You added AWS WAF in front of your ALB or CloudFront distribution to block the obvious stuff — bad bots, SQL injection attempts, the usual OWASP top ten — and it felt like a five-minute decision. Then a managed rule group went on for a compliance requirement, Bot Control went on to deal with scraping, and the WAF line on your bill went from a rounding error to something somebody has to explain. None of it looks like it should add up to real money. A firewall isn't compute, it isn't storage — and yet here it is.
Why does AWS WAF cost anything at all?
AWS WAF charges on three separate meters, and knowing which one is growing is most of the diagnosis:
| What you pay for | Rate |
|---|---|
| Web ACL | $5.00 per month |
| Rule (each) | $1.00 per rule per month |
| Managed rule group (each) | $1.00 per month |
| Request processing | $0.60 per million requests |
A Web ACL costs $5 a month to exist, whether or not it ever blocks anything. Every rule inside it — a custom rule you wrote, or a managed rule group from AWS or the Marketplace — adds another $1 a month on top. And every request the ACL evaluates, allowed or blocked, is metered at $0.60 per million.
These are standard rates at the time of writing, rounded for clarity. AWS WAF's base charges can vary by region, and AWS changes prices — check the AWS WAF pricing page before you build a budget on these numbers.
Why is my bill so much more than $5 plus rules?
The per-ACL, per-rule math explains the base fee. It rarely explains the total, because several multipliers stack on top of it.
Web ACL Capacity Units (WCU). Every rule and rule group consumes WCUs based on how expensive it is to evaluate — a simple IP match might cost 1 WCU, a regex pattern set or a rate-based rule costs dozens. Every Web ACL gets 1,500 WCUs included for free. Cross that line and AWS charges $0.20 per million requests for every additional 500 WCUs the ACL uses. Stack two or three AWS Managed Rules groups — the Core rule set alone runs several hundred WCUs — and a normally protected ACL crosses 1,500 without anyone intending to build something expensive.
Request body inspection. By default, WAF inspects the first 16KB of a request body for free. Raise that limit — a common ask for APIs accepting large JSON payloads or file uploads — and every additional 16KB inspected costs $0.30 per million requests, on top of the base request fee.
CAPTCHA actions. If any rule issues a CAPTCHA, each attempt bills separately at $0.40 per 1,000 attempts, in addition to the request fee that triggered it.
Bot Control and Fraud Control. These are what turn a $30 Web ACL into a $300 one. Bot Control costs $10.00 per month per Web ACL just to enable, plus $1.00 per million requests past the first 10 million free for Common Bot Control, or $10.00 per million requests past the first 1 million free for Targeted Bot Control — a ten-fold jump for the tier that actually stops sophisticated bots. Fraud Control (Account Takeover Prevention and Account Creation Fraud Prevention) adds another $10.00 per month per feature, plus tiered request fees from $50 to $1,000 per million depending on volume — the most expensive per-request meter WAF has, by a wide margin.
Turn any of these on for "just in case" and forget about it, and you keep paying the subscription fee every month for a feature protecting nothing.
None of that is unique to a single ACL, either. The real multiplier is how many Web ACLs you're running. A team with separate dev, staging, and prod environments, each in two regions, each with its own Web ACL protecting an ALB or a CloudFront distribution, is paying the $5 base fee and every rule fee six times over before a single request gets evaluated.
One quirk worth knowing if a CloudFront bill dropped recently: as of October 2024, CloudFront stopped charging its own per-request fee for requests that WAF blocks. That doesn't make WAF free — AWS WAF still bills its own $0.60-per-million evaluation fee for every request it looks at, blocked or not. The saving landed on the CloudFront side of the bill, not the WAF side.
How do I find out what's actually driving the number?
Start with Cost Explorer, filtered to WAF and grouped by Usage Type. That split shows in one screen whether the base ACL and rule fees, the request-processing fee, or an add-on like Bot Control is the biggest line — which tells you where to look next.
To check how many WCUs a Web ACL is using against its 1,500 free allocation:
aws wafv2 list-web-acls --scope REGIONAL --region us-east-1 \
--query 'WebACLs[].[Name,Id]' --output table
aws wafv2 get-web-acl --name my-web-acl --scope REGIONAL --region us-east-1 \
--id <web-acl-id> \
--query 'WebACL.{Capacity:Capacity,Rules:Rules[].Name}'
Capacity is the same WCU total the console shows. Comfortably under 1,500 means the overage charge isn't your problem. Near or over it — especially right after adding a managed rule group — usually means it is.
For request volume, CloudWatch has every Web ACL's evaluated, allowed, and blocked counts:
aws cloudwatch get-metric-statistics \
--namespace AWS/WAFV2 \
--metric-name AllowedRequests \
--dimensions Name=WebACL,Value=my-web-acl Name=Region,Value=us-east-1 Name=Rule,Value=ALL \
--start-time "$(date -u -d '30 days ago' +%Y-%m-%dT%H:%M:%SZ)" \
--end-time "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
--period 86400 \
--statistics Sum \
--region us-east-1 \
--output table
Swap AllowedRequests for BlockedRequests or CountedRequests to see the split, and check whether Bot Control or Fraud Control publish their own request metrics if either is enabled — they meter separately from the base ACL and won't show up in this query.
How do I bring the WAF bill down without opening a hole?
Every rule and managed rule group is there to stop something. Before deleting or disabling one,
check its match statistics (in the console under the rule's own metrics, or via
SampledRequests) to confirm it isn't actively catching real traffic. Cutting the wrong rule to
save a dollar a month is a bad trade.
Consolidate Web ACLs protecting the same kind of traffic. A single regional Web ACL can be associated with multiple resources — several ALBs, an API Gateway stage, an AppSync API — as long as they're in the same region and need the same protection. Four ALBs each with their own near-identical Web ACL means four times the base fee and four times every rule fee for rules doing the same job; one shared ACL collapses that to one.
Drop overlapping managed rule groups. AWS's Core rule set, the SQL injection rule set, and the Known Bad Inputs rule set cover meaningfully different ground, but it's common to find two managed rule groups from different vendors doing largely the same job — each billing its own $1.00/month and adding its own WCUs toward the 1,500 line. Check for overlap in what each group actually matches before assuming you need both.
Turn off Bot Control and Fraud Control on ACLs that aren't seeing bot or fraud traffic. These carry the highest fixed cost on the list — $10/month each, before a single request — and they're the easiest to forget once whatever prompted enabling them (a scraping incident, a credential-stuffing scare) is resolved. If the feature's own request metrics are flat, it isn't earning its subscription fee.
Raise the request-body inspection limit only where you need it, not on every ACL by default. If most of your traffic is small API payloads, the 16KB default is enough; reserve the higher limit for the specific resources that actually receive large bodies.
What else should I check while I'm in here?
Two things worth a look while you have the console open.
The first is a Web ACL nobody deleted. A Web ACL isn't attached to the resource it protects the way a security group is — it's a separate resource with its own lifecycle, so decommissioning the ALB or CloudFront distribution it was guarding doesn't delete it. It keeps billing its $5 base fee and every rule fee for a resource with nothing left to protect. That's the same shape as an Elastic IP AWS keeps charging you for after whatever it was attached to is gone — the resource outlives the thing that justified creating it, and nothing prompts anyone to go delete it.
The second is anything else on the account billing per API call the way WAF bills per request. Secrets Manager's pricing works the same shape — a flat, easy-to-ignore per-resource fee sitting next to a per-call meter that quietly does most of the damage once real traffic hits it. If WAF surprised you, it's worth checking whether the same pattern is hiding somewhere else on the bill.
More broadly, a Web ACL nobody has reviewed since the day it was created is exactly the kind of per-resource creep that adds up across an account; an account-wide tour of where AWS spend adds up works through the rest of it in the order worth tackling.
How do I catch this before it becomes a real number?
WAF spend rarely spikes all at once — it climbs one rule group, one Bot Control subscription, one forgotten Web ACL at a time, and each addition looks small enough on its own that nobody flags it. The moment worth catching is when the trend changes, not when the total finally gets big enough to notice.
Connect your AWS account read-only, and Parsivex's daily anomaly checks compare every service's spend — WAF included — against its own trailing baseline, so a jump from a new managed rule group or a Bot Control subscription nobody remembers enabling gets flagged the next morning instead of buried in next month's bill. For how those daily checks and severity thresholds work, see cost anomaly alerts, or read how scans work for what a connected account scan reads across the rest of your bill.