WebACL, Rule and Request - AWS WAF charges $5 per web ACL, $1 per rule and $0.60 per million requests

What it costs

US East (N. Virginia); other regions differ. Checked 2026-11-11. Sources: AWS WAF pricing, AWS price list file, AWS WAF offer, us-east-1.

Example with made-up numbers

Typical causes

A web ACL per service and environment

Each ACL bills $5 even when two of them hold the same rules.

Managed rule groups with many rules

A group adds its internal rules to the rule count, each at $1 a month.

Rules that never match

Temporary blocks and experiments left in the web ACL.

Bot and health-check traffic

Every inspected request bills, including monitoring probes and scrapers.

Find it in your bill

Have a CUR file queryable in Athena? Paste this and run it:

SELECT date_trunc('month', line_item_usage_start_date) AS month,
       line_item_product_code,
       line_item_usage_type,
       line_item_resource_id,
       SUM(line_item_usage_amount)  AS usage_amount,
       SUM(line_item_unblended_cost) AS cost
FROM your_cur_table
WHERE line_item_product_code = 'awswaf'
  AND (line_item_usage_type LIKE '%WebACL'
       OR line_item_usage_type LIKE '%Rule'
       OR line_item_usage_type LIKE '%Request')
GROUP BY 1, 2, 3, 4
ORDER BY month DESC, cost DESC
LIMIT 50;

Columns used: line_item_usage_start_date, line_item_product_code, line_item_usage_type, line_item_resource_id, line_item_usage_amount, line_item_unblended_cost.

No CUR file? Use Cost Explorer

1. Open Billing and Cost Management, then Cost Explorer, and set the date range to the last 3 months with Monthly granularity.
2. Set Group by to Usage type.
3. In the Filters panel choose Usage type and tick the entries ending in *WebACL, *Rule or *Request (the region prefix, such as USE1-, differs by region).
4. Read the monthly cost per usage type. A line that grows faster than your traffic is the one to chase with the fix below.
5. To see which resource drives it, query the CUR above; resource IDs appear only if your CUR was set up with resource IDs included, otherwise the resource column is empty.

Column names checked against: docs.aws.amazon.com/cur/latest/userguide/Lineitem-columns.html, docs.aws.amazon.com/cur/latest/userguide/cur-ate-run.html.

The fix, step by step

Verify first

Check these before you change anything: the steps below are suggestions, and only you can see your own configuration.

• A web ACL that is attached to a resource protects it: remove it only after the resource has another web ACL or does not need one.
• Rules that look idle may be your only block against an attack that has stopped for now; read sampled requests over a month, not a day.
• Save the web ACL as JSON before deleting (get-web-acl); that file is how you recreate it.
• Merging web ACLs changes rule priority and default actions; test the combined ACL in Count mode first.
• A web ACL for CloudFront is global and shown under us-east-1 in the CLI; check both scopes, Regional and CloudFront.

In the console

1. WAF & Shield console > Web ACLs; list every web ACL for each Region and for CloudFront (Global), with the resources attached.
2. Open a web ACL > Rules; count the rules and note which are managed rule groups and which are your own.
3. Web ACL > Overview > Sampled requests and the request count graph show which rules match and how many requests the ACL sees.
4. One web ACL can protect several load balancers and distributions: attach the resources of near-duplicate ACLs to one and delete the rest.
5. Delete rules that never match, and managed rule groups you do not need.

With the CLI

aws wafv2 list-web-acls --scope REGIONAL --region us-east-1 --query 'WebACLs[].[Name,Id]' --output table

aws wafv2 list-web-acls --scope CLOUDFRONT --region us-east-1 --query 'WebACLs[].[Name,Id]' --output table

aws wafv2 get-web-acl --name EXAMPLE --scope REGIONAL --id EXAMPLE-ID > web-acl-backup.json

aws wafv2 list-resources-for-web-acl --web-acl-arn EXAMPLE-ARN --resource-type APPLICATION_LOAD_BALANCER

aws wafv2 delete-web-acl --name EXAMPLE --scope REGIONAL --id EXAMPLE-ID --lock-token EXAMPLE-TOKEN

Rollback

Recreate the web ACL from the saved get-web-acl JSON with create-web-acl and re-attach it to the resource (associate-web-acl); changes made in Count mode revert by switching the rule action back.

Find your WAF lines in your own bill

Drop in your Cost Explorer or CUR CSV. Billtrim reads it in your browser, finds the web ACL, rule and request lines and shows what your WAF setup costs per month.

Get my ranked savings list See a sample result

Paste your export: how to export a Cost Explorer CSV or CUR file in two minutes.

Questions people ask

Does a web ACL cost money when nothing is attached?

Yes. The $5.00 per web ACL per month bills for every web ACL you create, attached or not.

Why do request prices differ?

The price list has request rates from $0.60 to $2.00 per million depending on the web ACL's capacity tier (the RequestV2-Tier usage types).

Is there a free tier?

The price list has no free web ACLs, rules or requests.

Related

• LoadBalancerUsage and LCUUsage: what an ALB costs
• CloudWatch Logs DataProcessing-Bytes: the log ingestion line
• KMS-Keys and KMS-Requests - $1 per key a month and $0.03 per 10,000 requests

Part of the guide: Reduce your AWS bill as a startup: a checklist for teams with no FinOps person