AWS WAF and Shield Cost Optimization

Last updated: June 2026 · Written by Morten Andersen and reviewed by Fredrik Filipsson · See, Cut, Lock, Run method

AWS WAF and AWS Shield protect web applications from common exploits and DDoS attacks, and because they are security tools, their cost is rarely questioned. That is how the bill grows: web ACLs duplicated across accounts, managed rule groups enabled wholesale for protections an app never needed, and a Shield Advanced subscription left running where the risk does not warrant it. None of this makes the application safer, it just costs more. This guide is part of our complete guide to AWS cost optimization, the cluster pillar it links up to.

How much do AWS WAF and Shield cost?

AWS WAF costs $5 per web ACL per month, $1 per rule per month, and $0.60 per million requests inspected, while AWS Shield Advanced costs $3,000 per month on a one-year commitment. The WAF figures come from the AWS WAF pricing page: every web ACL carries the $5 monthly fee, every rule inside it including each managed rule group adds $1 per month, and the request charge scales at $0.60 per million requests the ACL evaluates. AWS Shield Standard is free and on by default for all AWS customers; Shield Advanced adds the $3,000 monthly subscription plus data transfer out fees on protected resources, per the AWS Shield pricing page, and it includes the WAF usage fees for resources it protects. The Shield Advanced fee is consolidated across all accounts under a single payer, so for a large organization the per-account cost falls as more accounts share the one subscription. Verify current rates before modeling, since pricing changes.

How do I optimize AWS WAF and Shield cost step by step?

Optimize WAF and Shield by cutting fixed rule cost, reducing inspected requests, and making the Shield Advanced call deliberately. Work through these steps:

1. Count web ACLs and rules across accounts. Inventory every web ACL and the rules and managed rule groups inside it, since each ACL costs $5 per month and each rule $1 per month regardless of whether it ever matches traffic.
2. Remove redundant rules and ACLs. Consolidate duplicate ACLs, share common ACLs with AWS Firewall Manager, and drop rules that no longer block anything. Every removed rule saves $1 per month per ACL.
3. Right-size managed rule groups. Keep only the managed rule groups your application actually needs rather than enabling broad sets, because each group adds rule fees for protections you may never use.
4. Reduce inspected request volume. Filter obvious junk traffic earlier and cache where possible so fewer requests reach the web ACL, since WAF bills $0.60 per million requests evaluated.
5. Decide on Shield Advanced deliberately. Subscribe only where the DDoS risk and the included cost protection justify the $3,000 monthly fee, and consolidate the subscription across accounts so the fixed cost is shared.

This is the same waste-elimination work in our AWS cost optimization service. The data-protection counterpart, where backup retention drives its own cost, is covered in the sibling guide AWS Backup cost optimization: policies and retention.

Is AWS Shield Advanced worth the cost?

Shield Advanced is worth the $3,000 monthly fee when the DDoS risk is real and the included cost protection, response team, and WAF coverage justify it, and it is overkill for low-risk workloads. The subscription does more than enhanced detection: it includes the WAF fees for usage on protected resources, access to the AWS Shield Response Team during an attack, and cost protection that can absorb the scaling charges a volumetric attack would otherwise impose on your bill. For an organization running internet-facing, revenue-critical applications with a genuine threat profile, that bundle can pay for itself, especially once the single subscription is consolidated across many accounts. For a small estate or internal workloads with low exposure, the free Shield Standard tier plus a right-sized WAF delivers the protection most applications need at a fraction of the cost. The decision is a risk-versus-cost judgment, not a default, and it should be made deliberately. The same fixed-cost-versus-usage logic appears in our comparison of AWS Direct Connect versus VPN, and the right-sizing routes to the same fix in our AWS cost optimization service.

Frequently asked questions

How much does AWS WAF cost?

AWS WAF costs $5.00 per web ACL per month, $1.00 per rule per month, and $0.60 per million requests inspected. Managed rule groups count as rules, so enabling many of them adds monthly rule fees. The request charge scales with traffic, so high-volume applications pay more.

How much does AWS Shield Advanced cost?

AWS Shield Advanced costs $3,000 per month with a one-year commitment, plus data transfer out fees on protected resources. The subscription is consolidated across all accounts under one payer, and it includes the WAF fees for usage on protected resources, so the economics improve at scale.

Is AWS Shield Advanced worth the cost?

It is worth it when the DDoS risk is real and the included cost protection and response team matter, because Shield Advanced can absorb scaling charges from an attack and includes WAF on protected resources. For low-risk workloads, the standard free Shield tier plus WAF is usually enough.

What is the biggest hidden AWS WAF cost?

Unused rules and broad managed rule groups. Every rule bills $1 per month whether or not it ever matches traffic, so enabling large rule sets you do not need quietly inflates the bill. The request charge on high-traffic applications is the other line that grows with scale.

The short version

AWS WAF bills $5 per web ACL, $1 per rule, and $0.60 per million requests, and Shield Advanced adds a $3,000 monthly subscription. Cut cost by consolidating ACLs, removing redundant rules, keeping only the managed rule groups you need, reducing inspected requests, and subscribing to Shield Advanced only where the DDoS risk justifies it. Right-size security spend without weakening protection. When you want every ACL and subscription reviewed and the saving proven down, that is part of what our AWS cost optimization service delivers.