# AWS WAF vs Cloudflare WAF

Canonical: https://inetgeek.com/compare/aws-waf-vs-cloudflare-waf/

Every value below is read from AWS WAF's and Cloudflare WAF's own documentation. See https://inetgeek.com/methodology/ for how.

## At a glance

| Criterion | AWS WAF | Cloudflare WAF |
| --- | --- | --- |
| Entry paid plan | $5 a month per web ACL, prorated hourly, before a single rule or request. One rule takes it to $6 and the first million requests to $6.60 — and all of that is in addition to the bill for whatever it is protecting. | $20 a month for Pro billed annually, or $25 billed monthly — and $200 a month for Business. Nothing is metered on top: no per-rule charge, no per-request charge, so the WAF costs the plan and the plan costs the same whether it inspects a thousand requests or a billion. |
| Pricing model | Three meters: $5 per web ACL a month, $1 per rule a month, and $0.60 per million requests inspected at up to 48 KB each. Managed rule groups cost $10 a month each on top, and the anti-DDoS managed rule is $20. Everything is prorated hourly and there are no upfront commitments. | Bundled into a plan, not metered. The WAF and the free managed ruleset are plan features alongside SSL, image optimisation and PCI DSS 4.0 compliance, and the bill does not move with traffic — the opposite of AWS and Google, which both charge per rule and per million requests. |
| Uptime SLA | 99.95% monthly uptime per AWS region, backed by service credits. Lower than Cloudflare's 100% on Business and than Cloud Armor's 99.99% for globally-scoped policies — the least generous commitment of the three cloud WAFs here. | 100% on Business and Contract plans; none published on Free or Pro. The only 100% availability commitment in this corpus — every other SLA recorded on this site is a nine followed by more nines. |

## Where they differ

### Entry paid plan

- AWS WAF: $5 a month per web ACL, prorated hourly, before a single rule or request. One rule takes it to $6 and the first million requests to $6.60 — and all of that is in addition to the bill for whatever it is protecting. ([source](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/awswaf/current/us-east-1/index.json))
- Cloudflare WAF: $20 a month for Pro billed annually, or $25 billed monthly — and $200 a month for Business. Nothing is metered on top: no per-rule charge, no per-request charge, so the WAF costs the plan and the plan costs the same whether it inspects a thousand requests or a billion. ([source](https://www.cloudflare.com/plans/))

### Pricing model

- AWS WAF: Three meters: $5 per web ACL a month, $1 per rule a month, and $0.60 per million requests inspected at up to 48 KB each. Managed rule groups cost $10 a month each on top, and the anti-DDoS managed rule is $20. Everything is prorated hourly and there are no upfront commitments. ([source](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/awswaf/current/us-east-1/index.json))
- Cloudflare WAF: Bundled into a plan, not metered. The WAF and the free managed ruleset are plan features alongside SSL, image optimisation and PCI DSS 4.0 compliance, and the bill does not move with traffic — the opposite of AWS and Google, which both charge per rule and per million requests. ([source](https://www.cloudflare.com/plans/))

### Uptime SLA

- AWS WAF: 99.95% monthly uptime per AWS region, backed by service credits. Lower than Cloudflare's 100% on Business and than Cloud Armor's 99.99% for globally-scoped policies — the least generous commitment of the three cloud WAFs here. ([source](https://aws.amazon.com/waf/sla/))
- Cloudflare WAF: 100% on Business and Contract plans; none published on Free or Pro. The only 100% availability commitment in this corpus — every other SLA recorded on this site is a nine followed by more nines. ([source](https://www.cloudflare.com/plans/))

## Which should you choose?

Pick AWS WAF if Filtering traffic that already passes through CloudFront, an Application Load Balancer or API Gateway, where the WAF attaches to what you have rather than fronting it. $5 a web ACL, $1 a rule, $0.60 a million requests, prorated hourly with no commitment.

Pick Cloudflare WAF if Not thinking about it again. The WAF is a plan feature at $20 a month for Pro or $200 for Business, with nothing metered per rule or per request, so the bill is identical whether it inspects a thousand requests or a billion.

Consider something else: AWS WAF — You want one bill. Charges are explicitly in addition to CloudFront, Cognito, ALB, API Gateway, AppSync or Shield Advanced — it cannot be bought alone — and a noisy ruleset produces a second bill in CloudWatch once logging passes 500 MB per million requests.

Consider something else: Cloudflare WAF — You need the SLA or PCI DSS. Both start at the $200 Business plan — the 100% uptime commitment and PCI DSS 4.0 compliance are absent from Free and Pro, which is a tenfold step up from $20 to reach them.

## Documented by only one

- Free tier: Cloudflare WAF: Yes
- Egress over allowance: AWS WAF: Not charged as egress, but the surcharge is the point: WAF billing is in addition to CloudFront, Cognito, Application Load Balancer, API Gateway, AppSync or Shield Advanced pricing. It cannot be bought on its own, so every figure here is an increment on a bill that already exists.
- Log retention: AWS WAF: 500 MB of CloudWatch Logs and vended log ingestion included per million WAF requests. Logging beyond that is billed at CloudWatch rates, so a noisy ruleset produces a second bill in a different service.
- PCI DSS: Cloudflare WAF: PCI DSS 4.0 compliance is listed as a Business-plan feature, not available on Free or Pro.

## Questions this comparison answers

**Entry paid plan: AWS WAF or Cloudflare WAF?**

AWS WAF: $5 a month per web ACL, prorated hourly, before a single rule or request. One rule takes it to $6 and the first million requests to $6.60 — and all of that is in addition to the bill for whatever it is protecting.
Cloudflare WAF: $20 a month for Pro billed annually, or $25 billed monthly — and $200 a month for Business. Nothing is metered on top: no per-rule charge, no per-request charge, so the WAF costs the plan and the plan costs the same whether it inspects a thousand requests or a billion.

**Should I choose AWS WAF or Cloudflare WAF?**

Pick AWS WAF if Filtering traffic that already passes through CloudFront, an Application Load Balancer or API Gateway, where the WAF attaches to what you have rather than fronting it. $5 a web ACL, $1 a rule, $0.60 a million requests, prorated hourly with no commitment.
Pick Cloudflare WAF if Not thinking about it again. The WAF is a plan feature at $20 a month for Pro or $200 for Business, with nothing metered per rule or per request, so the bill is identical whether it inspects a thousand requests or a billion.