Token bucket is all you need

Not quite. A token. bucket alone would not prevent a retry storm if you have a chain of services A -> B -> C -> D with a failure in D, you'd end up still having A, B & C all performing retries as they cascade through the chain, albeit (yes) at your configured rate-limits (using token bucket), but you'd still end up with an amplification effect.