Estimate WAF request volume (CDN/LB to monthly requests)

Start with a calculator if you need a first-pass estimate, then use this guide to validate the assumptions and catch the billing traps.

This page is the measurement workflow, not the budget-boundary page: the goal is to turn observed traffic and attack windows into a defendable evaluated-request model.

If you still are not sure which costs belong inside the WAF bill, go back to the pricing guide first.

Step 0: define evaluated requests (the number that matters)

• Evaluated = allowed + blocked. For cost, you usually want the evaluated volume.
• Scope: one host/path protected by WAF can have a very different request profile than the rest of the site.
• Two scenarios: baseline month + attack month (peaks drive real bills).

Method 1: From average RPS

• Requests/month = avg RPS x 60 x 60 x 24 x days
• Use an average over a representative period (e.g., 30 days).
• Add a buffer if you have frequent bot spikes or peak-driven workloads.

Method 2: From CDN/LB metrics

• Use the request count metric from your CDN or load balancer and roll it up to a month.
• Segment by host/path if only some traffic is protected by WAF.

If you have multiple apps behind one gateway, measure by hostname (or listener) so the "noisy one" does not hide.

Method 3: From logs

• Count request records per day from access logs/WAF logs, then average to monthly.
• Include blocked traffic and retries; they are still evaluated.

Logs are best when you need to separate paths (login, search, uploads) because bot activity is usually concentrated on a few endpoints.

Worked example (baseline + spike)

• Baseline: 1,000 RPS sustained -> convert to monthly.
• Spike: +10,000 RPS for 2 hours/day for 5 days -> extra requests = 10,000 * (2 * 3600) * 5.
• Total evaluated: baseline + extra spike requests.

Use WAF request volume estimator to model baseline and spike together.

Evidence pack for a defendable evaluated-request model

• Baseline source: where the normal request volume came from, such as CDN metrics, load balancer metrics, or WAF logs for a representative window.
• Attack source: the incident or bot-wave window kept separate, with allowed and blocked traffic both counted.
• Hot-path split: login, search, API, or other endpoints broken out when one path attracts most abusive traffic.
• Open uncertainty: anything still estimated loosely, such as scraper intensity, retry storms, or partial host coverage.

Turn volume into cost

Use AWS WAF Cost Calculator to translate ACLs, rules, and request volume into an estimate.

• Save a baseline scenario and an attack scenario so you can compare without losing assumptions.
• If you log WAF events, estimate log ingestion separately (logs can be the second bill).

Common multipliers (why your estimate is low)

• Retry storms and client timeouts multiplying requests during incidents.
• Bot traffic concentrated on a few endpoints (login/search) that must be modeled separately.
• Cache misses (or disabled caching) pushing all requests through evaluation rather than serving from cache.
• Multi-tenant gateways where one app generates most requests.

How to validate the estimate

• Compare your modeled evaluated requests to one week of real request counts (CDN/LB/WAF logs) scaled to monthly.
• Keep a peak scenario for the largest spike window you see (attacks, bot waves, scraping).
• Confirm whether blocked requests are included in the evaluated volume you used.

What this page should hand off next

• Hand off to WAF pricing if your measurement work changes what you think belongs in the WAF bill versus the logging bill.
• Hand off to WAF cost optimization once the evaluated-request model is stable enough to judge before/after changes.
• Do not move into optimization with only a guessed attack multiplier if the main driver is still unclear.

Related guides

Related calculators

Validation checklist

• Validate the primary driver with measured usage from a representative window.
• Confirm units and pricing units (per 10k vs per 1M, GB vs GiB) before trusting the estimate.
• Re-check incident windows: retries/timeouts often multiply cost drivers.

Related reading

Sources

• AWS WAF pricing

Related guides

Related calculators

FAQ