Skip to content
inetGeek

AWS WAF

iScore64–72 · #2/4
aws.amazon.com/waf · WAF and DDoS
SEPT 2026 audit

A web application firewall billed per rule and per request, charged on top of whatever AWS service it protects.

Visit AWS WAF documentation
Compare AWS WAF with

No affiliate links, sponsored placements or paid rankings appear on this site. Ordering follows the sourced data and the stated criteria.

Entry paid plan$5 a month per web ACL, prorated hourly, before a single rule or request. One rule takes it to $6 and the first million requests to $6.60 — and all of that is in addition to the bill for whatever it is protecting.
CategoryWAF and DDoS

Updated 5 criteria comparedSources last checked

01.Evaluation guide

Who it suits

Filtering traffic that already passes through CloudFront, an Application Load Balancer or API Gateway, where the WAF attaches to what you have rather than fronting it. $5 a web ACL, $1 a rule, $0.60 a million requests, prorated hourly with no commitment.

Consider something else if…

You want one bill. Charges are explicitly in addition to CloudFront, Cognito, ALB, API Gateway, AppSync or Shield Advanced — it cannot be bought alone — and a noisy ruleset produces a second bill in CloudWatch once logging passes 500 MB per million requests.

Editorial · Palash Bagchi · approved

Each value below links to the page it was read from, with the sentence it came from. Criteria AWS WAF does not publish are not listed.

Pricing
3 criteria
Entry paid plan$5 a month per web ACL, prorated hourly, before a single rule or request. One rule takes it to $6 and the first million requests to $6.60 — and all of that is in addition to the bill for whatever it is protecting.
Sources (1) →
Pricing modelThree meters: $5 per web ACL a month, $1 per rule a month, and $0.60 per million requests inspected at up to 48 KB each. Managed rule groups cost $10 a month each on top, and the anti-DDoS managed rule is $20. Everything is prorated hourly and there are no upfront commitments.
Sources (1) →
Egress over allowanceNot charged as egress, but the surcharge is the point: WAF billing is in addition to CloudFront, Cognito, Application Load Balancer, API Gateway, AppSync or Shield Advanced pricing. It cannot be bought on its own, so every figure here is an increment on a bill that already exists.
Sources (1) →
  • AWS WAF Pricing ↗

    “AWS WAF charges are in addition to Amazon CloudFront pricing”

    Read 2026-09-15 · official pricing

Infrastructure
1 criteria
Uptime SLA99.95% monthly uptime per AWS region, backed by service credits. Lower than Cloudflare's 100% on Business and than Cloud Armor's 99.99% for globally-scoped policies — the least generous commitment of the three cloud WAFs here.
Sources (1) →
  • AWS WAF Service Level Agreement ↗

    “make AWS WAF available with a Monthly Uptime Percentage for each AWS region, during any monthly billing cycle, of at least 99.95%”

    Read 2026-09-15 · official docs

Email
1 criteria
Log retention500 MB of CloudWatch Logs and vended log ingestion included per million WAF requests. Logging beyond that is billed at CloudWatch rates, so a noisy ruleset produces a second bill in a different service.
Sources (1) →
  • AWS WAF Pricing ↗

    “AWS WAF includes 500 MB of CloudWatch Logs”

    Read 2026-09-15 · official pricing

When these numbers change, hear about it. Sources are re-checked monthly; a repricing goes out as a short note.

Confirm by email; unsubscribe from any issue. Your address goes to Kit and nowhere else — what we do with it.

Compare AWS WAF withAll alternatives, ranked →
AWS WAF vs Google Cloud Armor
AWS WAF vs Cloudflare WAF

Every page here is sourced and dated.