WAF cost optimization (reduce requests + rule sprawl)

Most WAF savings come from reducing the volume and the blast radius of evaluated requests, and from avoiding rule/ACL sprawl across many apps and environments.

What to model (WAF + the hidden log bill)

• Requests evaluated: baseline and peak (attacks and bot waves are the peak)
• Rules/ACL sprawl: duplicated policies across environments increase baseline cost and maintenance risk
• Logging volume: shipping every request to logs can be more expensive than the WAF line item itself

1) Reduce evaluated requests

• Cache aggressively at the CDN for cacheable routes.
• Rate-limit abusive traffic early (before it fans out).
• Block obvious bot paths and noisy endpoints (login, search) with targeted rules.

Think in terms of "requests you never evaluate" (blocked earlier or served from cache) vs "requests you evaluate but allow".

2) Keep ACLs and rules tight

• Consolidate similar policies; avoid duplicating ACLs per microservice without need.
• Remove unused rules and overly broad managed rule sets.

• Prefer a small number of shared, well-owned ACL templates rather than copy/paste per environment.
• Review rule changes after incidents; temporary emergency rules tend to accumulate into permanent cost.

3) Control downstream logging/analysis

• Sample or filter logs for noisy paths if you don't need full fidelity.
• Set retention intentionally; avoid storing everything forever.
• Optimize queries to avoid repeated full scans.

If you need detailed investigation, consider targeted logging for specific rules or short windows, rather than always-on full-fidelity logs.

4) Quantify changes (baseline + attack scenario)

Use WAF Cost Calculator to estimate savings from reducing rule count or request volume.

• Baseline scenario: typical daily request volume and current rule count.
• Peak scenario: attack window request volume (and expected logging intensity).
• Compare: WAF vs log storage/search costs if you enable full logging.

Common pitfalls

• Optimizing the WAF line item while ignoring the logging and analysis bill.
• Using one "average month" and missing attack spikes (the peak is the real risk).
• Rule sprawl: many similar ACLs across apps and environments with no ownership.
• Caching disabled on routes that could be cached, forcing every request through WAF evaluation.
• Over-logging noisy endpoints (health checks, bots, scanners) without sampling or filters.

How to validate the optimization

• Reconcile evaluated requests and rule counts against the bill in Cost Explorer / CUR.
• Compare baseline vs peak windows (incidents, bot waves) and keep the peak scenario in your budget.
• Validate security outcomes: false positives/negatives should not worsen after cost optimizations.

Related guides

Sources

• AWS WAF pricing
• AWS WAF logging

Related guides

Related calculators

FAQ