Marketing send-storms that don’t blow up the downstream.

The fan-out had been instant: campaign starts, every recipient gets queued, every queued message immediately fires a downstream request. The downstream rate-limits, then errors, then circuit-breaks. The campaign that finished in eight minutes also caused 90 minutes of webhook delivery failures.

We placed an SQS queue between the campaign engine and the downstream callers, with a Lambda consumer whose concurrency was bounded to a downstream-friendly rate. Token buckets per third-party provider absorbed their published rate limits. DLQ captured the few permanent failures for human review.

Burst-induced failures dropped to zero. P95 send latency went up about 7 seconds — the campaign now takes 15 minutes instead of 8, which the marketing customers couldn’t tell apart. The 24-hour throughput is the same; we just spread it over the available downstream capacity.