AWS WAF pricing calculator
WAF, Bot Control, Fraud Control & DDoS. Estimate your costs using AWS list prices.
Estimates from AWS list prices, not an AWS quote. Discounts, taxes and credit terms may affect your bill.
01 · How AWS WAF pricing works
What you pay for
- $5 per web ACL and $1 per rule (or rule group) per month, prorated hourly.
- $0.60 per million requests for ACLs up to 1,500 WCU, rising in steps to $2.00 above 4,500 WCU; body inspection beyond 16 KB adds a surcharge.
- Bot Control: $10 per ACL per month plus per-million inspected requests after included volume; Fraud Control ATP/ACFP: $10 per ACL plus per-1,000 requests.
- CAPTCHA $0.40 per 1,000 attempts; challenge $0.40 per million.
Common cost traps
- Bot Control targeted inspection costs $10 per million requests after 1 M; scope it down with rule scope-down statements.
- Raising WCU above 1,500 raises the price of every request in that ACL.
- Managed rule groups from Marketplace sellers carry their own fees and are not covered by credits.
Ways to reduce cost
- Put cheap rules (IP sets, rate limits) first and use scope-down statements for Bot and Fraud Control.
- Consolidate web ACLs where resources share rules.
- Keep WCU at or below 1,500 where possible.
Free Tier & account eligibility
Free Tier depends on account age. Accounts created on or after 15 July 2025 get a $100 sign-up credit plus up to $100 more for completing onboarding activities; on the Free plan these last 6 months (or until used up), on the Paid plan unused Free Tier credits stay usable for 12 months from sign-up. Accounts created before 15 July 2025 keep the legacy Free Tier (12-month offers plus always-free offers). Always-free offers apply on both plans. WAF has no Free Tier allowance (Bot Control and Fraud Control include a monthly volume of inspected requests). New-plan accounts can pay from Free Tier credits. Shield Advanced subscribers get standard WAF charges waived on protected resources.
02 · AWS credits & runway
Do credits cover AWS WAF?
WAF web ACLs, rules, requests, Bot Control, Fraud Control, CAPTCHA and challenge charges are eligible usage and are offset by credits. Managed rule groups bought from AWS Marketplace sellers are excluded. General rules: credits only offset charges from the billing cycle in which they were applied onward (never past bills), they apply only to the services listed on the credit in Billing and Cost Management > Credits, they expire on the date shown there, and accounts on the AWS Free plan cannot receive Activate credits until they upgrade to the Paid plan.
Check my creditsExcluded charges & conditions
- Upfront payments for Savings Plans and Reserved Instances (All Upfront, and the upfront part of Partial Upfront). The recurring hourly fee of a No Upfront commitment is billed as normal usage and can be offset.
- AWS Marketplace charges (Activate credits make an exception for third-party foundation models used through Amazon Bedrock).
- AWS Enterprise Support, Enterprise On-Ramp, Unified Operations, resold support and partner-led support.
- Amazon Route 53 domain name registration and transfer fees.
- Taxes (sales, use, VAT and similar), AWS Professional Services, Training and Certification, Mechanical Turk, AWS Managed Services, and any use for cryptocurrency mining.
Illustrative credit runway
Single-service examples from the supplied data, not your calculator result. Months = credit amount ÷ monthly cost, before credit expiry. Credits can expire before these theoretical months are used; coverage and other AWS services can shorten runway.
| Usage profile | Monthly estimate | $10,000 | $25,000 | $100,000 |
|---|---|---|---|---|
| Small | $16.00 | 625.0 mo. | 1,562.5 mo. | 6,250.0 mo. |
| Medium | $275.00 | 36.4 mo. | 90.9 mo. | 363.6 mo. |
| Large | $5,190.00 | 1.9 mo. | 4.8 mo. | 19.3 mo. |
Small profile assumptions
1 web ACL, 5 rules, 10 M requests | Web ACL: 1 ACL-months x $5 = $5.00; Rules: 5 rule-months x $1 = $5.00; Requests: 10 million x $0.6 = $6.00 | Total ~$16.00/month, us-east-1 on-demand list prices, before Free Tier, taxes and support.
Medium profile assumptions
3 web ACLs, 30 rules, 300 M requests, Bot Control (common) on 1 ACL with 50 M inspected | Web ACLs: 3 ACL-months x $5 = $15.00; Rules: 30 rule-months x $1 = $30.00; Requests: 300 million x $0.6 = $180.00; Bot Control subscription: 1 ACL-months x $10 = $10.00; Bot Control common requests: 50,000,000 requests tiered (10 @ $0; 40 @ $1) = $40.00 | Total ~$275.00/month, us-east-1 on-demand list prices, before Free Tier, taxes and support.
Large profile assumptions
10 web ACLs, 100 rules, 3 B requests, Bot Control on 5 ACLs (500 M inspected), ATP with 3 M login attempts | Web ACLs: 10 ACL-months x $5 = $50.00; Rules: 100 rule-months x $1 = $100.00; Requests: 3,000 million x $0.6 = $1,800.00; Bot Control subscriptions: 5 ACL-months x $10 = $50.00; Bot Control common requests: 500,000,000 requests tiered (10 @ $0; 490 @ $1) = $490.00; ATP subscription: 1 ACL-months x $10 = $10.00; ATP login attempts: 3,000,000 requests tiered (10 @ $0; 1,990 @ $1; 1,000 @ $0.7) = $2,690.00 | Total ~$5,190.00/month, us-east-1 on-demand list prices, before Free Tier, taxes and support.
04 · Questions
AWS WAF pricing FAQ
What is the minimum cost?
A web ACL with one rule costs $6/month plus $0.60 per million requests.
How does WCU affect price?
ACLs above 1,500 WCU pay more per million requests, up to $2.00 above 4,500 WCU.
Do credits cover WAF?
Yes for AWS WAF charges. Third-party managed rules bought through Marketplace are excluded.
Is there a free tier?
No general free tier. Bot Control and Fraud Control include some inspected requests each month.
05 · Sources & estimate notes
Content pack dated 2026-10-19. Calculator rates remain their existing snapshots; this content update is not a price refresh.
Verification notes
- Runway prices come from the calculator repository snapshot rate card waf (no AWS Price List mapping in the build). Confirm the main unit prices on https://aws.amazon.com/waf/pricing/ before publishing.