WAF cost compared: AWS WAF vs Azure vs Cloud Armor

Quick answer

AWS WAF charges per web ACL per month, per rule per month, and per million requests inspected. Azure WAF (on App Gateway or Front Door) folds into those services with a policy and per-rule and per-request component. GCP Cloud Armor charges per policy, per rule, and per million requests. The models are close; cost scales with rule count and request volume, so consolidating rules and the shared per-request charge dominate. The cheapest is usually the WAF on the cloud your traffic already flows through.

A web application firewall (WAF) filters malicious HTTP traffic, and all three clouds price it similarly: a fixed component per policy or web ACL, a per-rule charge, and a per-request charge on inspected traffic. So cost scales with rules and traffic, and the models are close enough that traffic topology usually decides.

The shared three-part model

WAF	Model
AWS WAF	Per web ACL/month + per rule/month + per million requests
Azure WAF	Policy + per rule + per request (on App Gateway or Front Door)
GCP Cloud Armor	Per policy + per rule + per million requests

AWS WAF charges per web ACL, per rule, and per million requests, as in AWS WAF. Azure WAF attaches to Application Gateway or Front Door with similar policy, rule, and request components, as in Application Gateway. GCP Cloud Armor charges per policy, per rule, and per million requests, as in Cloud Armor. The three-part shape is consistent.

Which is cheaper

Because the models align, the per-request charge (at high traffic) and the per-rule charge (with many rules) dominate on all three, and the differences are modest. Managed rule groups (bundled protections) add cost on each. So the cheapest is usually the WAF native to wherever your traffic already terminates, since putting a WAF off-path would add cross-cloud routing cost that dwarfs any per-unit difference.

The shared levers

On all three: consolidate rules rather than adding many overlapping ones (each rule is billed), use managed rule groups efficiently (they bundle many protections into fewer billed units), and remember the per-request charge scales with traffic, so a high-traffic site's WAF cost is mostly requests. Rate-based rules that block abusive traffic early can reduce downstream cost. These apply identically across clouds.

Choosing on cost

Use the WAF native to the load balancer or CDN your traffic already flows through (AWS WAF on CloudFront/ALB, Azure WAF on Front Door/App Gateway, Cloud Armor on GCP load balancing), since the per-unit differences are small and routing traffic elsewhere to save on WAF would cost more in transit. Then consolidate rules and account for the per-request charge, the same across all three.

FAQ

Is AWS WAF, Azure WAF, or Cloud Armor cheapest?

They are close, since all three use a similar model: a fixed component per policy or web ACL, a per-rule charge, and a per-request charge on inspected traffic. Cost scales with rule count and traffic, and the differences are modest, so the cheapest is usually the WAF native to wherever your traffic already terminates.

How do WAF pricing models differ across clouds?

They are largely the same three-part shape. AWS WAF charges per web ACL, per rule, and per million requests. Azure WAF folds into Application Gateway or Front Door with policy, rule, and request components. GCP Cloud Armor charges per policy, per rule, and per million requests. Managed rule groups add cost on each.

What drives WAF cost?

The per-request charge at high traffic and the per-rule charge with many rules, on all three clouds. A high-traffic site's WAF cost is mostly the per-request component, while a site with many overlapping custom rules pays more on the per-rule component. Managed rule groups add cost but bundle many protections efficiently.

What are the shared WAF cost levers?

Consolidate rules rather than adding many overlapping ones (each is billed), use managed rule groups efficiently since they bundle many protections into fewer billed units, and account for the per-request charge scaling with traffic. Rate-based rules that block abusive traffic early can reduce downstream cost. These apply identically across AWS, Azure, and GCP.

Should I choose a cloud based on WAF cost?

No. The WAF services are priced similarly with small differences, so use the WAF native to the load balancer or CDN your traffic already flows through. Routing traffic elsewhere to save on WAF would add cross-cloud transit cost that dwarfs any per-unit difference, so match the WAF to your existing traffic path.

Does C3X estimate WAF cost?

C3X prices WAF resources from your Terraform, including the per-web-ACL or per-policy and per-rule components across clouds, so the fixed and rule cost appears before deploy. The per-request cost depends on traffic volume, which you provide as a usage assumption to compare the models.

What to do next

Compare WAF options for your traffic. C3X reads your Terraform and prices your resources against a live catalog. Start with the quickstart.