# AWS WAF

Canonical: https://inetgeek.com/waf/aws-waf/

A web application firewall billed per rule and per request, charged on top of whatever AWS service it protects.

## Who it suits

Filtering traffic that already passes through CloudFront, an Application Load Balancer or API Gateway, where the WAF attaches to what you have rather than fronting it. $5 a web ACL, $1 a rule, $0.60 a million requests, prorated hourly with no commitment.

Consider something else if You want one bill. Charges are explicitly in addition to CloudFront, Cognito, ALB, API Gateway, AppSync or Shield Advanced — it cannot be bought alone — and a noisy ruleset produces a second bill in CloudWatch once logging passes 500 MB per million requests.

## iScore

68 / 100 (80% interval 64–72), rank 2 of 4 in waf — interval overlaps the next rank, so this is an ordering, not a finding.

inetGeek's own reading, computed from sourced facts against category peers by disclosed rules. Not a provider claim. Intervals are 80%; a provider with few documented facts is pulled toward the category middle rather than scored on what little is known.
Method: https://inetgeek.com/iscore/. Full output with every criterion's basis: https://inetgeek.com/scores.json. Every waf peer ranked: https://inetgeek.com/waf/aws-waf/alternatives/

- Price: 69 (63–75), weight 50%, 1 of 2 criteria scored; scored for peers, not here — undocumented or stated without a number or a yes/limited/no: free_tier
- Trust and compliance: 46 (38–53), weight 30%, 1 of 2 criteria scored; scored for peers, not here — undocumented or stated without a number or a yes/limited/no: pci_dss
- Evidence: 100 (100–100), weight 20%, 4 of 4 criteria scored

## What the documentation says

### Pricing

- Entry paid plan: $5 a month per web ACL, prorated hourly, before a single rule or request. One rule takes it to $6 and the first million requests to $6.60 — and all of that is in addition to the bill for whatever it is protecting. ([source](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/awswaf/current/us-east-1/index.json), read 2026-09-15)
- Pricing model: Three meters: $5 per web ACL a month, $1 per rule a month, and $0.60 per million requests inspected at up to 48 KB each. Managed rule groups cost $10 a month each on top, and the anti-DDoS managed rule is $20. Everything is prorated hourly and there are no upfront commitments. ([source](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/awswaf/current/us-east-1/index.json), read 2026-09-15)
- Egress over allowance: Not charged as egress, but the surcharge is the point: WAF billing is in addition to CloudFront, Cognito, Application Load Balancer, API Gateway, AppSync or Shield Advanced pricing. It cannot be bought on its own, so every figure here is an increment on a bill that already exists. ([source](https://aws.amazon.com/waf/pricing/), read 2026-09-15)

### Infrastructure

- Uptime SLA: 99.95% monthly uptime per AWS region, backed by service credits. Lower than Cloudflare's 100% on Business and than Cloud Armor's 99.99% for globally-scoped policies — the least generous commitment of the three cloud WAFs here. ([source](https://aws.amazon.com/waf/sla/), read 2026-09-15)

### Email

- Log retention: 500 MB of CloudWatch Logs and vended log ingestion included per million WAF requests. Logging beyond that is billed at CloudWatch rates, so a noisy ruleset produces a second bill in a different service. ([source](https://aws.amazon.com/waf/pricing/), read 2026-09-15)

## Compared with

- [AWS WAF vs Google Cloud Armor](https://inetgeek.com/compare/aws-waf-vs-google-cloud-armor/)
- [AWS WAF vs Cloudflare WAF](https://inetgeek.com/compare/aws-waf-vs-cloudflare-waf/)
- [AWS WAF vs Sucuri](https://inetgeek.com/compare/aws-waf-vs-sucuri/)