AWS WAF Pricing

AWS WAF charges are based on the number of web access control lists (web ACLs) that you create, the number of rules that you add per web ACL, and the number of web requests that you receive. There are no upfront commitments. AWS WAF charges are in addition to Amazon CloudFront pricing, AWS Cognito pricing, Application Load Balancer (ALB) pricing, Amazon API Gateway pricing, AWS AppSync pricing or AWS Shield Advanced pricing. AWS Shield Advanced customers get limited usage of AWS WAF as part of their subscription.

AWS Pricing Calculator

AWS Pricing Calculator

Calculate your AWS WAF and architecture cost in a single estimate.

Create your custom estimate now »

Pricing components

  • AWS WAF

  • You will be charged for each web ACL that you create and each rule that you create per web ACL. In addition, you will be charged for the number of web requests processed by the web ACL. Pricing may vary across AWS Regions. Monthly fees are prorated hourly. Pricing for AWS WAF Classic is the same as shown in the table below.

    You will be charged for rules inside rule groups that are created by you. In addition, you will be charged $1.00 per month (prorated hourly) for each rule group or each managed rule group that you add to your web ACL.

    * You will be charged an additional $0.20 per million requests for each 500 WCUs the Web ACL uses beyond the default allocation of 1500. In addition, you will be charged $0.30 per million requests for each additional 16KB analyzed beyond the default body inspection limit. For more information about default limits, see Developer Guide.

    AWS WAF supports standard rule actions such as Allow, Block, Count at no additional charge. You will be charged per each CAPTCHA attempt and Challenge response as per the table below.

    CAPTCHA attempt is when a user completes a CAPTCHA challenge that is submitted to AWS WAF for analysis, regardless of the outcome. A single CAPTCHA response can result in multiple attempts.

    Challenge response is when a user is served a challenge page by AWS WAF as a result of a challenge action, regardless of whether the user attempts the challenge.

  • Bot Control

  • AWS WAF Bot Control are AWS Managed Rules that gives you visibility and control over common and pervasive bot traffic that can consume excess resources, skew metrics, cause downtime or other undesired activities. Common Bot Control includes the first 10 million requests per month for free. Targeted Bot Control includes the first 1 million requests per month for free.

    The following table lists fees for additional security features that can be enabled on your web ACL. These charges are in addition to the AWS WAF fees listed in the previous table. The cost saving you receive from enabling AWS Shield Advanced resource protection does not apply to security features listed in the following table. Pricing is the same across all AWS Regions. You pay subscription fees (prorated hourly), request fees, and analysis fees where applicable.

    CAPTCHA attempt is when a user completes a CAPTCHA challenge that is submitted to AWS WAF for analysis, regardless of the outcome. A single CAPTCHA response can result in multiple attempts.

    Challenge response is when a user is served a challenge page by AWS WAF as a result of a challenge action, regardless of whether the user attempts the challenge. 

  • Fraud Control

  • AWS WAF Fraud Control are AWS Managed Rules that protects your login and sign-up pages against attacks such as credential stuffing, credential cracking and fake account creation attacks. 

    AWS WAF Fraud Control consists of Account Takeover Prevention and Account Creation Fraud Prevention. You will be charged a request fee as per the following table for the total requests analyzed by Account Takeover Prevention and Account Creation Fraud Prevention. You also pay a subscription fee of $10 per month per WebACL for using the AMR.

    CAPTCHA attempt is when a user completes a CAPTCHA challenge that is submitted to AWS WAF for analysis, regardless of the outcome. A single CAPTCHA response can result in multiple attempts. 

    Challenge response is when a user is served a challenge page by AWS WAF as a result of a challenge action, regardless of whether the user attempts the challenge.

  • DDoS Protection

  • AWS WAF DDoS Protection offers protection against Layer 7 distributed denial of service attacks. Pricing is shown in the table below.

Managed rule groups from AWS Marketplace

When you subscribe to a managed rule group provided by an AWS Marketplace seller, you will be charged additional fees based on the price set by the seller. These charges are in addition to the AWS WAF fees described earlier.

Pricing examples

Additional pricing resources

AWS Pricing Calculator

Easily calculate your monthly costs with AWS

Get pricing assistance

Contact AWS specialists to get a personalized quote