AWS WAF Cost Calculator

AWS WAF cost is a layered security bill, and attacks can create a second bill beside it

The visible WAF line items are only the first layer: Web ACLs, rules, and evaluated requests. In practice, attack periods also create downstream logging, scan, and analysis costs that make the true incident month more expensive than the WAF charge alone suggests.

• ACL inventory: the steady monthly security surface across accounts, regions, and environments.
• Rule inventory: managed and custom logic that grows as protection coverage expands.
• Evaluated requests: the variable layer that spikes during attacks, bot waves, or sudden traffic shifts.

Where WAF estimates usually drift

• Baseline traffic is modeled carefully, but blocked traffic and attack windows are undercounted or ignored.
• Rule inventory expands gradually across regions and environments after the original estimate was made.
• Teams review the WAF invoice but forget that log ingestion and query costs exploded at the same time.
• One blended request assumption hides the difference between a quiet month and a defensive month.

What to review before trusting the WAF baseline

• Count Web ACLs and rules by environment and region so the steady security surface is visible.
• Estimate evaluated requests with blocked traffic included, not just successful application traffic.
• Model attack or bot weeks separately because request-based charges are the first part of the defensive cost story.
• Keep downstream logging and analytics nearby so the incident month is not falsely treated as a pure WAF problem.

Baseline vs attack-expanded WAF scenarios

How to review the first real WAF incident month

• Check whether the miss came from evaluated-request spikes, inventory growth, or downstream observability costs before changing the entire model.
• Review attack periods separately so a few defensive days do not disappear inside one monthly average.

Next steps