All Services
Security & IAM
AWS WAF
AWS WAF filters HTTP and HTTPS requests to supported application resources with web ACLs, ordered rules, reusable rule groups, managed protections, rate-based rules, Bot Control, Fraud Control, and request inspection criteria.
Explore pricing models, common use cases, infrastructure support, and the AWS services that commonly work with AWS WAF.
AWS WAF pricing and cost programs
Pricing model: Web ACL, rule, and request usage
- On-Demand
- Available
- Reserved Instances or reserved capacity
- Not applicable
- Savings Plans
- Not applicable
- Spot
- Not applicable
Billing dimensions: Web ACLs · Rules · Requests · Managed rule groups and intelligent controls
Programs and modes: Standard rules · Managed rule groups · Bot Control · Fraud Control
Managed rule groups and intelligent threat controls can add subscription and request fees.
Free Tier: Service-specific — verify current offers
Pricing reviewed 2026-07-25. Reviewed against the linked official AWS pricing page. Recheck regional rates and program terms before purchase.
Official AWS pricing
Official AWS sources reviewed 2026-07-21.
Why implement AWS WAF?
- Adds centrally managed application-layer filtering in front of supported AWS web endpoints without modifying every application server.
- Combines custom rules with AWS and Marketplace managed rule groups, IP reputation, bot, fraud, and rate-based protections.
- Provides sampled requests, labels, metrics, and logs for tuning rules and understanding abusive traffic.
How to implement AWS WAF
- Identify protected resources, normal request shapes, trusted automation, abuse cases, sensitive routes, acceptable false positives, logging destination, and response strategy.
- Create a regional or CloudFront-scope web ACL, add current managed rule groups and narrow custom rules, configure logging with redaction, and associate it with each supported resource.
- Test in non-production, then run new rules in Count mode against production traffic, inspect matches and exclusions, promote to blocking gradually, and automate alerts and reviewed updates.
AWS WAF best practices
- Follow AWS's test-and-tune sequence: staging first, then production Count mode, then blocking after false positives and application-specific exclusions are understood.
- Layer managed rules, targeted rate rules, allow or deny exceptions, and Shield rather than relying on one rule group; a WAF rate rule is not a precise general-purpose rate limiter.
- Minimize logged sensitive fields, use labels and scoped statements to keep exceptions narrow, monitor sampled requests and rule capacity, and retest when applications or managed rule versions change.
AWS WAF use cases and server impact
- Blocking common web exploits
- Bot and credential-abuse mitigation
- Route-specific request filtering and coarse rate controls
Replaces many host-based web-filtering appliances and custom edge rules, but application security, precise business throttling, DDoS architecture, and ongoing rule tuning remain necessary.
Official implementation resources
How AWS WAF works with other AWS services
Arrows show the documented technical direction. Reciprocal navigation does not imply a reverse technical dependency.
Official AWS sources reviewed 2026-07-25.
AWS WAF → Amazon CloudFront
A web ACL associated with CloudFront evaluates viewer HTTP requests before CloudFront forwards allowed requests to an origin.
- Why teams use it
- Rules can block common exploits, rate-limit abusive clients, and reduce unwanted origin traffic at the edge.
- Permissions and networking
- Scope the web ACL for CloudFront, test managed and custom rules in count mode, and protect access to the origin independently.
- Pricing and security caveats
- AWS WAF charges for web ACLs, rules, and requests in addition to CloudFront. Rules can create false positives and do not replace application authorization.
AWS WAF → Elastic Load Balancing
A regional web ACL associated with an Application Load Balancer evaluates HTTP and HTTPS requests before they reach registered targets.
- Why teams use it
- The pairing adds centrally managed layer-7 filtering in front of EC2, ECS, or other ALB targets.
- Permissions and networking
- Use a regional web ACL in the load balancer Region, tune rules against real traffic, and retain security groups for network-layer controls.
- Pricing and security caveats
- WAF and load balancer charges are independent. WAF protects supported HTTP traffic but is not a network firewall or a substitute for secure application code.
AWS WAF → Amazon API Gateway
A regional AWS WAF web ACL can inspect requests sent to a supported API Gateway API stage before integration processing.
- Why teams use it
- Teams use the pairing for managed threat rules and rate-based controls at a public API boundary.
- Permissions and networking
- Confirm the API type and stage are supported, then coordinate WAF rules with API Gateway throttling, authorization, and resource policies.
- Pricing and security caveats
- WAF request processing adds cost and can block valid clients when rules are poorly tuned; it does not authenticate callers.
AWS WAF → Amazon CloudWatch
AWS WAF publishes rule and web ACL metrics to CloudWatch so teams can monitor allowed, blocked, counted, and challenged requests.
- Why teams use it
- Count-mode metrics support safe rule tuning before enforcement and make attack or false-positive trends visible.
- Permissions and networking
- Use stable metric names, alarm on meaningful rates, and keep sampled-request or logging access tightly controlled because requests may contain sensitive data.
- Pricing and security caveats
- WAF logs, CloudWatch metrics, alarms, and queries can add separate charges; aggregate metrics are not a complete forensic record.
Architecture patterns using this service
Planning guides that use AWS WAF