AWS WAF is priced like a subscription with a usage meter bolted on, and for most deployments the subscription part is the larger number. Ten million requests a month cost six dollars. The rules inspecting them cost nineteen. That ratio is what makes WAF bills grow when traffic does not.
Is AWS WAF free?
No, and there is no free tier on the WAF itself. The AWS WAF pricing page charges three things at once, and the first two start the moment a web ACL exists whether or not it sees traffic.
| Meter | Rate |
|---|---|
| Web ACL | $5.00 per month, prorated hourly |
| Each rule, and each rule group added to a web ACL | $1.00 per month, prorated hourly |
| Requests inspected | $0.60 per million |
| Bot Control managed rule group | $10.00 per month per web ACL, plus per-request charges |
| Fraud Control managed rule group | $10.00 per month per web ACL, plus per-request charges |
There is one free allowance, and it belongs to Bot Control rather than to WAF: "Common Bot Control includes the first 10 million requests per month for free. Targeted Bot Control includes the first 1 million requests per month for free."
Why does the rule count matter more than your traffic?
Because rules are a monthly subscription and requests are cents per million. AWS's simplest example, Case A, is a site taking ten million requests a month behind nineteen rules:
"Web ACL charges = $5.00 * 1 = $5.00 Rule charges = $1.00 * (19 rules) = $19.00 Request charges = $0.60/million * 10 million = $6.00 Total combined charges = $30.00/month"
Requests are 20% of that bill. Double the traffic and it goes to $36. Double the rules and it goes to $49. For a WAF protecting an internal or low-volume application, the request meter is close to irrelevant and the bill is effectively a per-rule licence.
The detail that surprises people is that rules inside your own rule group are billed individually, and the group is billed as well. Case C:
"Rule charges = $1.00 * (1 rule group + 5 rules + 9 rules) = $15.00"
Five rules bundled into a group cost $5, plus $1 for the group itself. Grouping rules is an organisational convenience, not a discount. The pricing page states the principle: "you will be charged for rules inside rule groups that are created by you. In addition, you will be charged $1.00 per month (prorated hourly) for each rule group or each managed rule group that you add to your web ACL."
AWS-managed rule groups are the exception that makes this bearable: adding one costs $1 for the group, not $1 for each of the rules inside it. A managed rule set is therefore dramatically cheaper per protection than writing the equivalent rules yourself.
What does AWS WAF Bot Control cost?
Enough to dwarf the WAF. There are two tiers and they differ by a factor of ten on the request charge and by a factor of ten on the free allowance, in opposite directions.
| Common Bot Control | Targeted Bot Control | |
|---|---|---|
| Subscription | $10.00 per month per web ACL | $10.00 per month per web ACL |
| Free requests | First 10 million per month | First 1 million per month |
| Per million after that | $1.00 | $10.00 |
AWS's Case D runs Common Bot Control over 22 million requests: "Bot Control request charges = $1.00/million * (22 million requests - 10 million free requests) = $12.00", for "total Bot Control charges = $22.00/month" on top of $26.20 of WAF.
Case F runs Targeted Bot Control over 35 million requests across three web ACLs, and the shape changes completely: "Bot Control charges = $10.00 * 3 = $30.00. Bot Control request charges = $10.00/million * (35 million requests - 1 million free requests) = $340.00. Total Bot Control charges = $370.00/month", against $60.00 of WAF charges. The bot protection is six times the firewall.
There is a documented way to cut it, and it is the single largest lever on this page. Case E applies a scope-down statement so that only half the traffic reaches Bot Control: "Bot Control request charges = $1.00/million * (20 million requests * 50% - 10 million free requests) = $0". Half of twenty million is ten million, which is exactly the free allowance, so the request charge goes to nothing. Scoping bot inspection to the paths that actually attract bots, rather than to every static asset request, is worth more than any other WAF optimisation.
What are the two AWS WAF charges nobody budgets for?
They are in a footnote on the pricing page, in one sentence each, and neither appears in any of the lettered examples:
"You will be charged an additional $0.20 per million requests for each 500 WCUs the Web ACL uses beyond the default allocation of 1500. In addition, you will be charged $0.30 per million requests for each additional 16KB analyzed beyond the default body inspection limit."
The WCU overage. Web ACL capacity units measure how expensive your rules are to evaluate, not how many you have. The WCU documentation confirms the threshold: "the basic price for a protection pack (web ACL) includes up to 1,500 WCUs. Using more than 1,500 WCUs incurs additional fees, according to a tiered pricing model." The ceiling is 5,000, so at worst this meter adds seven increments of $0.20 per million requests.
What pushes you past 1,500 is complexity rather than count, and the capacity of each rule statement type is published individually. AWS: "rule capacity requirements generally start at a base cost for the rule type and increase with complexity, for example, when you add text transformations before inspection or if you inspect the JSON body." A handful of regex rules with several text transformations each can outweigh dozens of simple IP-match rules. Managed rule groups carry a fixed capacity: "each rule group has an immutable capacity setting, which the owner assigns at creation", and "the WCU cost to use a rule group in a protection pack (web ACL) is always the fixed WCU setting that you defined at the rule group creation." Adding two large managed groups can consume most of the included allowance before you write a rule of your own.
The body inspection overage. $0.30 per million requests for each extra 16 KB inspected. This is the more dangerous of the two, because it scales with your traffic rather than with your configuration. An API accepting large JSON bodies, with a rule set configured to inspect them beyond the default limit, pays this on every request.
Do AWS Marketplace managed rule groups cost extra?
Yes, and on both meters. The seller's price is added to AWS's: "when you subscribe to a managed rule group provided by an AWS Marketplace seller, you will be charged additional fees based on the price set by the seller. These charges are in addition to the AWS WAF fees described earlier."
Case B prices one: a seller charging "$20.00 per month (prorated hourly) and $1.20 per 1 million requests" turns a $21.00 WAF bill into "total combined charges = $53.00/month". Note that the seller's per-request rate, $1.20 per million, is double AWS's own $0.60. The rule group also still costs $1.00 as a rule group on your web ACL.
Budget for the seller's fees as a separate line rather than as part of your WAF estimate: AWS's wording is that they are "in addition to the AWS WAF fees described earlier". They are also excluded from promotional credits, which the credit terms name explicitly: how AWS credits actually apply.
How do you cut AWS WAF cost without dropping protection?
- Scope down bot inspection. AWS's own example takes the Bot Control request charge to zero by inspecting half the traffic. Static assets, health check paths and image requests rarely need bot analysis.
- Prefer managed rule groups to hand-written rules. A managed group is $1.00 regardless of how many rules it contains. Ten equivalent rules you wrote are $10.00.
- Delete rules in COUNT mode that nobody reads. A rule left in count mode after an investigation costs the same $1.00 a month as one that blocks, and it consumes WCUs toward the 1,500 allowance.
- Consolidate web ACLs where the rule set is identical. Each web ACL is $5.00 plus its own copy of every rule, and each Bot Control subscription is per web ACL: Case F pays $30.00 in Bot Control subscriptions across three of them.
- Check your WCU usage against 1,500. It is a threshold with no console alarm attached, and crossing it changes the shape of your bill from fixed to per-request.
- Count the CAPTCHA and Challenge meters separately. CAPTCHA is billed "per ten thousand attempts analyzed" and Challenge "per million responses served", so a rule that challenges aggressively has a cost that the rule charge does not show.
Which usage types carry AWS WAF spend?
Under its own service, split across usage types for the web ACL, the rules and the request volume. Because two of those three are fixed monthly charges, WAF is one of the few services where the bill barely moves with load, and where a sudden increase almost always traces to a configuration change rather than to traffic. That makes it a good candidate for the anomaly detection comparison in AWS Budgets vs Cost Anomaly Detection: a fixed-cost service that jumps is exactly the pattern a monitor should catch.
Two adjacent charges land elsewhere. WAF logging goes to your chosen destination and is billed there, in the same way as VPC Flow Logs, so full request logging on a busy endpoint can cost more than the WAF: the destination rates are in what CloudWatch Logs actually cost. The same pattern applies to every security service that prices on what it inspects rather than on what it finds, which is why GuardDuty bills flow logs you never made. And a web ACL is always attached to something that meters separately, such as a CloudFront distribution, an Application Load Balancer or a REST API: for the load balancer case, see what an ALB LCU actually is, and note that an HTTP API cannot use WAF at all.