Most WAF bills don’t grow because someone missed a $5 Web ACL. They grow when high-volume traffic meets paid bot checks, oversized body inspection, and logging that nobody budgets for.
For multi-account teams, the WAF bill is also an architecture decision. Centralized billing doesn’t eliminate duplicate Web ACL resources or turn member-account traffic into a single protected workload. Accurate estimates start with the requests, rules, and inspection settings attached to each application.
Key Takeaways
- AWS WAF core pricing is based on each Web ACL, its rules and rule groups, and the volume of inspected requests. The standard planning rates are $5 per ACL, $1 per rule or rule-group attachment, and $0.60 per million inspected requests.
- Multi-account billing consolidation does not merge Web ACLs or eliminate duplicate resource and usage charges. Centralizing protection can reduce fixed costs, but workload-owned ACLs may still be the better choice for separate pipelines, compliance needs, or regional endpoints.
- Bot Control, Fraud Control, CAPTCHA, Challenge actions, extra body inspection, and WCU overages can add significant usage-based charges. Scope these features to high-risk paths and estimate them with real request and evaluation volumes.
- Logging is billed through the services that store and deliver WAF logs, including CloudWatch Logs, Kinesis Data Firehose, S3, and Athena. Logging filters, sampling, redaction, and lifecycle policies help control downstream costs without reducing WAF request charges.
- Accurate forecasts require an inventory of every ACL, rule, scope, WCU level, inspection setting, request volume, optional feature, and cost allocation tag. Shield Advanced may include eligible standard WAF charges, but paid bot and fraud features, CAPTCHA, logging, and other exclusions remain separately billable.
AWS WAF pricing: start with the core meter
AWS WAF bills through four basic meters: each Web ACL, its rules, attached rule groups, and inspected web requests. Managed rule groups fall under the rule-group meter. The following figures are AWS list-price assumptions in US dollars for 2026 planning. AWS states standard WAF rates are consistent across Regions, although protected resources still follow their required scope. A CloudFront distribution uses the global WAF scope, while an Application Load Balancer and regional API Gateway deployments require regional scope.
A Web ACL is the policy container attached to a CloudFront distribution, Application Load Balancer, API Gateway, or another supported resource. One ACL can protect several compatible resources in the same account and scope. That can reduce fixed charges, but only when those applications can safely share the same policy.
| Pricing component | List price | What drives it |
|---|---|---|
| Web ACL | $5 per month | Each ACL created |
| Custom rule | $1 per month | Each rule added, creating $1 rule charges per rule |
| Rule group or managed rule group | $1 per month | Each group attached to an ACL |
| Inspected requests | $0.60 per million | Requests processed by the ACL, generating request charges |
| Capacity above 1,500 Web Capacity Units | $0.20 per million requests per extra 500 WCUs | ACL capacity configuration |
| Extra body inspection | $0.30 per million requests per additional 16 KB | Each additional 16 KB above the included 16 KB body inspection limit |
AWS prorates each fixed monthly fee by the hour, while request billing is pay-as-you-go based on inspected volume. A useful AWS re:Post pricing discussion confirms the familiar $5 ACL and $0.60-per-million-request figures. The AWS Pricing Calculator offers a rough cross-check, but feature-specific usage and logging still require manual inputs.
For a single Web ACL, the core formula captures the $1 rule charges and the $0.60 request rate:
Monthly core cost = $5 + ($1 x rules) + ($1 x rule groups) + ($0.60 x millions of inspected requests)
Calculate this for every ACL, then add the total. Include the $1 rule charges from every ACL in that sum, along with all requests reaching it. Don’t multiply the $5 fee by every attached resource. Do add all requests reaching that ACL across its attachments.
The base Web ACL price includes capacity up to 1,500 Web Capacity Units, our reader-friendly term for AWS WAF Capacity Units (WCUs). Capacity measures the computational cost of rules, not traffic volume. AWS provides details on how WCUs are calculated and billed, including charges once an ACL exceeds the included 1,500-WCU level.
Managed rule groups can change the cost curve
AWS Managed Rules often make financial sense because they reduce maintenance work and bring threat intelligence into the policy. However, each of these managed rule groups attached to a Web ACL adds $1 in recurring rule charges each month. Marketplace rule groups can add separate vendor subscriptions or usage pricing through AWS Marketplace, so review each offer before deploying a group across the organization.
Bot Control costs $10 per Web ACL each month, plus $1 per million requests in additional request charges. AWS includes the first 10 million monthly requests for common bot detection at no additional charge. The $10 subscription fee is a recurring monthly fee and remains payable. The ordinary $0.60-per-million WAF request fee still applies.
That structure makes path selection important. Use scope-down statements for login, search, checkout, authentication, registration, and other high-value API paths. Avoid inspecting routine customer traffic when it adds little protection.
Fraud Control is built for narrower cases, such as Account Takeover Prevention and Account Creation Fraud Prevention. Each feature has a $10 ACL subscription and can add $1 per 1,000 evaluated requests in request charges. That equals $1,000 per million requests, far above ordinary WAF rule charges. The standard WAF request meter can still apply. Restrict fraud checks to authentication and registration paths, then estimate traffic using real request counts before activation.
Interactive controls have their own meters:
- Each CAPTCHA attempt costs $0.40 per 1,000 attempts.
- Challenge responses cost $0.15 per 1,000 responses.
These charges can be appropriate during an attack or abuse spike. A permanent rule that challenges routine customer traffic, however, turns a security control into a recurring operating cost and a conversion risk.
Multi-account design determines where charges land
AWS Organizations consolidates invoices, but it doesn’t merge individual Web ACL resources. If twelve member accounts each create a regional ACL with similar rules, each account incurs its own fixed resource cost and rule charges. The organization therefore pays for twelve ACLs and twelve corresponding sets of usage.
A shared edge architecture can reduce duplicate fixed costs. For example, a central CloudFront distribution in an edge account can use one global Web ACL for several applications behind it. Common controls, such as reputation lists and basic rate limits, can sit there. Application-specific rules can use host headers, URI paths, and labels to keep policies separate.
That model has trade-offs. A change to the shared ACL can affect every application behind it, so policy deployment needs stronger testing and change control. It also doesn’t protect traffic that reaches a regional Application Load Balancer directly.
Workload-owned ACLs fit applications with separate deployment pipelines, different compliance obligations, or direct regional endpoints. AWS Firewall Manager can distribute WAF policy across member accounts, yet it doesn’t erase the WAF resources and request usage created in those accounts. Treat centralized policy management and cost consolidation as separate decisions.
Apply cost allocation tags to each Web ACL, such as Application, Environment, BusinessUnit, Owner, and CostCenter. Activate those user-defined tag keys in the management account, then use AWS Cost Explorer and the Cost and Usage Report to group data by linked account and tag. Tags alone won’t explain every request spike, but they make it possible to assign the fixed policy cost to the right team.
The less obvious AWS WAF charges to watch
Capacity overages can surprise teams that keep adding managed rule groups. An ACL with 1,501 to 2,000 Web Capacity Units enters the first overage tier. AWS charges $0.20 per million inspected requests for each extra 500 WCUs, separate from fixed rule charges. At 100 million requests, that first tier adds $20 monthly. The same capacity choice at 5 billion requests adds $1,000.
Don’t treat capacity reduction as a goal by itself. Removing a needed control to remain under 1,500 WCUs is rarely sensible. Instead, remove retired rules, prevent duplicate protections, and test whether a consolidated custom rule has a lower total WCU cost. Inventory configured Web Capacity Units before making changes. AWS has raised the maximum supported WCU level over time, but a higher limit doesn’t make a large policy free.
Request body inspection is another variable. The normal body inspection limit is 16 KB. Inspecting an additional 16 KB costs $0.30 per million requests. Raise the body inspection limit to 64 KB for a JSON API that receives meaningful input beyond the first 16 KB. It is unnecessary for most asset paths and simple GET requests.
Scope-down statements reduce paid managed-feature evaluations. They do not remove the base Web ACL request charge for traffic that still reaches the ACL.
Logging has no single “WAF logging fee,” which makes it easy to underestimate. WAF logs can create CloudWatch Logs ingestion and retention costs, Kinesis Data Firehose delivery charges, Amazon S3 storage costs, and Amazon Athena query charges. High-volume allow logs are usually the main source of waste.
Use WAF logging filters to retain blocked requests and selected sampled or counted traffic. Keep enough sampled records to investigate a CAPTCHA attempt without logging every allowed request. Logging filters don’t reduce WAF request charges, but they can reduce downstream log volume. Redact sensitive headers and fields before delivery.
For long retention, send logs to S3 through an appropriate destination and apply lifecycle policies. Keep short-term operational data in CloudWatch Logs only as long as incident response requires.
Yes, enabling one-click protection on a CloudFront resource can create a Web ACL and rules that begin accruing charges. A reported CloudFront billing incident is a useful reminder to inventory new ACLs after console experiments, proofs of concept, and automated deployments.
A multi-account WAF cost example
Assume an organization runs twelve Web ACL resources across six AWS accounts. Each ACL has eight custom rules, three standard managed groups, and an average of 15 million inspected requests each month. This example excludes taxes, Marketplace subscriptions, and log delivery costs.
The table isolates recurring fixed rule charges from optional usage. Use the AWS Pricing Calculator to cross-check basic list-price inputs, but model bot features, fraud evaluations, logging, and other usage-based features with separate traffic data.
| Monthly assumption | Calculation | Estimated cost |
|---|---|---|
| Twelve ACLs | 12 x $5 | $60 |
| Ninety-six rules | 96 x $1 | $96 |
| Thirty-six managed rule group attachments | 36 x $1 | $36 |
| 180 million inspected requests | 180 x $0.60 | $108 |
| Core WAF total | $300 |
The $132 in fixed rule charges makes up the rule portion of the $300 core total.
Now add realistic optional usage. Three high-traffic ACLs use 2,000 Web Capacity Units and process 75 million requests between them. Their first 500-WCU overage adds $15. Two API ACLs inspect an additional 16 KB beyond the body inspection limit for 30 million requests, which adds $9.
If the team issues 50,000 CAPTCHA attempt interactions and 50,000 Challenge responses, those interactions add $27.50. Running Bot Control on two ACLs that together receive 30 million requests adds $20 in subscriptions and up to $30 in request charges before applying any eligible included request allowance.
That brings the conservative total to $401.50 per month, before log delivery and fraud protection. The fixed ACL fees were only $60.
Now consider Fraud Control on a login endpoint receiving three million evaluated requests. At $1 per 1,000 evaluations, request charges reach $3,000, plus the $10 monthly subscription. The organization’s monthly estimate rises to $3,411.50. This is why a Fraud Control rollout needs endpoint-level traffic data, not a broad estimate based on total site visits.
Cost controls that work in AWS Organizations
A monthly cost optimization review should join security telemetry with billing data. Cost owners need to see why requests were inspected, not only which account paid the bill.
- Maintain an inventory of every Web ACL, its scope, attached resources, rules, WCU count, body inspection limit, owner, and attributable rule charges. Delete unused proof-of-concept ACLs promptly.
- Require WAF tags through infrastructure-as-code standards for each Web ACL. Firewall Manager can enforce or distribute policy standards, while linked-account views and application tags support chargeback or showback.
- Consolidate equivalent custom rules only after comparing WCU estimates and testing the final logic. Combining expressions can reduce fixed rule charges, but a larger statement may consume more capacity or add policy complexity.
- Put known bad IP sets, rate-based rules, and carefully verified trusted traffic controls ahead of expensive managed features. A terminating block or allow action can stop later evaluations, but only use allow rules for traffic you fully trust.
- Apply scope-down statements to Bot Control and Fraud Control. Limit fraud checks to routes such as
/login,/signup, and the APIs that process those actions. Excluding static assets from a bot rule group can also reduce optional request charges. - Monitor inspected web requests beside application traffic. A sudden growth in allowed requests can signal bot activity, an unplanned CloudFront behavior, or a new endpoint. Track CAPTCHA attempt volume, set AWS Budgets alerts, and review Cost Explorer by linked account each month.
- Use Count mode before enforcing new managed rule groups or a new policy. It exposes false positives and shows which paths the rules would touch. That information also helps decide whether the group needs scope-down logic.
Free usage should never be assumed in a production forecast. Check the current AWS Free Tier eligibility for each account before applying any allowance to core WAF estimates. The included common-bot request allowance is separate from general WAF pricing and doesn’t make the Web ACL subscription free.
When AWS Shield Advanced changes the calculation
Shield Advanced costs $3,000 per organization per month under its annual commitment model. For protected resources, eligible standard WAF Web ACL, rule charges, and request charges are included up to 50 billion WAF requests per month. The ACL must remain at the default 1,500-WCU capacity level.
The inclusion excludes paid bot and fraud features, CAPTCHA, Challenge actions, extra body inspection, Marketplace rule-group fees, and capacity above 1,500 WCUs. Logging and other AWS services still bill separately, so Shield Advanced doesn’t make every WAF feature free.
Shield Advanced also includes DDoS protection and DDoS cost protection, subject to AWS eligibility requirements. Its value comes from those protections and operating support, not just waived standard WAF fees. Compared with a pay-as-you-go WAF estate costing $300 per month, a $3,000 subscription isn’t justified by fee avoidance alone.
Frequently Asked Questions
How is the core AWS WAF cost calculated?
The core monthly estimate combines $5 for each Web ACL, $1 for every custom rule, $1 for every attached rule group, and $0.60 per million inspected requests. Calculate these charges for each ACL and add them across the organization.
Does AWS Organizations eliminate duplicate AWS WAF charges?
No. Organizations consolidates billing, but each member account’s Web ACLs, rules, rule groups, and inspected requests continue to generate their own charges. A shared CloudFront architecture can reduce duplicate fixed costs when applications can safely use a common policy.
Which AWS WAF features can increase costs the most?
Fraud Control can be especially expensive because its request charge can reach $1 per 1,000 evaluated requests, or $1,000 per million. Bot Control, CAPTCHA, Challenge actions, extra body inspection, WCU overages, Marketplace rule groups, and log delivery can also add to the standard WAF bill.
How can teams reduce AWS WAF costs without weakening protection?
Use scope-down statements to limit Bot Control and Fraud Control to high-value paths such as login, registration, and checkout. Remove unused rules, sample allowed-request logs, apply cost allocation tags, and review request volumes and optional feature usage by account each month.
Does Shield Advanced make AWS WAF free?
No. Shield Advanced may include eligible standard WAF ACL, rule, and request charges up to its stated limits, but it excludes features such as paid bot and fraud protection, CAPTCHA, Challenge actions, extra body inspection, and WCU overages. Logging and other AWS service costs are also billed separately.
Final cost perspective
The most accurate AWS WAF pricing model begins with individual Web ACL resources, actual request volumes, and every paid inspection feature attached to them. A multi-account organization can control the bill by sharing policy where safe, limiting paid evaluations to high-risk paths, and treating logs as a separate spend category.
The $5 fee is predictable. Request volume and inspection choices drive variable rule charges, determining whether WAF stays a modest security line item or becomes a major application cost.
