AWS WAF pricing: what to model (ACLs, rules, requests)

AWS WAF-style pricing is usually a combination of fixed monthly baselines (Web ACLs + rules) plus a request-based charge that scales with total evaluated requests.

What to model (baseline + variable)

Web ACL count: how many ACLs you maintain (often per environment/app)
Rule count: custom rules + managed rule groups you enable (based on your pricing model)
Requests/month: total evaluated requests (watch out for attack traffic)
Downstream: log delivery, storage, search/analytics, and SIEM ingestion

The two most common budgeting failures are (1) modeling only the baseline and missing request spikes and (2) paying a second bill for logs and analysis.

A fast estimate (baseline + spike)

Use AWS WAF Cost Calculator for the baseline + request model, then add log/analysis and any security tooling.

Baseline scenario: typical month requests and current ACL/rule inventory.
Spike scenario: attack/bot window where evaluated requests are much higher.

Worked estimate template (copy/paste)

Baseline = ACLs + rules (and any managed add-ons you actually use)
Requests/month = evaluated requests (allowed + blocked), baseline + spike
Logs = (bytes per request) * requests/month + retention + query scans

Where to get inputs (evidence path)

Evaluated requests: from WAF metrics/logs for a representative week; keep a separate spike window.
ACL and rule inventory: list ACLs by environment and identify duplicated policies (sprawl is common).
Log volume: measure bytes per event and multiply by events/day; do not assume "logs are small".

Common pitfalls

Underestimating request volume during incidents (bot traffic, attacks).
Keeping many almost-identical ACLs and rules across environments.
Streaming full logs everywhere without volume controls.
Measuring allowed requests only and forgetting blocked traffic in evaluated volume.
Using one average and missing peak hours (spikes drive the bill).

How to validate the pricing model

Reconcile evaluated requests against the bill for the same window (baseline week + spike window).
Confirm rule/ACL inventory matches what is deployed (copy/paste ACL sprawl is common).
Verify logging controls: sampling, retention, and dashboard query windows.

Validation checklist

Validate the primary driver with measured usage from a representative window.
Confirm units and pricing units (per 10k vs per 1M, GB vs GiB) before trusting the estimate.
Re-check incident windows: retries/timeouts often multiply cost drivers.