What is AWS WAF? Pricing, Setup & Complete Guide 2026

AWS WAF (Web Application Firewall) is a managed service that protects your web applications from common exploits and bots that could affect availability, compromise security, or consume excessive resources. Think of it as the bouncer at your website's door—it inspects every incoming web request and blocks the malicious ones before they reach your application. The counterintuitive truth: AWS WAF is often cheaper than doing nothing, because CloudFront no longer charges for requests that AWS WAF blocks—you only pay the WAF evaluation fee, saving both the bandwidth and request costs for all that blocked traffic. For most websites, a basic configuration costs under $10/month, but can prevent thousands of dollars in attack damage and infrastructure costs. Even small sites benefit: bots constantly scan for vulnerabilities regardless of your traffic volume, making WAF protection essential insurance for any web property. In our last post, we had seen about Route 53, so in this post lets see about AWS Web Application Firewall. If you are a new reader of our site and non tech, don't worry! you can start from here learn aws for free..

What Exactly is AWS WAF? The Technical Explanation

AWS WAF is a web application firewall that lets you monitor the HTTP and HTTPS requests that are forwarded to Amazon CloudFront distributions or an Application Load Balancer. You can also use AWS WAF to block or allow requests based on conditions that you specify, such as the IP addresses that requests originate from or values in the requests.

Ethan explains it to Jake using a familiar analogy: "You know how your phone shop has a security guard who checks IDs before letting people in? AWS WAF is that security guard for your website. It stands between the internet and your application, checking every visitor to see if they look suspicious before letting them through."

The Full Form and Meaning

AWS WAF stands for Amazon Web Services Web Application Firewall. The "WAF" part is the industry term for a firewall that operates at Layer 7 (the application layer) of the OSI model, specifically inspecting web traffic (HTTP/HTTPS). Unlike traditional network firewalls that filter based on IP addresses and ports, a WAF understands web protocols and can inspect the actual content of requests.

This distinction matters because many modern attacks exploit application layer vulnerabilities rather than network layer weaknesses. A traditional firewall might block traffic from a specific IP address, but a WAF can identify and block SQL injection attempts, cross-site scripting (XSS) attacks, and other application-specific threats that network firewalls can't detect.

What AWS WAF Actually Does

AWS WAF inspects web requests and identifies patterns that indicate malicious or unwanted behavior. When it detects such a pattern, it can take action—blocking the request, allowing it, counting it for metrics, or challenging the client with a CAPTCHA. Here's what AWS WAF can inspect in each request:

• IP addresses - Block or allow specific IPs or ranges
• Geographic location - Restrict access by country or region
• Request headers - Filter based on header values
• Query strings - Block requests with specific parameters
• Request body - Inspect POST data for malicious content
• Rate - Limit requests from a single source in a time window
• Bot signatures - Identify known bots and automated agents
• Request size - Block unusually large or small requests

Why Layer 7 Protection Matters

Most traditional security tools operate at lower network layers (Layer 3/4), filtering based on IP addresses and ports. While this catches some attacks, many sophisticated threats target the application layer where they can exploit business logic, inject malicious code, or automate abuse. AWS WAF provides this critical Layer 7 inspection, protecting against threats that network firewalls miss.

For example, a network firewall might block all traffic from a suspicious IP range, but a WAF can allow legitimate users from that range while blocking only the malicious requests based on their content or behavior patterns. This granularity is essential for maintaining availability while ensuring security.

How AWS WAF Works: Web ACLs, Rules, and Rule Groups

AWS WAF uses a hierarchical structure to organize protections. Understanding this structure is key to using the service effectively.

The Web ACL: Your Foundation

A web ACL (Access Control List) is the foundation of your AWS WAF configuration. It's a container that holds all the rules you want to apply to your traffic. When you create a web ACL, you associate it with an AWS resource like a CloudFront distribution, Application Load Balancer, or API Gateway API.

Each web ACL has a default action (allow or block) that applies to any request that doesn't match any of your rules. This is your "catch-all" behavior. Setting the default action to Allow means requests are allowed unless explicitly blocked by a rule, which is the most common configuration. Setting it to Block means everything is blocked unless explicitly allowed, which is more secure but can cause issues if you forget to allow legitimate traffic.

Rules: The Individual Filters

Within a web ACL, you add rules—the specific conditions you want to check. Each rule contains one or more statements that define what to look for in a request. AWS WAF provides several rule statement types:

• IP set match - Matches IP addresses in your list
• Geographic match - Matches requests from specific countries/regions
• String match - Searches for specific strings in request components
• Regex match - Uses regular expressions for pattern matching
• SQLi match - Detects SQL injection attempts
• XSS match - Detects cross-site scripting attacks
• Size constraint - Checks request component sizes
• Rate-based - Limits request rates over time

Rule Groups: Pre-built Protection Packages

For common threats, AWS offers managed rule groups—pre-configured collections of rules that address specific attack vectors. You simply add these to your web ACL instead of creating individual rules from scratch. AWS provides several categories of managed rule groups:

• Baseline rule groups - Common web exploits (Core rule set)
• Use-case specific - WordPress, PHP, etc.
• IP reputation - Known malicious IPs
• Bot Control - Automated traffic management
• Account takeover prevention - Credential stuffing protection

Web ACL Capacity Units (WCUs)

Each rule in AWS WAF consumes capacity units (WCUs) that count against your web ACL's capacity limit. The basic price for a web ACL includes up to 1,500 WCUs. Using more than 1,500 WCUs incurs additional fees according to a tiered pricing structure.

Different rule types consume different amounts of WCUs based on their complexity. For example, a simple IP match rule uses 1 WCU, while a complex rule with multiple conditions and transformations might use 10 or more WCUs. When planning your web ACL, consider the WCU consumption of your rules to avoid unexpected charges.

AWS WAF vs AWS Shield: What's the Difference?

AWS offers two complementary services for web protection, and understanding their differences is crucial. They're not competitors—they're designed to work together.

AWS Shield Standard: The Free Baseline

AWS Shield Standard is automatically included at no extra cost for all AWS customers. It protects against common DDoS attacks targeting your infrastructure at Layer 3/4 (network and transport layers). If you're using CloudFront or Route 53, you already have this protection.

Shield Standard uses AWS's global infrastructure to detect and mitigate common DDoS attacks automatically. You don't need to configure anything—it just works. However, it provides limited visibility into attack details and no customization options.

AWS Shield Advanced: The Premium Tier

AWS Shield Advanced provides expanded DDoS protection for higher-profile applications. It costs $3,000 per month (1-year commitment) plus data transfer fees, but includes AWS WAF at no additional cost for protected resources. Shield Advanced adds application layer (Layer 7) DDoS protection and integrates with AWS WAF for web ACLs, rules, and rule groups.

How They Work Together

AWS Shield Advanced uses AWS WAF web ACLs, rules, and rule groups as part of its application layer protections. If you subscribe to Shield Advanced, you get AWS WAF included for the resources you protect with Shield Advanced. This means you can create sophisticated web ACLs with rules to mitigate application layer attacks, and Shield Advanced will automatically apply these protections during DDoS events.

Even if you don't subscribe to Shield Advanced, AWS WAF and Shield Standard work together to provide comprehensive protection. Shield Standard handles network layer attacks automatically, while WAF handles application layer filtering based on your rules.

AWS WAF vs Cloudflare WAF vs Azure WAF: Complete Comparison

When choosing a web application firewall, you have three main options in the cloud market. Here's how they compare across key dimensions:

When to Choose Each Option

• Choose AWS WAF if you're already invested in the AWS ecosystem, have variable traffic workloads, or need tight integration with CloudFront, ALB, or API Gateway.
• Choose Cloudflare WAF if you want an easy setup, need CDN integration, or have a WordPress site. Their free tier is excellent for small sites.
• Choose Azure WAF if your applications are hosted in Azure, you need compliance certifications, or you're using Application Gateway or Front Door.

AWS WAF Pricing: How Much Does It Really Cost?

AWS WAF pricing is straightforward but has several components you need to understand. Here's the complete breakdown based on official AWS pricing documentation:

Base Costs

Additional Costs

Several features incur additional charges:

• Bot Control - Additional per-request cost for advanced bot detection
• CAPTCHA and Challenge - Charges per CAPTCHA/Challenge action performed
• Advanced request body inspection - For requests larger than 8KB
• Exceeding WCU limits - If your web ACL exceeds 1,500 WCUs, you pay for additional capacity

The Hidden Savings

As of October 25, 2024, CloudFront no longer charges for requests that AWS WAF blocks. This is a significant cost-saving for websites with heavy bot traffic or attack attempts. You still pay the WAF evaluation fee, but you save on CloudFront request charges and data transfer for all blocked requests.

Cost Optimization Tips

1. Use scope-down statements to limit which requests are evaluated by expensive rules.
2. Apply lower-cost rules first to filter traffic before using expensive Bot Control or ATP rule groups.
3. Separate static and dynamic content to apply advanced controls only to dynamic endpoints.
4. Monitor CloudWatch metrics to track WAF costs and usage patterns.
5. Use AWS Shield Advanced if you have high-volume workloads—it includes WAF at no additional cost.

How to Enable AWS WAF: Step-by-Step Setup Guide

Setting up AWS WAF involves creating a web ACL, adding rules, and associating it with your resource. Here's the complete process.

Step 1: Create a Web ACL

1. Sign in to the AWS Management Console and navigate to AWS WAF.
2. Choose Go to AWS WAF (if you have access to the updated console experience) or Switch to AWS WAF Classic (if you need to use the classic interface).
3. Choose Create web ACL.
4. Enter a name for your web ACL (e.g., "MyWebsite-Production").
5. Choose a Region: For CloudFront distributions, you must use US East (N. Virginia). For regional resources (ALB, API Gateway), choose the region where your resource is located.
6. Set the default action to either Allow (most common) or Block.
7. Choose Next to proceed to rule configuration.

Step 2: Add Rules to Your Web ACL

There are three ways to add rules:

• Add AWS managed rule groups - Recommended starting point for most users
• Add your own rules - For custom filtering logic
• Add rules from AWS Marketplace - Third-party rule groups (additional cost)

For beginners, start with the AWS Managed Rules Common Rule Set which protects against the OWASP Top 10 vulnerabilities. This single rule group provides protection against SQL injection, cross-site scripting, and other common attacks.

Step 3: Associate the Web ACL with Your Resource

1. In the web ACL details page, choose Associations.
2. Choose Add association.
3. Select the resource type (CloudFront distribution, Application Load Balancer, or API Gateway API).
4. Choose the specific resource you want to protect.
5. Choose Add.

Step 4: Test and Monitor

After setup, monitor your WAF metrics in CloudWatch to see how many requests are being blocked or allowed. Use Test mode (Count action instead of Block) to verify rules are working correctly before enforcing them.

AWS WAF JSON Configuration Examples

For programmatic configuration or infrastructure-as-code, you can use JSON to define your web ACLs and rules. Here are practical examples.

Creating a Web ACL with AWS CLI

Here's how to create a basic web ACL using the AWS CLI:

aws wafv2 create-web-acl \
  --name "MyWebACL" \
  --scope "CLOUDFRONT" \
  --default-action Allow={} \
  --visibility-config "SampledRequestsEnabled=true,CloudWatchMetricsEnabled=true,MetricName=MyWebACLMetrics" \
  --region us-east-1

Adding a Rule to a Web ACL

To add a rule that blocks requests from a specific IP address:

aws wafv2 update-web-acl \
  --name "MyWebACL" \
  --scope "CLOUDFRONT" \
  --id "web-acl-id" \
  --lock-token "lock-token" \
  --rules '[{
    "Name": "BlockSpecificIP",
    "Priority": 1,
    "Statement": {
      "IPSetReferenceStatement": {
        "ARN": "arn:aws:wafv2:us-east-1:123456789012:global/ipset/MyIPSet/12345678-1234-1234-1234-123456789012"
      }
    },
    "Action": {
      "Block": {}
    },
    "VisibilityConfig": {
      "SampledRequestsEnabled": true,
      "CloudWatchMetricsEnabled": true,
      "MetricName": "BlockSpecificIP"
    }
  }]' \
  --default-action Allow={} \
  --region us-east-1

Rate-Based Rule JSON Example

Here's a JSON example for a rate-based rule that limits requests to a login page:

{
  "Name": "RateLimitLogin",
  "Priority": 1,
  "Statement": {
    "RateBasedStatement": {
      "Limit": 100,
      "EvaluationWindowSec": 300,
      "AggregateKeyType": "IP",
      "ScopeDownStatement": {
        "ByteMatchStatement": {
          "SearchString": "/login",
          "FieldToMatch": {
            "UriPath": {}
          },
          "TextTransformations": [
            {
              "Priority": 0,
              "Type": "LOWERCASE"
            }
          ],
          "PositionalConstraint": "STARTS_WITH"
        }
      }
    }
  },
  "Action": {
    "Block": {}
  },
  "VisibilityConfig": {
    "SampledRequestsEnabled": true,
    "CloudWatchMetricsEnabled": true,
    "MetricName": "RateLimitLogin"
  }
}

AWS WAF Bot Control: Managing Automated Traffic

Bot Control is a managed rule group that helps you monitor, block, or rate limit bots such as scrapers, scanners, crawlers, status monitors, and search engines. It provides two protection levels:

Common Protection Level

The basic level adds labels to self-identifying bots, verifies generally desirable bots (like search engines), and detects high-confidence bot signatures. This gives you visibility into bot traffic without aggressive blocking.

Targeted Protection Level

The advanced level uses detection techniques like browser interrogation, fingerprinting, and behavior heuristics to identify sophisticated bots that don't self-identify. This includes optional machine learning analysis to detect bot-related activity patterns.

AI Traffic Monetization

Bot Control also provides AI traffic monetization, which lets you charge AI bots and agents for content access. When you add rules with the Monetize action, you can use Bot Control labels to differentiate pricing based on bot identity and verification status.

Rate Limiting: Protecting Against Floods and DoS Attacks

Rate-based rules are one of AWS WAF's most powerful features. They allow you to limit the number of requests from a single source over a time period, which is essential for protecting against brute force attacks, credential stuffing, and application layer DDoS.

How Rate-Based Rules Work

A rate-based rule counts incoming requests and rate limits requests when they are coming at too fast a rate. The rule aggregates requests according to your specification (like IP address or headers) and applies a limit over an evaluation window (1 minute or 5 minutes).

Configuring a Rate-Based Rule

1. In your web ACL, choose Add rules > Add my own rules.
2. Choose Rate-based rule.
3. Set the Rate limit (e.g., 2000 requests per 5 minutes).
4. Choose the Aggregation key (usually IP address).
5. Optionally, add a scope-down statement to limit which requests are counted (e.g., only count requests to /login).
6. Set the Action to Block.

Advanced Rate Limiting Features

AWS WAF rate-based rules support advanced aggregation options beyond simple IP-based limiting:

• IP + User Agent pair - Rate limit by both IP and browser
• Custom aggregation - Rate limit by any request component
• Forwarded IP - Rate limit based on X-Forwarded-For header
• Labels - Rate limit requests that match specific labels from other rules

CAPTCHA and Challenge Actions: Human Verification

AWS WAF can challenge suspicious requests with a CAPTCHA or Challenge action, verifying that the request comes from a real human rather than an automated bot.

How CAPTCHA Works in AWS WAF

When a request matches a rule with a CAPTCHA action, AWS WAF returns a CAPTCHA challenge to the client. The client must solve the CAPTCHA to proceed. If solved correctly, the client receives a token that allows subsequent requests for a limited time.

Challenge Action (Alternative to CAPTCHA)

The Challenge action is a lighter alternative that verifies the client without requiring CAPTCHA solving. It's useful for less suspicious traffic where you want additional verification without the user friction of a CAPTCHA.

Best Use Cases

• Login pages - Prevent credential stuffing attacks
• Form submissions - Stop spam and bot submissions
• Sensitive actions - Verify humans for account changes
• Rate limiting exceptions - Allow legitimate users to bypass rate limits

Geographic Blocking and IP Sets

AWS WAF provides two main methods for controlling access based on origin: geographic blocking and IP sets.

Geographic Match Rules

You can create rules that block or allow requests based on the country or region where they originate. AWS WAF uses the alpha-2 country codes from the ISO 3166 international standard. For example, to block all traffic from China and Russia, you would create a geographic match rule with country codes ["CN", "RU"].

IP Sets for Whitelisting and Blacklisting

IP sets allow you to create lists of IP addresses that you want to allow or block. You can maintain separate IP sets for trusted sources (whitelist) and known malicious sources (blacklist).

Forwarded IP Configuration

By default, AWS WAF uses the IP address in the web request origin. However, if your traffic goes through a proxy or load balancer, you can configure rules to use a forwarded IP from an HTTP header like X-Forwarded-For instead.

AWS WAF Integration with Monitoring and Logging Services

AWS WAF integrates with several AWS services for monitoring, logging, and centralized management.

CloudWatch Metrics

AWS WAF automatically publishes metrics to Amazon CloudWatch. Key metrics include:

• AllowedRequests - Number of allowed requests
• BlockedRequests - Number of blocked requests
• CountedRequests - Number of counted requests (test mode)
• PassedRequests - Number of requests that passed all rules

Logging Destinations

AWS WAF can send detailed logs to multiple destinations:

• Amazon CloudWatch Logs - For real-time monitoring and alerting
• Amazon S3 - For long-term storage and analysis
• Amazon Kinesis Data Firehose - For streaming to third-party services like Splunk

To enable logging, use the put-logging-configuration API or configure it in the AWS WAF console under your web ACL settings.

AWS Firewall Manager Integration

For organizations with multiple AWS accounts, AWS Firewall Manager provides centralized management of AWS WAF across your organization. You can define policies once and apply them consistently across all accounts and resources.

AWS WAF Quotas and Limits: What You Need to Know

AWS WAF has specific quotas and limits that you should be aware of when planning your implementation.

Requesting Quota Increases

If you need higher limits, you can request quota increases through AWS Support. Most quotas can be increased, but some have hard limits based on service architecture.

AWS WAF Best Practices for 2026

Follow these best practices to get the most out of AWS WAF while minimizing costs and false positives.

Start with Test Mode

Before enforcing rules with Block action, use Count action to see how many requests would be affected. This helps you avoid blocking legitimate traffic. Monitor CloudWatch metrics to see how many requests match each rule while in test mode.

Use Scope-Down Statements

Scope-down statements limit which requests are evaluated by a rule, reducing costs and improving performance. For example, apply Bot Control only to /api/* endpoints, not to static images.

Implement Layered Protection

Use a "pyramid" approach: apply low-cost, high-volume filters first (like IP reputation rules), then more expensive rules (like Bot Control) only for traffic that passes the earlier checks.

Monitor and Tune Regularly

Use CloudWatch metrics and AWS WAF logging to track your protection performance. Adjust rules based on actual traffic patterns rather than set-and-forget.

Troubleshooting Common AWS WAF Issues

Here are solutions to the most common problems users encounter with AWS WAF.

Problem: Legitimate Users Are Being Blocked

Cause: Rules are too aggressive, or false positives are occurring.

Fix: Switch to Count action temporarily to identify which rules are causing blocks. Use scope-down statements to narrow rule application. Create exceptions for legitimate traffic patterns.

Problem: Costs Are Higher Than Expected

Cause: Evaluating too many requests with expensive rules, or using Bot Control on all traffic.

Fix: Apply scope-down statements to limit Bot Control to dynamic endpoints. Use lower-cost rules first to filter traffic. Monitor CloudWatch metrics to track usage.

Problem: WAF Not Blocking Expected Traffic

Cause: Default action is Allow, or rules aren't correctly configured.

Fix: Verify default action is set to Block. Check that rules are correctly ordered and associated with the right resource. Use the AWS WAF console to test rules against sample requests.

Problem: "Internal Error" in WAF Logs

Cause: Rule complexity or size constraints exceeded.

Fix: Simplify complex rules with multiple conditions. Check request body size (default limit is 8KB). Consider using text transformations before matching.

Jake's Perspective: Is AWS WAF Worth It for a Small Business?

As a phone shop owner with an online store, Jake initially questioned whether AWS WAF was necessary for his small business.

Ethan adds: "For Jake's use case, I'd recommend starting with the AWS Managed Rules Common Rule Set and a rate-based rule to protect his login page. That's about $7/month and provides solid baseline protection. He can add more advanced features later if his traffic grows or if he sees specific attack patterns in his metrics."

When Nothing Works: A Path Forward for Complex Cases

Sometimes you've exhausted the standard troubleshooting approaches and still have issues. Here are paths forward for complex cases.

Option 1: Start Fresh with a New Web ACL

If your current web ACL has accumulated too many rules or complex configurations, sometimes it's easier to start over. Create a new web ACL with only essential rules and gradually add more as you verify each works correctly.

Option 2: Use AWS Firewall Manager for Centralized Management

If you're managing WAF across multiple accounts or applications, AWS Firewall Manager can simplify administration. It provides a single pane of glass for managing WAF policies across your organization.

Option 3: Consider Third-Party WAF Solutions

If AWS WAF isn't meeting your needs, consider alternatives like Cloudflare WAF or Imperva WAF. These might offer different features or pricing models that better fit your requirements.

Option 4: Engage AWS Support

For persistent issues, AWS Support can help diagnose problems that aren't obvious from logs or metrics. They can review your configuration and provide specific recommendations.

Frequently Asked Questions

Is AWS WAF free?

No, AWS WAF is not free. It costs $5 per month per web ACL, $1 per month per rule, and $0.60 per million requests evaluated. However, AWS Shield Standard (which provides basic DDoS protection) is free and included with CloudFront and Route 53.

What is the full form of AWS WAF?

AWS WAF stands for Amazon Web Services Web Application Firewall. It's a web application firewall that inspects HTTP/HTTPS requests and blocks malicious traffic based on rules you define.

How much does AWS WAF cost per month?

A basic AWS WAF configuration costs approximately $6-10 per month: $5 for one web ACL, $1-5 for 1-5 rules, and minimal request charges for low-traffic sites. Costs increase with traffic volume and additional features like Bot Control or CAPTCHA.

Does AWS WAF protect against DDoS attacks?

AWS WAF provides application layer (Layer 7) DDoS protection by filtering malicious requests. For network layer (Layer 3/4) DDoS protection, use AWS Shield Standard (free) or AWS Shield Advanced (paid). Shield Advanced includes AWS WAF at no additional cost for protected resources.

What is the difference between AWS WAF and AWS Shield?

AWS WAF is a web application firewall that filters HTTP/HTTPS requests based on rules. AWS Shield Standard provides free baseline DDoS protection at network layer. AWS Shield Advanced provides advanced DDoS protection and includes AWS WAF capabilities. They're complementary services, not alternatives.

Is AWS WAF regional or global?

AWS WAF is available globally for CloudFront distributions, but you must use the US East (N. Virginia) region to create and manage web ACLs for CloudFront. For regional resources like Application Load Balancers and API Gateway APIs, you use the region where your resource is located.

Can AWS WAF block specific IP addresses?

Yes, you can create IP set rules to block specific IP addresses or ranges. You can also create IP sets for whitelisting (allowing) trusted IPs and blacklisting (blocking) known malicious IPs.

What is a web ACL in AWS WAF?

A web ACL (Access Control List) is the foundation of your AWS WAF configuration. It's a container that holds all the rules you want to apply to your traffic. You associate web ACLs with AWS resources like CloudFront distributions or Application Load Balancers.

How do I add AWS WAF to my CloudFront distribution?

1. Create a web ACL in the US East (N. Virginia) region.
2. Add rules to the web ACL (start with AWS Managed Rules Common Rule Set).
3. Associate the web ACL with your CloudFront distribution.
4. Test with Count action before enforcing with Block action.

What is Bot Control in AWS WAF?

Bot Control is a managed rule group that helps monitor, block, or rate limit bots such as scrapers, scanners, and crawlers. It provides common protection (for self-identifying bots) and targeted protection (for sophisticated bots) with additional cost.

Can AWS WAF block countries?

Yes, AWS WAF supports geographic match rules that block or allow requests based on country or region. You specify two-character country codes from the ISO 3166 standard (e.g., "US" for United States, "CN" for China).

What is rate limiting in AWS WAF?

Rate limiting in AWS WAF allows you to restrict the number of requests from a single source (usually IP address) over a time period. This protects against brute force attacks and application layer DDoS. You can set rate limits from 100 to 2,000,000,000 requests per 5-minute window.

Does AWS WAF support CAPTCHA?

Yes, AWS WAF supports CAPTCHA and Challenge actions for rules. When a request matches a rule with these actions, the client must solve a CAPTCHA or complete a challenge to proceed. This verifies the request comes from a human rather than an automated bot.

How does AWS WAF pricing work with Shield Advanced?

When you use AWS Shield Advanced, AWS WAF is included at no additional cost for resources protected by Shield Advanced. You only pay for Shield Advanced itself ($3,000/month) plus data transfer charges.

Can I use AWS WAF with Application Load Balancer?

Yes, AWS WAF can protect Application Load Balancers, API Gateway APIs, and CloudFront distributions. For regional resources like ALBs, you create web ACLs in the same region as your resource.

Also Read:

What is Amazon Macie? The archivist who reads your buckets  

What is AWS KMS? Who holds the keys to your data  

What is AWS Secrets Manager? Passwords out of your code 

Revision note. Written September 2026, covering current AWS WAF features and pricing as of Q3 2026. AWS regularly updates WAF capabilities and occasionally adjusts pricing—we'll update this guide as significant changes occur. We hope this helps you understand how AWS WAF can protect your web applications—there's no better time to start securing your websites against common exploits and automated attacks.