AWS WAF charges based on the number of web access control lists (web ACLs) that you create, the number of rules that you add per web ACL, and the number of web requests that you receive. There are no upfront commitments. AWS WAF charges are in addition to Amazon CloudFront pricing, Application Load Balancer (ALB) pricing, Amazon API Gateway pricing, and/or AWS AppSync pricing.
AWS WAF
You will be charged for each web ACL that you create and each rule that you create per web ACL. In addition, you will be charged for the number of web requests processed by the web ACL.
Note 1: Price is the same across all AWS Regions.
Note 2: Price for AWS WAF Classic is same as shown in the table above.
AWS WAF uses Web ACL Capacity Units (WCUs) to calculate and control the operating resources required to process your web ACLs. WCUs for an individual rule varies according to its type and any additional configuration. WCUs do not directly affect pricing.
Managed Rule Groups through AWS Managed Rules
Bot Control is a paid AWS Managed Rules that can be added to your web ACL. You will be charged for each time Bot Control is added to your web ACL. In addition, you will be charged for the number of web requests processed by Bot Control. Bot Control charges are in addition to the AWS WAF fees described above.
Bot Control free usage tier includes 10M free requests processed by Bot Control per month.
| Resource Type | Price |
|---|---|
| Bot Control | $10.00 per month (prorated hourly) |
| Request | $1.00 per 1 million requests |
Managed Rule Groups from AWS Marketplace
When you subscribe to a managed rule group provided by an AWS Marketplace seller, you will be charged additional fees based on the price set by the seller. These charges are in addition to the AWS WAF fees described above.
Pricing examples
-
Case A: No managed rule group and 19 rules written by you
Let’s assume that you have a web application with traffic of 10 million requests per month.Web ACL charges = $5.00 * 1 = $5.00
Rule charges = $1.00 * (19 rules) = $19.00
Request charges = $0.60/million * 10 million = $6.00
Total combined charges = $30.00/month -
Case B: One managed rule group from AWS Marketplace seller and 9 rules written by you
Let’s assume that you have a web application with traffic of 10 million requests per month. In addition, let’s assume that the seller sets the price of its managed rule group at $20.00 per month (prorated hourly) and $1.20 per 1 million requests seen and processed by the managed rule group.Web ACL charges = $5.00 * 1 = $5.00
Rule charges = $1.00 * (1 managed rule group + 9 rules) = $10.00
Request charges = $0.60/million * 10 million = $6.00
Total AWS WAF charges = $21.00/monthManaged rule group charges = $20.00
Managed rule group request charges = $1.20/million * 10 million = $12.00
Total AWS Marketplace charges = $32.00/monthTotal combined charges = $53.00/month
-
Case C: One rule group containing 5 rules and 9 rules written by you
Let’s assume that you have a web application with traffic of 10 million requests per month.Web ACL charges = $5.00 * 1 = $5.00
Rule charges = $1.00 * (1 rule group + 5 rules + 9 rules) = $15.00
Request charges = $0.60/million * 10 million = $6.00
Total combined charges = $26.00/month -
Case D: Bot Control enabled on web ACL and 7 rules written by you
Let’s assume that you have a web application with traffic of 22 million requests per month.Web ACL charges = $5.00 * 1 = $5.00
Rule charges = $1.00 * (1 managed rule group + 7 rules) = $8.00
Request charges = $0.60/million * 22 million = $13.20
Total WAF charges = $26.20/monthBot Control charges = $10.00 * 1 = $10.00
Bot Control request charges = $1.00/million * (22 million requests - 10 million free requests) = $12.00
Total Bot Control charges = $22.00/month
Total combined charges = $48.20/month
-
Case E: Bot Control with scope down statement enabled on web ACL and 7 rules written by you
Let’s assume that you have a web application with traffic of 20 million requests per month. In addition, let’s assume that you have specified scope down statement to limit traffic inspected by Bot Control, resulting in 50% decrease in traffic evaluated by Bot Control.Web ACL charges = $5.00 * 1 = $5.00
Rule charges = $1.00 * (1 managed rule group + 7 rules) = $8.00
Request charges = $0.60/million * 20 million = $12.00
Total WAF charges = $25.00/monthBot Control charges = $10.00 * 1 = $10.00
Bot Control request charges = $1.00/million * (20 million requests * 50% - 10 million free requests) = $0
Total Bot Control charges = $10.00/month
Total combined charges = $35.00/month
-
Case F: Bot Control enabled on 3 web ACLs and 21 rules written by you
Let’s assume that you have multiple web applications protected by 3 web ACLs with combined traffic of 35 million requests per month.Web ACL charges = $5.00 * 3 = $15.00
Rule charges = $1.00 * (3 managed rule group + 21 rules) = $24.00
Request charges = $0.60/million * 35 million = $21.00
Total WAF charges = $60.00/monthBot Control charges = $10.00 * 3 = $30.00
Bot Control request charges = $1.00/million * (35 million requests - 10 million free requests) = $25.00
Total Bot Control charges = $55.00/monthTotal combined charges = $115.00/month
Pricing calculator
Additional pricing resources
Easily calculate your monthly costs with AWS
Additional resources for switching to AWS
Learn how to get started with AWS WAF
