# AWS WAF vs Google Cloud Armor

Canonical: https://inetgeek.com/compare/aws-waf-vs-google-cloud-armor/

Every value below is read from AWS WAF's and Google Cloud Armor's own documentation. See https://inetgeek.com/methodology/ for how.

## At a glance

| Criterion | AWS WAF | Google Cloud Armor |
| --- | --- | --- |
| Entry paid plan | $5 a month per web ACL, prorated hourly, before a single rule or request. One rule takes it to $6 and the first million requests to $6.60 — and all of that is in addition to the bill for whatever it is protecting. | $0.006849315 per security-policy hour on the Standard tier — $5 a month — plus $0.001369863 per rule-hour, which is $1 a month. The hourly figures carry nine decimal places because they are a monthly price divided by 730. |
| Pricing model | Three meters: $5 per web ACL a month, $1 per rule a month, and $0.60 per million requests inspected at up to 48 KB each. Managed rule groups cost $10 a month each on top, and the anti-DDoS managed rule is $20. Everything is prorated hourly and there are no upfront commitments. | Per policy-hour, per rule-hour and per million requests on the Standard tier, with the two Enterprise tiers replacing all three with "All included" and a data processing fee instead. Enterprise Annual carries a one-year time commitment where Standard carries none. Bot management is billed separately under reCAPTCHA pricing. |
| Uptime SLA | 99.95% monthly uptime per AWS region, backed by service credits. Lower than Cloudflare's 100% on Business and than Cloud Armor's 99.99% for globally-scoped policies — the least generous commitment of the three cloud WAFs here. | 99.99% for globally-scoped security policies and 99.9% for regionally-scoped backend policies. The commitment depends on how the policy is scoped rather than on what you pay, which is unusual — every other SLA in this corpus is bought with a tier. |

## Where they differ

### Entry paid plan

- AWS WAF: $5 a month per web ACL, prorated hourly, before a single rule or request. One rule takes it to $6 and the first million requests to $6.60 — and all of that is in addition to the bill for whatever it is protecting. ([source](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/awswaf/current/us-east-1/index.json))
- Google Cloud Armor: $0.006849315 per security-policy hour on the Standard tier — $5 a month — plus $0.001369863 per rule-hour, which is $1 a month. The hourly figures carry nine decimal places because they are a monthly price divided by 730. ([source](https://cloud.google.com/armor/pricing))

### Pricing model

- AWS WAF: Three meters: $5 per web ACL a month, $1 per rule a month, and $0.60 per million requests inspected at up to 48 KB each. Managed rule groups cost $10 a month each on top, and the anti-DDoS managed rule is $20. Everything is prorated hourly and there are no upfront commitments. ([source](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/awswaf/current/us-east-1/index.json))
- Google Cloud Armor: Per policy-hour, per rule-hour and per million requests on the Standard tier, with the two Enterprise tiers replacing all three with "All included" and a data processing fee instead. Enterprise Annual carries a one-year time commitment where Standard carries none. Bot management is billed separately under reCAPTCHA pricing. ([source](https://cloud.google.com/armor/pricing))

### Uptime SLA

- AWS WAF: 99.95% monthly uptime per AWS region, backed by service credits. Lower than Cloudflare's 100% on Business and than Cloud Armor's 99.99% for globally-scoped policies — the least generous commitment of the three cloud WAFs here. ([source](https://aws.amazon.com/waf/sla/))
- Google Cloud Armor: 99.99% for globally-scoped security policies and 99.9% for regionally-scoped backend policies. The commitment depends on how the policy is scoped rather than on what you pay, which is unusual — every other SLA in this corpus is bought with a tier. ([source](https://cloud.google.com/armor/sla))

## Which should you choose?

Pick AWS WAF if Filtering traffic that already passes through CloudFront, an Application Load Balancer or API Gateway, where the WAF attaches to what you have rather than fronting it. $5 a web ACL, $1 a rule, $0.60 a million requests, prorated hourly with no commitment.

Pick Google Cloud Armor if Google Cloud workloads needing a documented availability commitment: 99.99% for globally-scoped security policies, at the same $5 per policy and $1 per rule AWS charges.

Consider something else: AWS WAF — You want one bill. Charges are explicitly in addition to CloudFront, Cognito, ALB, API Gateway, AppSync or Shield Advanced — it cannot be bought alone — and a noisy ruleset produces a second bill in CloudWatch once logging passes 500 MB per million requests.

Consider something else: Google Cloud Armor — Your policies are regional. The SLA drops to 99.9% for regionally-scoped backend policies, so the commitment depends on an architecture choice rather than on the tier you bought — and the Enterprise tiers that bundle request volume carry a one-year commitment.

## Documented by only one

- Egress over allowance: AWS WAF: Not charged as egress, but the surcharge is the point: WAF billing is in addition to CloudFront, Cognito, Application Load Balancer, API Gateway, AppSync or Shield Advanced pricing. It cannot be bought on its own, so every figure here is an increment on a bill that already exists.
- Rate limits: Google Cloud Armor: $0.60 per million requests against regionally scoped security policies on Standard. The Enterprise tiers include request volume rather than metering it, so the per-request charge disappears at the point the commitment appears.
- Log retention: AWS WAF: 500 MB of CloudWatch Logs and vended log ingestion included per million WAF requests. Logging beyond that is billed at CloudWatch rates, so a noisy ruleset produces a second bill in a different service.

## Questions this comparison answers

**Entry paid plan: AWS WAF or Google Cloud Armor?**

AWS WAF: $5 a month per web ACL, prorated hourly, before a single rule or request. One rule takes it to $6 and the first million requests to $6.60 — and all of that is in addition to the bill for whatever it is protecting.
Google Cloud Armor: $0.006849315 per security-policy hour on the Standard tier — $5 a month — plus $0.001369863 per rule-hour, which is $1 a month. The hourly figures carry nine decimal places because they are a monthly price divided by 730.

**Should I choose AWS WAF or Google Cloud Armor?**

Pick AWS WAF if Filtering traffic that already passes through CloudFront, an Application Load Balancer or API Gateway, where the WAF attaches to what you have rather than fronting it. $5 a web ACL, $1 a rule, $0.60 a million requests, prorated hourly with no commitment.
Pick Google Cloud Armor if Google Cloud workloads needing a documented availability commitment: 99.99% for globally-scoped security policies, at the same $5 per policy and $1 per rule AWS charges.