Sold by: Fortinet Inc.
Deployed on AWS
The Complete OWASP Top 10 Ruleset delivers comprehensive web application protection to protect against the OWASP Top 10 web application threats
4
Overview
Video
Video 1
Video
Video 2
This listing is for AWS WAF Classic only. Fortinets WAF rulesets are based on the FortiWeb web application firewall security service signatures, and are updated on a regular basis to include the latest threat information from FortiGuard Labs. The Complete OWASP Top 10 Ruleset combines Fortinets other AWS WAF rulesets into one comprehensive package to protect web applications and to cover the entire list of OWASP Top 10 web application threats. Included are the SQLi/XSS, General and Known Exploits, and Malicious Bots rulesets.
For extended web application firewall features such as detailed trigger/event visibility, custom whitelisting and dedicated tools to fine tune and manage detections as well as detailed event visibility and AI-based behavioral attack detection you can try the FortiWeb Cloud Product: https://aws.amazon.com/marketplace/pp/prodview-rbkvcwsvcpgsk?sr=0-1&ref_=beagle&applicationId=AWSMPContessa
For more information on AWS WAF Classic, you can find documentation here: https://docs.aws.amazon.com/waf/latest/developerguide/classic-waf-chapter.html
Pricing information: Pricing consists of two dimensions:
- $30 per month for each web ACL using the Fortinet Managed Rules, per region
- $1.8 per million requests in each region
Pricing examples:
pricing example: 2x web acl in a single region (ie us-east-1)
Managed rule group charges = $60.00 (2x units for 2x web ACLs) Managed rule group request charges = $1.80/million * 10 million = $18.00 Total AWS Marketplace charges = $78.00/month
pricing example: 2x web acl in two regions (ie us-east-1 & us-east-2)
Managed rule group charges = $60.00 (2x units for 2x web ACLs) Managed rule group request charges = $1.80/million * 10 million = $18.00 Total AWS Marketplace charges = $78.00/month
pricing example: 3x web acl in two regions and one using a CloudFront (ie us-east-1, us-east-2, CloudFront)
Managed rule group charges = $90.00 (3x units for 3x web ACLs) Managed rule group request charges = $1.80/million * 10 million = $18.00 Total AWS Marketplace charges = $108.00/month
Highlights
- Complete set of all rules offered by Fortinet
- Can be configured to log, alert and/or block
- Regular updates from FortiGuard Labs
Details
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Trust Center
Access real-time vendor security and compliance information through their Trust Center powered by Drata or Vanta. Review certifications and security standards before purchase.
Buyer guide
Gain valuable insights from real users who purchased this product, powered by PeerSpot.
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Pricing is based on actual usage, with charges varying according to how much you consume. Subscriptions have no end date and may be canceled any time.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Cost/unit |
|---|---|
Charge per month in each available region (pro-rated by the hour) | $30.00 |
Charge per million requests in each available region | $1.80 |
Dimensions summary
This listing charges you two ways that work together. First, you pay a recurring monthly fee for each AWS region where you run the rules. That charge is pro-rated by the hour, so partial months cost less. Second, you pay based on usage, measured per million requests processed in each region. Your total cost combines both parts and grows as you add regions or handle more traffic. The rules pair with AWS WAF Classic to protect against OWASP Top 10 web application threats.
Top-of-mind questions for buyers
A request is a single web application call that AWS WAF Classic inspects using the Fortinet rules. The charge accrues per million inspected requests in each region. High-traffic applications generate more requests, so this part of your bill scales with the volume of traffic reaching your protected applications.
Both charges apply at the same time and appear together. The monthly per-region fee is fixed and pro-rated by the hour. The per-million-request charge grows with traffic. For high-traffic applications, request volume tends to dominate. For low-traffic sites, the monthly fee is the larger part.
Both charges apply separately in each region. You pay one monthly fee per region and one per-million-request charge per region. Adding a region adds a new monthly fee plus request charges for traffic in that region. Total cost rises with each region you add.
www.fortinet.com
Helpful?
Vendor refund policy
Non-Refundable
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
Software as a Service (SaaS)
SaaS delivers cloud-based software applications directly to customers over the internet. You can access these applications through a subscription model. You will pay recurring monthly usage fees through your AWS bill, while AWS handles deployment and infrastructure management, ensuring scalability, reliability, and seamless integration with other AWS services.
Support
Vendor support
Support offered by Fortinet. Contact Fortinet directly by email - awswaf@fortinet.com . Please see FAQ for more info.
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Updated weekly
By Cyber Security Cloud
Sentiment is AI generated from actual customer reviews on AWS and G2
Functionality
Ease of use
Customer service
Cost effectiveness
Positive reviews
Mixed reviews
Negative reviews
AI generated from product descriptions
OWASP Top 10 Coverage
Comprehensive protection against the complete OWASP Top 10 web application threats including SQLi/XSS, general exploits, known exploits, and malicious bots
Threat Signature Updates
Regular updates from FortiGuard Labs with latest threat information and security signatures
Rule-Based Detection Actions
Configurable detection modes supporting logging, alerting, and blocking capabilities
Web Application Firewall Signatures
Security signatures derived from FortiWeb web application firewall service
Threat Intelligence Integration
Rulesets regularly updated with latest threat alerts using Cyber Threat Intelligence
OWASP Top 10 Coverage
Comprehensive protection against all OWASP Top 10 Web Application Threats
Code Injection Prevention
Managed rules targeting code injection techniques including SQLi, NoSQLi, and OS command injection
Technology-Specific Vulnerability Protection
Dedicated rules for known exploits in Apache Struts2, Apache Tomcat, Oracle WebLogic, WordPress, Drupal, and Joomla
Malicious Bot Detection
Malicious Bots rulesets included for bot-based threat mitigation
OWASP Top 10 Attack Protection
Provides protection against web attacks including SQL injection, cross-site scripting (XSS), command injection, NoSQL injection, path traversal, and predictable resource exploitation.
Managed Rule Updates
Rules are written, managed and regularly updated by F5's security specialists to ensure protection against evolving threats without requiring manual intervention.
AWS WAF Integration
Rules can be attached to AWS WAF instances for immediate deployment and protection enhancement.
Automated Threat Detection
Utilizes security expertise to identify and mitigate vulnerabilities that are part of the OWASP Top 10 attack vectors.
Pay-as-You-Go Licensing Model
Rules are licensed on a consumption-based pricing structure where usage determines costs.
Standard contract
No
No
No
Customer reviews
Anonymous
Saves Time with Effective Web Attack Coverage
Reviewed on Aug 25, 2026
Review provided by G2
What do you like best about the product?
I appreciate the simplicity of usage for Fortinet Managed Rules for AWS WAF. It doesn't need much maintenance and does its job simply, which is really crucial as we are a small team of developers. It saves us time because we don't have to deal with keeping up with signature updates, and it helps manage the noise from the internet that isn't always a direct threat but can use up unnecessary capacity. I like that we can apply the group rule only where it makes sense, rather than globally, which saved a lot of time and pain.
What do you dislike about the product?
I find the rules confusing as I don't always know why something was blocked. I get an ID and label but have to infer the intent. Also, I think the documentation is pretty thin, which could definitely be improved.
What problems is the product solving and how is that benefiting you?
I save time with Fortinet Managed Rules for AWS WAF, avoiding signature management. It simplifies usage with minimal maintenance and allows rule application only where needed, reducing unnecessary resource use.
Prateek M.
Easy, Reliable AWS WAF Protection with Fortinet Managed Rules
Reviewed on Aug 24, 2026
Review provided by G2
What do you like best about the product?
What I like best about Fortinet Managed Rules for AWS WAF is how easy it is to strengthen application security without having to build and maintain every rule manually. The managed rules provide broad coverage against common web application threats, are regularly updated to address emerging vulnerabilities, and integrate smoothly with AWS WAF. This saves time for security teams while providing reliable protection and reducing the effort required for ongoing rule management.
What do you dislike about the product?
One area that could be improved is the cost, especially for larger environments with multiple applications and AWS accounts. Some rules may also require tuning to reduce false positives and fit specific application requirements. More detailed documentation, clearer rule explanations, and easier troubleshooting would make it simpler to fine-tune the rules and understand why specific requests are being blocked.
What problems is the product solving and how is that benefiting you?
Fortinet Managed Rules for AWS WAF helps us protect our web applications from common threats such as SQL injection, cross-site scripting, bots, and other malicious traffic without having to create and maintain all the security rules ourselves. The managed rules reduce the operational effort required for WAF management, improve our overall security posture, and help us respond to emerging threats more quickly. This allows our security team to focus more on higher-value security initiatives while maintaining consistent protection across AWS-hosted applications.
shubham t.
Robust Security with Easy Integration
Reviewed on Aug 22, 2026
Review provided by G2
What do you like best about the product?
I like that Fortinet Managed Rules for AWS WAF enhances firewall protection, blocking threats before they reach the application and defending against common web attacks and known CVEs. I find the integration with AWS SNS really useful because it provides real-time updates to admins, letting them quickly respond to updates. Integrating Fortinet with AWS WAF is super easy, and the documentation is helpful.
What do you dislike about the product?
I think they have everything that is needed. I dont have any dislike points to be mentioned
What problems is the product solving and how is that benefiting you?
I use Fortinet Managed Rules for AWS WAF to enhance firewall protection, blocking threats and common web attacks before they reach my application. It provides robust safety against AI-driven threats, offers seamless AWS integration, and sends real-time updates for immediate action.
Emmanuel N.
Strong AWS Protection for EC2 and S3 with Proactive Security Controls
Reviewed on Aug 21, 2026
Review provided by G2
What do you like best about the product?
I like using it as one of the AWS services to protect what I run on AWS, such as applications deployed on EC2 and assets stored in an S3 bucket. It also helps me set up security measures in advance, before requests reach my apps.
What do you dislike about the product?
I’d say there’s something I dislike: if I had to, I would disconnect myself from the service and let requests hit my app through AWS WAF as a proxy for protection.
What problems is the product solving and how is that benefiting you?
This AWS WAF service helps me improve my cybersecurity measures by reducing suspicious requests to my applications hosted on AWS S3 bucket, where I keep sensitive assets.
Accounting
Out-of-the-Box OWASP Top 10 & Bot Coverage With Self-Updating Rules
Reviewed on Aug 18, 2026
Review provided by G2
What do you like best about the product?
Honestly the best part is not having to write my own rules — it just covers the OWASP Top 10 and bots out of the box, and the rules update themselves.
What do you dislike about the product?
Mainly the UI. Policy management isn't the most intuitive, and the reporting side could be a lot better.The dashboard could be simplerBit of a learning curve at the start too.
What problems is the product solving and how is that benefiting you?
Mainly blocking common web/API attacks like SQL injection and bots. The big win is I'm not writing or maintaining custom rules — it updates itself, scales automatically.