WAF cost spikes during attacks: how to budget request surges

WAF cost spikes are usually not caused by \"more rules\" - they're caused by more evaluated requests. During attacks, blocked traffic can explode request volume and create an additional surprise: security log cost can grow with it.

Step 1: separate steady traffic from surge traffic

• Steady: your typical 30-day traffic.
• Surge: bot spikes, credential stuffing, scraping, or DDoS-like bursts.
• Include blocked traffic: for billing, it's often evaluated even when blocked.

Step 2: convert surge RPS into added monthly requests

Simple approximation: extra requests = surge RPS x surge seconds. Then add to your steady requests/month.

• Keep two scenarios: baseline (typical month) and attack (surge traffic for a few hours/days).
• Include blocked and allowed requests together (evaluated requests).

Worked surge example (copy/paste)

• Baseline: 500 RPS sustained -> convert to monthly requests.
• Attack: +5,000 RPS for 6 hours/day for 3 days -> extra requests = 5,000 * (6 * 3600) * 3.
• Total: baseline monthly + extra attack requests.

The purpose is not perfect math; it is to avoid budgeting only the steady state and getting surprised by the peak.

Step 3: reduce evaluated requests (high leverage)

• Cache aggressively for cacheable routes (especially for abusive hot paths).
• Rate-limit early for known abusive endpoints (login, search, auth token endpoints).
• Block obvious bot paths and bad user agents with targeted rules.
• Move traffic up the stack: stop bad traffic at the CDN edge when possible.

• Use a narrow allowlist for truly public endpoints during incidents (reduce evaluation surface).
• Keep one high-confidence emergency policy ready (temporary controls tend to become permanent if you do not review them).

Step 4: don't let security logging become the bigger bill

• Sample or filter logs for high-volume endpoints where full fidelity isn't required.
• Set retention intentionally for noisy logs.
• Optimize queries and dashboards to avoid repeated large scans.

If you need detailed investigation, prefer targeted logging for specific rules or short windows instead of always-on full-fidelity logs.

How to validate after an attack

• Reconcile evaluated requests (allowed + blocked) against the WAF bill for the same window.
• Compare baseline days vs attack days and keep the peak scenario for future budgets.
• Check whether logging and dashboards caused repeated scans of large windows during incident response.

Related tools

Validation checklist

• Validate the primary driver with measured usage from a representative window.
• Confirm units and pricing units (per 10k vs per 1M, GB vs GiB) before trusting the estimate.
• Re-check incident windows: retries/timeouts often multiply cost drivers.

Related reading

Sources

• AWS WAF pricing
• AWS WAF logging

Related guides

Related calculators

FAQ