Security & Privacy / Web Application Firewall (WAF) Software
AWS WAF Review, Pricing, Pros & Cons
AWS WAF is a cloud-native web application firewall for CloudFront and supported regional AWS resources, priced by web ACLs, rules or attached rule groups, and inspected requests, with separately charged intelligent threat-mitigation features.
Research by Global Tool Radar Research SystemEvidence checked: Aug 12, 2026AI-assisted · No Global Tool Radar hands-on testView research methodology
A compact view of who this tool fits, what it costs, and what to confirm before choosing it.
Best for
Your applications already use supported AWS delivery or application services: AWS WAF attaches directly to CloudFront globally and to supported regional resources without a separate appliance or proxy fleet.
You need programmable custom rules plus maintained managed rule groups: The service combines custom matching, rate-based controls, AWS Managed Rules, rule action overrides, labels, APIs, and CloudFormation support.
More buying conditions
You want AWS-native traffic evidence and automation: AWS WAF provides per-minute CloudWatch metrics, request sampling, detailed logs to three AWS destinations, CloudTrail administration records, and API-based management.
Not for
You need direct protection for arbitrary infrastructure without placing it behind a supported AWS resource: AWS WAF evaluates requests forwarded by supported AWS resources; non-AWS origins require a supported front door such as CloudFront.
You need complete API discovery, posture, testing, and runtime context: AWS WAF protects supported HTTP(S), REST, and GraphQL entry points with rules; public evidence does not establish a full API security lifecycle platform.
More buying conditions
You require one predictable price across CDN, hosting, logging, central management, and DDoS response: Ordinary AWS WAF is component-priced and adjacent AWS services, excess logging, Firewall Manager, Shield, and optional WAF defenses have separate cost boundaries.
Pricing
AWS WAF is a no-upfront-commitment, pay-as-you-go service. Base cost is composed from each web ACL, each rule or attached rule group, and inspected requests. Capacity above 1,500 WCU, body inspection beyond each resource's default, interactive actions, intelligent threat mitigation, and seller-managed rule groups can add charges.
AWS WAF pay-as-you-go · $5.00 USD · per web ACL · per month · Web ACL monthly component · usage based · no commitment
Free or trial access
No permanent free AWS WAF plan or time-limited AWS WAF trial is publicly stated.
Product scope
Product functionality and purchase scope
The evaluated product is the current AWS WAF pay-as-you-go service: web ACLs, custom and AWS managed rules, request inspection, actions, metrics, logging connections, APIs, and optional AWS WAF threat-mitigation capabilities on supported AWS resources.
Product checked: Aug 12, 2026
Functionality reviewed
AWS WAF web ACLs, custom rules, rule groups, and AWS Managed Rules
CloudFront global-scope AWS WAF associations
Regional AWS WAF associations for Application Load Balancer, API Gateway REST APIs, AppSync GraphQL APIs, Cognito user pools, App Runner services, and Verified Access instances
Amazon CloudFront delivery and flat-rate plan bundles
Application Load Balancer, API Gateway, AppSync, Cognito, App Runner, Verified Access, and other hosting-service charges
AWS Shield Standard and AWS Shield Advanced
AWS Firewall Manager and AWS Config
AWS Marketplace seller-owned managed rule group subscriptions
Amazon CloudWatch, Amazon S3, Amazon Data Firehose, and Security Lake charges outside stated WAF allowances
Purchase paths
Pricing checked: Aug 12, 2026
Amazon CloudFront flat-rate pricing plans: A separate CloudFront bundle can cover the associated AWS WAF web ACL, bounded custom and AWS Managed Rules, request fees, and associated WAF log ingestion. Its Free, Pro, Business, and Premium tiers are CloudFront plans, not AWS WAF plans, and their WAF rule limits and eligibility rules apply.
AWS Shield Advanced: A separate one-year DDoS protection subscription includes specified base AWS WAF web ACL, rule, and request fees for Shield-protected resources up to 50 billion monthly requests per payer organization. Bot Control, Fraud Control, capacity above 1,500 WCU, and managed-rule fees remain chargeable.
AWS Firewall Manager: A separate central-policy service can create and enforce AWS WAF policies across AWS Organizations accounts and resources. Firewall Manager policy and AWS Config charges are separate, and ordinary AWS WAF charges continue unless a supported Shield Advanced entitlement changes them.
Pricing plans
AWS WAF pricing table
Pricing checked: Aug 12, 2026
Official factConfidence 100%2 linked sources
The only exact-target core offer is AWS WAF pay-as-you-go. Monthly web ACL and rule fees are prorated hourly, but AWS does not state an invoice cadence. AWS WAF charges sit on top of the protected resource's service charges. Bot Control, Fraud Control, AWS WAF DDoS Protection, CAPTCHA, Challenge, excess WCU, larger body inspection, log overages, and seller-priced Marketplace rule groups can materially increase spend. CloudFront flat-rate plans, Shield Advanced, and Firewall Manager are separate products with their own commercial terms.
$5.00 USD · per web ACL · per month · Web ACL monthly component · usage based · no commitment
$1.00 USD · per rule or attached rule group · per month · Rule and rule-group monthly component · usage based · no commitment · Rules inside customer-created rule groups are also charged individually
$0.60 USD · per 1 million requests · per usage unit · Base request component · usage based · no commitment · Base rate before excess WCU, larger body inspection, and optional feature charges
Teams protecting supported AWS-delivered HTTP(S) applications and APIs that want usage-aligned pricing and direct control over rules, capacity, and optional defenses.
Variable usage cost
Usage cost scenarios
Calculate additional usage only where the plan allowance, unit, and period are established. Published rates are shown separately when an estimate is not available.
Web ACL capacity above 1,500 WCU
$0.20 USD / 1,000,000 requests for each additional 500 WCUs
Published rate only. The plan allowance, matching unit, or billing period is not fully established, so extra cost cannot be calculated. An unknown allowance is not zero. Check the base subscription and any required products separately.
Request body inspection beyond the service default
$0.30 USD / 1,000,000 requests for each additional 16 KB analyzed
Published rate only. The plan allowance, matching unit, or billing period is not fully established, so extra cost cannot be calculated. An unknown allowance is not zero. Check the base subscription and any required products separately.
CAPTCHA attempts
$4.00 USD / 10,000 CAPTCHA attempts analyzed
Published rate only. The plan allowance, matching unit, or billing period is not fully established, so extra cost cannot be calculated. An unknown allowance is not zero. Check the base subscription and any required products separately.
Challenge responses
$0.40 USD / 1,000,000 Challenge responses served
Published rate only. The plan allowance, matching unit, or billing period is not fully established, so extra cost cannot be calculated. An unknown allowance is not zero. Check the base subscription and any required products separately.
Bot Control managed rule group subscription
$10.00 USD / web ACL with Bot Control AMR
Published rate only. The plan allowance, matching unit, or billing period is not fully established, so extra cost cannot be calculated. An unknown allowance is not zero. Check the base subscription and any required products separately.
Common Bot Control inspected requests above the monthly allowance
$1.00 USD / 1,000,000 requests inspected after the first 10 million monthly requests
Published rate only. The plan allowance, matching unit, or billing period is not fully established, so extra cost cannot be calculated. An unknown allowance is not zero. Check the base subscription and any required products separately.
Targeted Bot Control inspected requests above the monthly allowance
$10.00 USD / 1,000,000 requests inspected after the first 1 million monthly requests
Published rate only. The plan allowance, matching unit, or billing period is not fully established, so extra cost cannot be calculated. An unknown allowance is not zero. Check the base subscription and any required products separately.
Fraud Control managed rule group subscription
$10.00 USD / Fraud Control AMR on one web ACL
Published rate only. The plan allowance, matching unit, or billing period is not fully established, so extra cost cannot be calculated. An unknown allowance is not zero. Check the base subscription and any required products separately.
Fraud Control analyzed requests from 10,000 to 2 million
$1,000.00 USD / 1,000,000 requests analyzed in this monthly tier
Published rate only. The plan allowance, matching unit, or billing period is not fully established, so extra cost cannot be calculated. An unknown allowance is not zero. Check the base subscription and any required products separately.
Fraud Control analyzed requests from 2 million to 5 million
$700.00 USD / 1,000,000 requests analyzed in this monthly tier
Published rate only. The plan allowance, matching unit, or billing period is not fully established, so extra cost cannot be calculated. An unknown allowance is not zero. Check the base subscription and any required products separately.
Fraud Control analyzed requests from 5 million to 15 million
$400.00 USD / 1,000,000 requests analyzed in this monthly tier
Published rate only. The plan allowance, matching unit, or billing period is not fully established, so extra cost cannot be calculated. An unknown allowance is not zero. Check the base subscription and any required products separately.
Fraud Control analyzed requests from 15 million to 30 million
$200.00 USD / 1,000,000 requests analyzed in this monthly tier
Published rate only. The plan allowance, matching unit, or billing period is not fully established, so extra cost cannot be calculated. An unknown allowance is not zero. Check the base subscription and any required products separately.
Published rate only. The plan allowance, matching unit, or billing period is not fully established, so extra cost cannot be calculated. An unknown allowance is not zero. Check the base subscription and any required products separately.
AWS WAF Layer 7 DDoS Protection web ACL fee
$20.00 USD / web ACL with AWS WAF DDoS Protection
Published rate only. The plan allowance, matching unit, or billing period is not fully established, so extra cost cannot be calculated. An unknown allowance is not zero. Check the base subscription and any required products separately.
Published rate only. The plan allowance, matching unit, or billing period is not fully established, so extra cost cannot be calculated. An unknown allowance is not zero. Check the base subscription and any required products separately.
This calculation compares usage with the published allowance on the same unit and period basis. It excludes taxes, negotiated terms, and unverified packaging conditions.
What is included, connected, or sold separately
Product scope
What is included, connected, or sold separately
Material capabilities are separated by their verified relationship to the target product.
Account takeover and account creation fraud managed rulesAdd-on
Account Takeover Prevention and Account Creation Fraud Prevention are separately enabled paid AWS managed rule groups with tiered request analysis.
Plan: AWS WAF pay-as-you-go: Optional add-onAWS WAF Fraud Control
AWS states that non-Bot-Control and non-Fraud-Control AWS managed groups have no additional managed-rule price; base WAF rule-group and request charges still apply.
Plan: AWS WAF pay-as-you-go: IncludedAWS Managed Rules for AWS WAF
Shield Advanced DDoS response and limited base WAF fee coverageSeparate product
Shield Advanced has a one-year commitment and covers only documented base WAF usage on Shield-protected resources; premium WAF features remain charged.
The score uses the category-specific buying dimensions below and their displayed weights.
This page is based on public product information, official sources, structured feature data, and multi-model AI evaluation. It is not a hands-on lab test unless explicitly stated. Confidence percentages describe our research indicators, not the probability that a claim is true or a measured accuracy rate.
Evidence confidence
85%
AI claim confidence
100%
Required-field evidence status
100%
Evidence freshness
54%
Field traceability
100%
Model agreement
97%
Why this confidence level
Evidence confidence uses source level and claim-to-source support; AI claim confidence is shown separately.
Required-field evidence status measures whether weighted required claims have evidence links; it does not mean every product behavior was independently verified.
8 of 8 weighted claims have evidence links.
9 A1 documentary official sources and 1 A2 official product sources are linked.
1 independent review sources are retained, including 0 professional sources with an explicit hands-on method.
4 weighted claims are past the review window.
No blocking evidence conflict was identified.
Protection efficacy20%
76
Efficacy rests on managed rule groups, rate-based controls, and optional intelligent threat features when correctly associated and tuned, offset by inspection-size limits, non-inspected gRPC bodies, and the need for continuous false-positive handling.
Policy accuracy and tuning17%
74
Count-mode evaluation, exclusions, overrides, and log review enable accuracy improvements before and after enforce actions, but accurate outcomes remain dependent on buyer staging discipline rather than automatic precision alone.
Application and API coverage15%
71
Coverage spans CloudFront and multiple regional AWS HTTP(S) fronts including load balancers and common API services, while remaining unavailable for non-supported deployment targets and constrained by per-resource body inspection rules.
Security operations14%
78
Metrics, dashboards, sampling, multi-destination logging, and full API administration support day-to-day security operations, with Firewall Manager available only as a separate organizational policy service when broader multi-account rollout is required.
Performance and reliability13%
71
Edge and regional AWS-native placement removes appliance HA work for supported resources, yet reliability characteristics beyond that architectural model are not quantified in the commercial capability set provided.
Deployment and integrations11%
80
Native association to CloudFront and listed regional services, complete API control, and CloudFormation deployment fit AWS infrastructure workflows, while hardware, virtual-appliance, and Kubernetes-ingress patterns are outside the supported model.
Support and total cost10%
58
No-commitment pay-as-you-go base meters keep entry flexible at USD 5 per web ACL, USD 1 per rule or attached group, and USD 0.60 per million requests, but TCO is sensitive to additive WCU, body-size, bot, fraud, CAPTCHA, Marketplace, logging, and adjacent AWS service charges, with no permanent free AWS WAF plan or time-limited AWS WAF trial stated and AWS Support priced separately.
Public review signals
AWS WAF reviews favor native AWS control while flagging cost and operational analysis
The current exact-product TrustRadius aggregate is positive but not exceptional. Review material emphasizes straightforward AWS placement, customizable rules, rate controls, and managed bot defenses, while costs for advanced controls and dependence on CloudWatch or other analysis services remain cautions.
Public review signals updated: Aug 12, 2026
Commonly reported strengths
Native placement in front of CloudFront, API Gateway, and load-balanced AWS applications
Flexible custom and managed rule ordering
Useful rate limiting and bot controls
Commonly reported concerns
Advanced bot protection can be expensive
Investigating allow and block activity can require CloudWatch or other tooling
Applications outside AWS still need a supported AWS delivery resource in front
TrustRadius7.3/10
Reviews and ratings
29 reviews and ratings
Source context
AWS WAF on TrustRadiusExact product
View sourceHistory baseline established: Aug 12, 2026
Score73Pricing modelAWS WAF is a no-upfront-commitment, pay-as-you-go service. Base cost is composed from each web ACL, each rule or attached rule group, and inspected requests. Capacity above 1,500 WCU, body inspection beyond each resource's default, interactive actions, intelligent threat mitigation, and seller-managed rule groups can add charges.Use caseprotect supported AWS-delivered web applications and APIs from application-layer exploits, abusive bots, fraud, and HTTP floods with custom and managed rulesCompany sizeEnterprise, Mid-market, Small business
Structured tags
AWS WAF tag profile
Company size
Enterprise
Mid-market
Small business
Key features
AWS WAF core capabilities
Custom allow, block, count, CAPTCHA, Challenge, and rate-based controls for HTTP(S) requests
AWS Managed Rules and optional seller-managed AWS Marketplace rule groups
Optional Common and Targeted Bot Control plus account takeover and account creation fraud defenses
Optional AWS WAF Layer 7 DDoS Protection with automatic mitigation
Global CloudFront-edge and supported regional resource associations
CloudWatch metrics, traffic dashboards, request sampling, and logs to CloudWatch Logs, S3, or Data Firehose
Detailed strengths and purchase cautions
Pros
Why it is worth considering
Custom allow, block, count, CAPTCHA, Challenge, and rate-based controls can be combined with AWS Managed Rules and optional Marketplace rule groups on each web ACL.
Associations cover CloudFront edge distributions plus regional resources including Application Load Balancer, API Gateway REST APIs, AppSync GraphQL APIs, Cognito user pools, App Runner services, and Verified Access instances.
CloudWatch metrics, traffic dashboards, request sampling, and logs to CloudWatch Logs, S3, or Data Firehose support investigation and response workflows.
Full API administration and CloudFormation-based deployment let security and platform teams manage rules as code without a separate appliance layer.
Cons
What to confirm before buying
Total cost can rise from excess WCU above the base allocation, body inspection above each resource default, CAPTCHA and Challenge actions, Bot Control, Fraud Control, AWS WAF Layer 7 DDoS Protection, seller Marketplace rule groups, and separate charges for protected resources, logging, Firewall Manager, Shield, or AWS Support.
Request-body inspection is fixed at 8 KB on Application Load Balancer and AppSync, defaults to 16 KB with optional expansion to 64 KB on listed other resources at extra charge, and gRPC request bodies are not inspected.
False-positive control depends on buyer-run staging, Count-mode testing, exclusions, overrides, and ongoing log review rather than a fully automatic accuracy guarantee.
Fraud Control analysis is called out as becoming expensive at published lower-volume tiers, so lighter traffic patterns may still incur material optional-feature spend.
Cross-model buying perspectives
Multi-AI review
Cross-model buying perspectives
Multiple AI models assess this tool against the same buying criteria, so you can compare scores, confidence, fit, cautions, and final views.
AI assessment updated: Sep 23, 2026
Score comparisonxAIGPTRange
Protection efficacy76760
Policy accuracy and tuning74731
Application and API coverage73685
Security operations78771
Performance and reliability71710
Deployment and integrations80800
Support and total cost635211
waf attack detection blocking78780
waf policy tuning control83821
waf api bot protection fit72742
waf performance availability70700
waf event visibility response81792
Where models differ
Support and total cost: 52–63 (11-point range)
Application and API coverage: 68–73 (5-point range)
waf api bot protection fit: 72–74 (2-point range)
xAIAI-assisted buyer perspective75
AWS WAF suits AWS-centered teams that will protect supported CloudFront and regional HTTP(S) entry points with custom and managed rules under pay-as-you-go metering, provided they actively tune policies and govern additive costs from capacity, body inspection, and optional threat features.
Review confidence
75/100
Model details
Strengths
Custom allow, block, count, CAPTCHA, Challenge, and rate-based controls can be combined with AWS Managed Rules and optional Marketplace rule groups on each web ACL.
Associations cover CloudFront edge distributions plus regional resources including Application Load Balancer, API Gateway REST APIs, AppSync GraphQL APIs, Cognito user pools, App Runner services, and Verified Access instances.
CloudWatch metrics, traffic dashboards, request sampling, and logs to CloudWatch Logs, S3, or Data Firehose support investigation and response workflows.
Full API administration and CloudFormation-based deployment let security and platform teams manage rules as code without a separate appliance layer.
Cautions
Total cost can rise from excess WCU above the base allocation, body inspection above each resource default, CAPTCHA and Challenge actions, Bot Control, Fraud Control, AWS WAF Layer 7 DDoS Protection, seller Marketplace rule groups, and separate charges for protected resources, logging, Firewall Manager, Shield, or AWS Support.
Request-body inspection is fixed at 8 KB on Application Load Balancer and AppSync, defaults to 16 KB with optional expansion to 64 KB on listed other resources at extra charge, and gRPC request bodies are not inspected.
False-positive control depends on buyer-run staging, Count-mode testing, exclusions, overrides, and ongoing log review rather than a fully automatic accuracy guarantee.
Fraud Control analysis is called out as becoming expensive at published lower-volume tiers, so lighter traffic patterns may still incur material optional-feature spend.
GPTAI-assisted buyer perspective73
AWS WAF fits AWS-centered teams that need cloud-native request filtering and managed-rule options for supported CloudFront and regional AWS entry points, provided they can operate usage-based pricing, tune policies, and accept the service boundaries on body inspection and supported deployment targets.
Review confidence
73/100
Model details
Strengths
It supports custom allow, block, count, CAPTCHA, Challenge, and rate-based controls for HTTP(S) traffic, which gives security teams direct request-layer enforcement options.
It supports AWS Managed Rules and optional seller-managed AWS Marketplace rule groups, which can reduce the amount of custom rule writing needed for common protections.
It supports CloudWatch metrics, traffic dashboards, request sampling, and logs to CloudWatch Logs, S3, or Data Firehose, which gives teams multiple paths for monitoring and investigation.
It supports full API administration and CloudFormation-based deployment, which suits infrastructure-as-code and programmatic operations.
Cautions
Pricing is usage-based across web ACLs, rules or attached rule groups, requests, capacity, body inspection above defaults, and optional defenses, so spend can grow as protections and traffic expand.
Request body inspection has fixed and configurable size boundaries by resource, and gRPC request bodies are not inspected, so some traffic patterns remain outside the supported inspection scope.
The service is tied to supported AWS resources, so it does not fit deployments that need hardware, virtual-appliance, or Kubernetes-ingress placement.
Research transparency
How this page was researched
A compact record of the evidence used, what was not tested, and which conclusions still need verification.
Official sources
10
Broad product review sources
1
Marketplace and app-store sources
0
Editorial sources
0
Latest evidence check
Aug 12, 2026
Research basis
Global Tool Radar generated this assessment from structured facts linked to public sources. No Global Tool Radar hands-on test is recorded in this page's research data. Any external hands-on assessment is identified separately and does not affect the Global Tool Radar score.
Conflict handling
No unresolved evidence conflict is currently recorded.
Verified findingsNo permanent free AWS WAF plan or time-limited AWS WAF trial is publicly stated.
AWS WAF is a no-upfront-commitment, pay-as-you-go service. Base cost is composed from each web ACL, each rule or attached rule group, and inspected requests. Capacity above 1,500 WCU, body inspection beyond each resource's default, interactive actions, intelligent threat mitigation, and seller-managed rule groups can add charges.
USD 5 per web ACL per month, plus USD 1 per rule or attached rule group per month and USD 0.60 per million requests
The only exact-target core offer is AWS WAF pay-as-you-go. Monthly web ACL and rule fees are prorated hourly, but AWS does not state an invoice cadence. AWS WAF charges sit on top of the protected resource's service charges. Bot Control, Fraud Control, AWS WAF DDoS Protection, CAPTCHA, Challenge, excess WCU, larger body inspection, log overages, and seller-priced Marketplace rule groups can materially increase spend. CloudFront flat-rate plans, Shield Advanced, and Firewall Manager are separate products with their own commercial terms.
Custom allow, block, count, CAPTCHA, Challenge, and rate-based controls for HTTP(S) requests
AWS Managed Rules and optional seller-managed AWS Marketplace rule groups
Optional Common and Targeted Bot Control plus account takeover and account creation fraud defenses
Optional AWS WAF Layer 7 DDoS Protection with automatic mitigation
Global CloudFront-edge and supported regional resource associations
CloudWatch metrics, traffic dashboards, request sampling, and logs to CloudWatch Logs, S3, or Data Firehose
Full API administration and CloudFormation-based deployment
Verification notes and unresolved itemsVerified 2026-08-12 against current public AWS pages and documentation.
The AWS WAF pricing tables render amounts from AWS pricing tokens
retained values were cross-checked against the page's current examples and public USD price map.
The marketing FAQ lists an older subset of associations, so the current Developer Guide controls CloudFront, API Gateway REST, AppSync GraphQL, Cognito, App Runner, and Verified Access scope.
Marketplace seller prices were not retained because AWS publishes only seller-specific pricing and an illustrative example, not a deterministic AWS WAF add-on price.
No current AWS WAF edition ladder is published. The exact-target core offer is pay-as-you-go pricing for web ACLs, rules or attached rule groups, and requests, with optional metered defenses.
Does AWS WAF have a free plan or trial?
No permanent free AWS WAF plan or time-limited AWS WAF trial is publicly stated. Shield Standard and CloudFront Free are separate products or bundles, not AWS WAF plans.
Which AWS services can AWS WAF protect?
Current documentation includes CloudFront and regional associations such as Application Load Balancer, API Gateway REST APIs, AppSync GraphQL APIs, Cognito user pools, App Runner services, and Verified Access instances, plus additional newer supported resources.
Are AWS Marketplace managed rule groups included?
No. Marketplace sellers own their rule groups and set separate subscription prices. Ordinary AWS WAF charges also apply, including the attached managed rule-group fee.
Does Shield Advanced make AWS WAF free?
Only within its documented scope. Shield Advanced includes specified base web ACL, rule, and request fees for Shield-protected resources up to 50 billion monthly requests, while Bot Control, Fraud Control, excess WCU, and managed-rule fees remain chargeable.
Is AWS Firewall Manager part of AWS WAF?
No. Firewall Manager is a separate central-policy service that can deploy AWS WAF protections across an AWS organization and can add its own policy and AWS Config charges.
How much request body content can AWS WAF inspect?
Application Load Balancer and AppSync are fixed at 8 KB. CloudFront, API Gateway, Cognito, App Runner, and Verified Access default to 16 KB and can be configured up to 64 KB in 16-KB increments, with extra charges above the default.
Popular comparisons
Common AWS WAF comparisons
Only high-scoring and nearby tools from the same subcategory are shown, avoiding comparisons between unrelated use cases.