Skip to content
inetGeek

AWS WAF pricing and limits

iScore49–75 · ≈#2/4
aws.amazon.com/waf · WAF and DDoS
SEPT 2026 audit

A web application firewall billed per rule and per request, charged on top of whatever AWS service it protects.

Visit AWS WAF documentation

No affiliate links, sponsored placements or paid rankings appear on this site. Ordering follows the sourced data and the stated criteria.

Entry paid plan$5 a month per web ACL, prorated hourly, before a single rule or request. One rule takes it to $6 and the first million requests to $6.60 — and all of that is in addition to the bill for whatever it is protecting.
CategoryWAF and DDoS

Reviewed by Palash BagchiUpdated 5 criteria comparedSources last checked

AWS WAF pricing at a glance

Entry paid plan
$5 a month per web ACL, prorated hourly, before a single rule or request source ↗
Pricing model
Three meters: $5 per web ACL a month, $1 per rule a month, and $0.60 per million requests inspected at up to 48 KB each source ↗
Egress over allowance
Not charged as egress, but the surcharge is the point: WAF billing is in addition to CloudFront, Cognito, Application Load Balancer, API… source ↗

First line of each sourced value. The full text is in AWS WAF pricing below.

01.Evaluation guide

Who it suits

Filtering traffic that already passes through CloudFront, an Application Load Balancer or API Gateway, where the WAF attaches to what you have rather than fronting it. $5 a web ACL, $1 a rule, $0.60 a million requests, prorated hourly with no commitment.

Consider something else if…

You want one bill. Charges are explicitly in addition to CloudFront, Cognito, ALB, API Gateway, AppSync or Shield Advanced — it cannot be bought alone — and a noisy ruleset produces a second bill in CloudWatch once logging passes 500 MB per million requests.

Editorial · Palash Bagchi · approved

Each value below links to the page it was read from, with the sentence it came from. Criteria AWS WAF does not publish are not listed.

AWS WAF pricing

3 criteria
Entry paid plan$5 a month per web ACL, prorated hourly, before a single rule or request. One rule takes it to $6 and the first million requests to $6.60 — and all of that is in addition to the bill for whatever it is protecting.
Sources (1) →
Pricing modelThree meters: $5 per web ACL a month, $1 per rule a month, and $0.60 per million requests inspected at up to 48 KB each. Managed rule groups cost $10 a month each on top, and the anti-DDoS managed rule is $20. Everything is prorated hourly and there are no upfront commitments.
Sources (1) →
Egress over allowanceNot charged as egress, but the surcharge is the point: WAF billing is in addition to CloudFront, Cognito, Application Load Balancer, API Gateway, AppSync or Shield Advanced pricing. It cannot be bought on its own, so every figure here is an increment on a bill that already exists.
Sources (1) →

Infrastructure

1 criteria
Uptime SLA99.95% monthly uptime per AWS region, backed by service credits. Lower than Cloudflare's 100% on Business and than Cloud Armor's 99.99% for globally-scoped policies — the least generous commitment of the three cloud WAFs here.
Sources (1) →

Email

1 criteria
Log retention500 MB of CloudWatch Logs and vended log ingestion included per million WAF requests. Logging beyond that is billed at CloudWatch rates, so a noisy ruleset produces a second bill in a different service.
Sources (1) →

When these numbers change, hear about it. Sources are re-checked monthly; a repricing goes out as a short note.

Confirm by email; unsubscribe from any issue. Your address goes to Kit and nowhere else — what we do with it.

AWS WAF in the news

Headlines from other publications, not checked by us · collected

Selected by a search on this company, refreshed weekly. Nobody here has verified these claims — where something material is confirmed, it is written into the page above with its source, the way every other fact on this site is.

AWS WAF pricing questions

How much does AWS WAF cost?

$5 a month per web ACL, prorated hourly, before a single rule or request. One rule takes it to $6 and the first million requests to $6.60 — and all of that is in addition to the bill for whatever it is protecting.

AWS Price List — AWS WAF, us-east-1 · read

How does AWS WAF charge?

Three meters: $5 per web ACL a month, $1 per rule a month, and $0.60 per million requests inspected at up to 48 KB each. Managed rule groups cost $10 a month each on top, and the anti-DDoS managed rule is $20. Everything is prorated hourly and there are no upfront commitments.

AWS Price List — AWS WAF, us-east-1 · read

How much does AWS WAF charge for egress?

Not charged as egress, but the surcharge is the point: WAF billing is in addition to CloudFront, Cognito, Application Load Balancer, API Gateway, AppSync or Shield Advanced pricing. It cannot be bought on its own, so every figure here is an increment on a bill that already exists.

AWS WAF Pricing · read

What uptime does AWS WAF guarantee?

99.95% monthly uptime per AWS region, backed by service credits. Lower than Cloudflare's 100% on Business and than Cloud Armor's 99.99% for globally-scoped policies — the least generous commitment of the three cloud WAFs here.

AWS WAF Service Level Agreement · read

Comments

Every page here is sourced and dated.