets-manager";

const client = new SecretsManagerClient({});

// Fetched once per execution environment, not once per invocation.
let cached;
async function secret() {
  cached ??= await client.send(
    new GetSecretValueCommand({ SecretId: process.env.SECRET_ID })
  );
  return cached.SecretString;
}

jsimport { DynamoDBClient } from "@aws-sdk/client-dynamodb";

const client = new DynamoDBClient({
  maxAttempts: 5,
  retryMode: "adaptive"   // backoff plus client-side rate limiting
});

yamlResources:
  ProcessFunction:
    Type: AWS::Serverless::Function
    Properties:
      # Cap the fan-out so the database is never asked for more than it can take.
      ReservedConcurrentExecutions: 25

bash# Current account concurrency quota.
aws service-quotas get-service-quota \
  --service-code lambda --quota-code L-B99A9384

Also seen as

The same underlying failure, worded differently by a different runtime, SDK version, or logging layer. All of these land here — there is no separate page for each phrasing.

Related errors

Errors that show up alongside this one, or that people mistake for it.

References

• AWS Lambda Developer Guide — Lambda quotas
• AWS Lambda Developer Guide — Configuring reserved concurrency