Skip to content
inetGeek

AWS WAF vs Google Cloud Armor

SEPT 2026 audit

A comparison of AWS WAF and Google Cloud Armor built from values read directly from each provider's own documentation, with the source recorded against every figure.

Updated 6 criteria comparedSources last checked

The short answer

Choose AWS WAF if…

Filtering traffic that already passes through CloudFront, an Application Load Balancer or API Gateway, where the WAF attaches to what you have rather than fronting it. $5 a web ACL, $1 a rule, $0.60 a million requests, prorated hourly with no commitment.

Editorial · Palash Bagchi · approved

Choose Google Cloud Armor if…

Google Cloud workloads needing a documented availability commitment: 99.99% for globally-scoped security policies, at the same $5 per policy and $1 per rule AWS charges.

Editorial · Palash Bagchi · approved

Consider something else if…

  • AWS WAF: You want one bill. Charges are explicitly in addition to CloudFront, Cognito, ALB, API Gateway, AppSync or Shield Advanced — it cannot be bought alone — and a noisy ruleset produces a second bill in CloudWatch once logging passes 500 MB per million requests.
  • Google Cloud Armor: Your policies are regional. The SLA drops to 99.9% for regionally-scoped backend policies, so the commitment depends on an architecture choice rather than on the tier you bought — and the Enterprise tiers that bundle request volume carry a one-year commitment.

3 sourced criteria separate them — see where, with sources, below.

Visit AWS WAF documentationVisit Google Cloud Armor documentation

No affiliate links, sponsored placements or paid rankings appear on this site. Ordering follows the sourced data and the stated criteria.

01.

At a glance.

CriterionAWS WAFGoogle Cloud Armor
Pricing
Entry paid plan$5 a month per web ACL, prorated hourly, before a single rule or request. One rule takes it to $6 and the first million requests to $6.60 — and all of that is in addition to the bill for whatever it is protecting.$0.006849315 per security-policy hour on the Standard tier — $5 a month — plus $0.001369863 per rule-hour, which is $1 a month. The hourly figures carry nine decimal places because they are a monthly price divided by 730.
Pricing modelThree meters: $5 per web ACL a month, $1 per rule a month, and $0.60 per million requests inspected at up to 48 KB each. Managed rule groups cost $10 a month each on top, and the anti-DDoS managed rule is $20. Everything is prorated hourly and there are no upfront commitments.Per policy-hour, per rule-hour and per million requests on the Standard tier, with the two Enterprise tiers replacing all three with "All included" and a data processing fee instead. Enterprise Annual carries a one-year time commitment where Standard carries none. Bot management is billed separately under reCAPTCHA pricing.
Infrastructure
Uptime SLA
99.95% monthly uptime per AWS region, backed by service credits. Lower than Cloudflare's 100% on Business and than Cloud Armor's 99.99% for globally-scoped policies — the least generous commitment of the three cloud WAFs here.
99.99% for globally-scoped security policies and 99.9% for regionally-scoped backend policies. The commitment depends on how the policy is scoped rather than on what you pay, which is unusual — every other SLA in this corpus is bought with a tier.

Only criteria both providers publish appear here; a tinted cell marks a real difference. Criteria only one of them documents are listed below, and an absence there means we found no source — not that the feature is missing. How we source this.

The small bar above a value is inetGeek's own lean toward that side — computed from the same facts shown, never a number the provider published. See the picker below "The short answer" to weigh only the criteria you care about.

02.

Where they differ.

Entry paid plan

AWS WAF
$5 a month per web ACL, prorated hourly, before a single rule or request. One rule takes it to $6 and the first million requests to $6.60 — and all of that is in addition to the bill for whatever it is protecting.
Google Cloud Armor
$0.006849315 per security-policy hour on the Standard tier — $5 a month — plus $0.001369863 per rule-hour, which is $1 a month. The hourly figures carry nine decimal places because they are a monthly price divided by 730.
Sources (2) →

Pricing model

AWS WAF
Three meters: $5 per web ACL a month, $1 per rule a month, and $0.60 per million requests inspected at up to 48 KB each. Managed rule groups cost $10 a month each on top, and the anti-DDoS managed rule is $20. Everything is prorated hourly and there are no upfront commitments.
Google Cloud Armor
Per policy-hour, per rule-hour and per million requests on the Standard tier, with the two Enterprise tiers replacing all three with "All included" and a data processing fee instead. Enterprise Annual carries a one-year time commitment where Standard carries none. Bot management is billed separately under reCAPTCHA pricing.
Sources (2) →

Uptime SLA

AWS WAF

99.95% monthly uptime per AWS region, backed by service credits. Lower than Cloudflare's 100% on Business and than Cloud Armor's 99.99% for globally-scoped policies — the least generous commitment of the three cloud WAFs here.

Google Cloud Armor

99.99% for globally-scoped security policies and 99.9% for regionally-scoped backend policies. The commitment depends on how the policy is scoped rather than on what you pay, which is unusual — every other SLA in this corpus is bought with a tier.

Sources (2) →

When these numbers change, hear about it. Sources are re-checked monthly; a repricing goes out as a short note.

Confirm by email; unsubscribe from any issue. Your address goes to Kit and nowhere else — what we do with it.

03.

Documented by only one.

These criteria are published by one provider and not the other. An absence here means we have not found a source, not that the feature is missing.

Egress over allowanceAWS WAF: Not charged as egress, but the surcharge is the point: WAF billing is in addition to CloudFront, Cognito, Application Load Balancer, API Gateway, AppSync or Shield Advanced pricing. It cannot be bought on its own, so every figure here is an increment on a bill that already exists.
Rate limitsGoogle Cloud Armor: $0.60 per million requests against regionally scoped security policies on Standard. The Enterprise tiers include request volume rather than metering it, so the per-request charge disappears at the point the commitment appears.
Log retentionAWS WAF: 500 MB of CloudWatch Logs and vended log ingestion included per million WAF requests. Logging beyond that is billed at CloudWatch rates, so a noisy ruleset produces a second bill in a different service.
04.

Questions this comparison answers.

Entry paid plan: AWS WAF or Google Cloud Armor?

AWS WAF: $5 a month per web ACL, prorated hourly, before a single rule or request. One rule takes it to $6 and the first million requests to $6.60 — and all of that is in addition to the bill for whatever it is protecting.

Google Cloud Armor: $0.006849315 per security-policy hour on the Standard tier — $5 a month — plus $0.001369863 per rule-hour, which is $1 a month. The hourly figures carry nine decimal places because they are a monthly price divided by 730.

Should I choose AWS WAF or Google Cloud Armor?

Pick AWS WAF if Filtering traffic that already passes through CloudFront, an Application Load Balancer or API Gateway, where the WAF attaches to what you have rather than fronting it. $5 a web ACL, $1 a rule, $0.60 a million requests, prorated hourly with no commitment.

Pick Google Cloud Armor if Google Cloud workloads needing a documented availability commitment: 99.99% for globally-scoped security policies, at the same $5 per policy and $1 per rule AWS charges.

Provider pages

AWS WAFA web application firewall billed per rule and per request, charged on top of whatever AWS service it protects.Google Cloud ArmorGoogle Cloud's web application firewall and DDoS protection, billed per policy-hour, per rule-hour and per million requests.

Related comparisons

AWS WAF vs Cloudflare WAFAWS WAF vs SucuriGoogle Cloud Armor vs Cloudflare WAFGoogle Cloud Armor vs SucuriCloudflare WAF vs Sucuri

Every page here is sourced and dated.