AWS WAF vs Cloudflare WAF
SEPT 2026 auditA comparison of AWS WAF and Cloudflare WAF built from values read directly from each provider's own documentation, with the source recorded against every figure.
The short answer
Choose AWS WAF if…
Filtering traffic that already passes through CloudFront, an Application Load Balancer or API Gateway, where the WAF attaches to what you have rather than fronting it. $5 a web ACL, $1 a rule, $0.60 a million requests, prorated hourly with no commitment.
Editorial · Palash Bagchi · approved
Choose Cloudflare WAF if…
Not thinking about it again. The WAF is a plan feature at $20 a month for Pro or $200 for Business, with nothing metered per rule or per request, so the bill is identical whether it inspects a thousand requests or a billion.
Editorial · Palash Bagchi · approved
Consider something else if…
- AWS WAF: You want one bill. Charges are explicitly in addition to CloudFront, Cognito, ALB, API Gateway, AppSync or Shield Advanced — it cannot be bought alone — and a noisy ruleset produces a second bill in CloudWatch once logging passes 500 MB per million requests.
- Cloudflare WAF: You need the SLA or PCI DSS. Both start at the $200 Business plan — the 100% uptime commitment and PCI DSS 4.0 compliance are absent from Free and Pro, which is a tenfold step up from $20 to reach them.
3 sourced criteria separate them — see where, with sources, below.
Pick the criteria you care about. The chart counts how many of them lean toward each provider — the same read as scanning the bars below, just totalled for the ones you chose.
AWS WAF 0
Cloudflare WAF 0
At a glance.
| Criterion | AWS WAF | Cloudflare WAF |
|---|---|---|
| Pricing | ||
| Entry paid plan | $5 a month per web ACL, prorated hourly, before a single rule or request. One rule takes it to $6 and the first million requests to $6.60 — and all of that is in addition to the bill for whatever it is protecting. | $20 a month for Pro billed annually, or $25 billed monthly — and $200 a month for Business. Nothing is metered on top: no per-rule charge, no per-request charge, so the WAF costs the plan and the plan costs the same whether it inspects a thousand requests or a billion. |
| Pricing model | Three meters: $5 per web ACL a month, $1 per rule a month, and $0.60 per million requests inspected at up to 48 KB each. Managed rule groups cost $10 a month each on top, and the anti-DDoS managed rule is $20. Everything is prorated hourly and there are no upfront commitments. | Bundled into a plan, not metered. The WAF and the free managed ruleset are plan features alongside SSL, image optimisation and PCI DSS 4.0 compliance, and the bill does not move with traffic — the opposite of AWS and Google, which both charge per rule and per million requests. |
| Infrastructure | ||
| Uptime SLA | 99.95% monthly uptime per AWS region, backed by service credits. Lower than Cloudflare's 100% on Business and than Cloud Armor's 99.99% for globally-scoped policies — the least generous commitment of the three cloud WAFs here. | 100% on Business and Contract plans; none published on Free or Pro. The only 100% availability commitment in this corpus — every other SLA recorded on this site is a nine followed by more nines. |
Where they differ.
Entry paid plan
- AWS WAF
- $5 a month per web ACL, prorated hourly, before a single rule or request. One rule takes it to $6 and the first million requests to $6.60 — and all of that is in addition to the bill for whatever it is protecting.
- Cloudflare WAF
- $20 a month for Pro billed annually, or $25 billed monthly — and $200 a month for Business. Nothing is metered on top: no per-rule charge, no per-request charge, so the WAF costs the plan and the plan costs the same whether it inspects a thousand requests or a billion.
Sources (2) →Sources ↓
- AWS Price List — AWS WAF, us-east-1 ↗
“$5.00 per web ACL created (prorated hourly)”
Read 2026-09-15 · official docs
- Cloudflare Plans ↗
“$20 /mo billed annually, or $25/mo billed monthly”
Read 2026-09-15 · official pricing
Pricing model
- AWS WAF
- Three meters: $5 per web ACL a month, $1 per rule a month, and $0.60 per million requests inspected at up to 48 KB each. Managed rule groups cost $10 a month each on top, and the anti-DDoS managed rule is $20. Everything is prorated hourly and there are no upfront commitments.
- Cloudflare WAF
- Bundled into a plan, not metered. The WAF and the free managed ruleset are plan features alongside SSL, image optimisation and PCI DSS 4.0 compliance, and the bill does not move with traffic — the opposite of AWS and Google, which both charge per rule and per million requests.
Sources (2) →Sources ↓
- AWS Price List — AWS WAF, us-east-1 ↗
“$0.60 per million requests processed (48KB)”
Read 2026-09-15 · official docs
- Cloudflare Plans ↗
“Web Application Firewall (WAF) Free Pro Business Contract”
Read 2026-09-15 · official pricing
Uptime SLA
99.95% monthly uptime per AWS region, backed by service credits. Lower than Cloudflare's 100% on Business and than Cloud Armor's 99.99% for globally-scoped policies — the least generous commitment of the three cloud WAFs here.
100% on Business and Contract plans; none published on Free or Pro. The only 100% availability commitment in this corpus — every other SLA recorded on this site is a nine followed by more nines.
Sources (2) →Sources ↓
- AWS WAF Service Level Agreement ↗
“make AWS WAF available with a Monthly Uptime Percentage for each AWS region, during any monthly billing cycle, of at least 99.95%”
Read 2026-09-15 · official docs
- Cloudflare Plans ↗
“Uptime SLA — — 100% 100%”
Read 2026-09-15 · official pricing
When these numbers change, hear about it. Sources are re-checked monthly; a repricing goes out as a short note.
Documented by only one.
These criteria are published by one provider and not the other. An absence here means we have not found a source, not that the feature is missing.
Questions this comparison answers.
Entry paid plan: AWS WAF or Cloudflare WAF?
AWS WAF: $5 a month per web ACL, prorated hourly, before a single rule or request. One rule takes it to $6 and the first million requests to $6.60 — and all of that is in addition to the bill for whatever it is protecting.
Cloudflare WAF: $20 a month for Pro billed annually, or $25 billed monthly — and $200 a month for Business. Nothing is metered on top: no per-rule charge, no per-request charge, so the WAF costs the plan and the plan costs the same whether it inspects a thousand requests or a billion.
Should I choose AWS WAF or Cloudflare WAF?
Pick AWS WAF if Filtering traffic that already passes through CloudFront, an Application Load Balancer or API Gateway, where the WAF attaches to what you have rather than fronting it. $5 a web ACL, $1 a rule, $0.60 a million requests, prorated hourly with no commitment.
Pick Cloudflare WAF if Not thinking about it again. The WAF is a plan feature at $20 a month for Pro or $200 for Business, with nothing metered per rule or per request, so the bill is identical whether it inspects a thousand requests or a billion.