"Engineers mitigated the problem by temporarily reducing gateway retries through a code change and configuring the load balancers to reject inbound Copilot Token Service requests with HTTP 403 responses."
^^ How can the LB reject a request when it hasn't hit the backend yet to known what the response would be? (eg the 403)
Inspect headers for the request you need to filter, serve the 403 from the load balancing tier
Ah ok, so the point is to protect the backend then? But by inspecting the headers are you still not hitting the backend? I guess that winds up putting way less load on the backend?
is this something that code review tool may have caught?