AWS WAF

What AWS WAF actually is

AWS WAF is Amazon's managed web application firewall. It is not a hosting product, not a server, and not a CDN — it is a rule engine that sits in front of resources you already run on AWS and inspects incoming HTTP(S) requests before they reach your application. You attach a web ACL (access control list) to an Amazon CloudFront distribution, an Application Load Balancer, an API Gateway stage, or an AppSync API, and every request is evaluated against your rules: allow, block, count, or challenge.

In our view the interesting part is what you are buying. A self-hosted WAF (ModSecurity plus a rule set on an nginx box) gives you the same basic capability, but you own rule tuning, patching, and capacity. AWS WAF gives you managed rule groups maintained by Amazon — the Core Rule Set (OWASP Top 10 coverage), SQL injection and known-bad-inputs groups, and an IP reputation list — plus rate-based rules and geographic conditions. When you put it on CloudFront, rule evaluation happens at every AWS edge location, so blocked traffic never travels to your origin. On regional resources (ALB, API Gateway, AppSync), evaluation happens in-region and also covers internal, non-public resources.

We would frame this honestly: AWS WAF is infrastructure plumbing for AWS-invested teams. If your application does not run behind CloudFront, ALB, API Gateway, or AppSync, this product does nothing for you. That constraint is the single most important fact in this review, and it is why we list it under /category/firewall-ddos as an AWS-native option rather than a general-purpose firewall.

The service launched in October 2015 and has been extended steadily since — managed rules arrived in 2019, IPv6 support earlier, and recent additions include bot control, account takeover fraud prevention, application-layer DDoS tooling, and protection packs (preconfigured rule templates for specific workload types such as APIs or PHP applications).

Pricing: what you really pay

AWS WAF pricing has three components and no upfront commitment, per Amazon's published pricing page:

• $5 per web ACL per month. A web ACL is your rule container; one per application or environment is typical.
• $1 per rule per web ACL per month. Each rule you write counts, and each rule group or managed rule group you attach also counts as one rule at $1.00 per month (prorated hourly). Marketplace rule groups from third-party sellers cost extra — AWS's own worked example assumes a seller charging $20.00 per month plus $1.20 per million requests.
• $0.60 per million web requests inspected. This is the meter that scales with traffic.

AWS's own examples make the arithmetic concrete: one web ACL with 19 hand-written rules and 10 million requests per month totals $30.00/month ($5 + $19 + $6). Add a marketplace managed rule group and the same workload costs $53.00/month combined. Rule groups bill as a single rule regardless of how many rules they contain internally, which is why the AWS-managed groups are good value — you get dozens of signatures for $1 per month.

Where we would watch the bill: capacity units and body inspection. A web ACL has a default allocation of 1,500 WCUs; every additional 500 WCUs costs $0.20 per million requests. Inspecting request bodies beyond the default 16 KB costs $0.30 per million per additional 16 KB. Bot Control is a $10 per month per WebACL subscription plus request fees that run an order of magnitude above base inspection — AWS's own example shows bot request charges of $340 for 34 million requests on top of $60 of base WAF fees. CAPTCHA and Challenge actions are also metered per attempt. A "cheap" WAF bill can become an expensive one quickly if you turn on everything.

Add-ons sit outside the WAF meter: CloudFront, ALB, or API Gateway charges still apply, and AWS Shield Advanced — the premium DDoS tier with cost protection and enhanced support — is a separate, substantial subscription. Shield Standard, the always-on network DDoS protection, is included with AWS services at no charge. We appreciate that AWS publishes real worked examples instead of a single "starting at" number; that transparency is worth something, and it is one reason we rate this product's pricing model well.

Performance & infrastructure

There is no hardware to evaluate here, so most of our usual benchmark categories do not apply. What matters instead is where inspection happens and how it is wired in. On CloudFront, WAF rules execute at every AWS edge location — several hundred points of presence — so adding the firewall does not add a meaningful round trip for end users, and malicious requests are dropped at the edge rather than consuming origin capacity. That is the strongest performance argument for AWS WAF over an origin-side WAF: at scale, blocking junk traffic before it crosses the network is a real capacity saving.

The product handles both IPv4 and IPv6 traffic; Amazon states that all features work over IPv6 without performance or availability differences. Availability is backed by a published service level agreement: AWS commits to 99.95% monthly uptime per region, with service credits of 10% to 100% of that month's WAF charges if the commitment is missed. For a security control, we consider a written SLA table with defined exclusions (downtime of the host service — CloudFront, ALB, API Gateway — is excluded) more honest than the vague "enterprise-grade reliability" language many security vendors use.

Operational tooling is genuinely deep: CloudWatch metrics at one-minute resolution, sampled raw request logs with IP, geolocation, user agent and referrer fields, logging to Kinesis Data Firehose or S3, CloudFormation templates for rule deployment, and full API coverage. Teams running many accounts can centralize rule management with AWS Firewall Manager. Everything you would expect from a platform service is there — and everything is, of course, another AWS service to learn.

On DDoS: AWS WAF itself covers application-layer (L7) events, with the FAQ describing automatic inline mitigation of L7 DDoS within seconds, and it composes with AWS Shield for network-layer attacks. It is not a substitute for Shield Advanced's cost protection if volumetric attacks are your main worry, but for most web applications the combination of WAF rate rules and Shield Standard is adequate.

Where it falls short

The rule model is powerful and fiddly in equal measure. Web ACL Capacity Units are an abstraction you must budget against; a complex rule set that looks fine in testing can exceed the 1,500 WCU default once you attach several managed groups, and the overage is billed per request, not per rule. We regularly see teams surprised by this in production.

Bot Control pricing is the other trap. At roughly $10 per month per web ACL plus per-request fees that dwarf base inspection costs, enabling bot management on a high-traffic site can multiply the bill tenfold. The example on Amazon's own pricing page — $340 of bot request charges against $60 of core WAF fees — is the clearest warning you will find.

More fundamentally: this is AWS-only. There is no equivalent for protecting an app running on a Hetzner server or a DigitalOcean droplet (see /benchmarks for those hosts). Rule authoring is JSON-based and verbose; the console has improved with guided setup and protection packs, but serious deployments still live in infrastructure-as-code and need someone who understands request inspection order, rule priority, and label-based evaluation. The product assumes you already think in AWS terms.

Lock-in deserves a mention. Rules, rule groups, logging pipelines, and Firewall Manager policies are all AWS constructs. Migrating a mature WAF configuration to another provider means rebuilding it. We do not consider that disqualifying for an AWS-native tool, but it should be a conscious choice rather than a surprise.

Who should pick this

We would pick AWS WAF when the application already runs on CloudFront, ALB, or API Gateway and you want OWASP-level protection without operating WAF infrastructure yourself. It is the default choice for teams with compliance checkboxes that require a managed WAF, teams standardizing on infrastructure-as-code, and any deployment where edge-blocking matters — consumer-facing properties absorbing scrapers and credential-stuffing traffic are the canonical case.

We would not pick it for a small site on a budget where the traffic meter is unpredictable, for organizations without AWS skills on the team, or for anyone whose stack is not on AWS. A simpler reverse-proxy WAF or a CDN with a bundled firewall can be cheaper and less to learn at small scale. And if you need multi-cloud or multi-provider policy enforcement from one console, a dedicated WAF vendor will beat an AWS-only tool on breadth.

Our practical advice: start with the free AWS managed rule groups (Core Rule Set, SQL injection, known bad inputs, IP reputation — all included at $1 per group per month), add rate-based rules before you consider marketplace rules or Bot Control, and instrument the bill the same week you deploy.

Key takeaways

• AWS WAF inspects HTTP requests in front of CloudFront, ALB, API Gateway, and AppSync — nothing outside the AWS ecosystem is protected.
• Pricing is metered and transparent: $5 per web ACL, $1 per rule, $0.60 per million requests, with AWS's own worked examples published.
• Managed rule groups bill as one rule each, so the OWASP-focused AWS rule sets cost a few dollars a month — the best value in the product.
• Watch capacity-unit overages and Bot Control fees; per-request add-ons can dominate the bill at high traffic.
• Published SLA of 99.95% monthly uptime per region, with defined service credits — unusually concrete for a security control.
• On CloudFront, rules run at every edge location, so blocking bad traffic happens before it reaches your origin.

Sources

• https://aws.amazon.com/waf/pricing
• https://aws.amazon.com/waf/faqs
• https://aws.amazon.com/waf/sla
• https://aws.amazon.com/waf/features
• https://aws.amazon.com/blogs/aws/tag/aws-web-application-firewall
• https://aws.amazon.com/about-aws/whats-new/2019/03/aws-waf-and-shield-advanced-now-available-in-four-new-regions
• https://docs.aws.amazon.com/waf/latest/developerguide/doc-history.html
• https://wring.co/blog/aws-waf-pricing-guide