Quick Answer
Last verified:
High confidence

AWS WAF + API Gateway Shield costs $0.40 to $0.40 per per thousand attempts as of July 2026. Plan: AWS WAF - CAPTCHA attempt at $0.4/per thousand attempts. Pricing depends on your chosen tier, contract length, and negotiated discounts.

Use the interactive pricing calculator to estimate your exact cost based on team size and requirements.

  • Free tier: No free tier available

AWS WAF + API Gateway Shield offers 1 pricing tiers: AWS WAF - CAPTCHA attempt. Paid plans include AWS WAF - CAPTCHA attempt at $0.4/per thousand attempts.

Last verified: | Sources: 1 pricing pages and reviews
Know Before You Buy — See AWS WAF + API Gateway Shield Plans

AWS WAF + API Gateway Shield lists $0.4-$0.4/per thousand attempts, but hidden costs like implementation and support add to the total as of July 2026. Key hidden costs: wcu overages, deep body inspections, waf logging costs. Verified from 1 sources by CostBench.

Hidden Costs Breakdown

1

WCU Overages

high overage

Complex WAF rule sets exceeding the default 1,500 WCU limit can incur an additional charge.

industry

AWS WAF Specific Costs: * Web ACL Capacity Unit (WCU) Overages: While a Web ACL has a default limit of 1,500 WCUs, complex rule sets exceeding this can incur an additional charge of $0.20 per million requests for every 500 WCUs beyond the limit.

2

Deep Body Inspections

low overage

Inspections beyond the default 16KB can add to the bill.

industry

Deep Body Inspections: Inspections beyond the default 16KB can add $0.30 per million requests to the bill.

3

WAF Logging Costs

high overage

Ingestion and storage costs for verbose WAF logs sent to Amazon S3 or CloudWatch can sometimes rival the WAF fees themselves, though 500 MB of CloudWatch Logs Vended Logs Ingestion is included for every 1 million WAF requests.

industry

Logging Costs: WAF logs are often verbose and, when sent to Amazon S3 or CloudWatch, their ingestion and storage costs can sometimes rival the WAF fees themselves.

4

Managed Rule Group Subscriptions

medium addon

Advanced protections like Bot Control and Fraud Control, and AWS Marketplace managed rule groups, have their own subscription fees and tiered request fees.

industry

Managed Rule Group Subscriptions: While AWS provides standard managed rules for $1.00 per month, advanced protections like Bot Control and Fraud Control have their own subscription fees and tiered request fees.

5

Interactive Challenges

low overage

CAPTCHA completions and serving silent challenge pages incur per-attempt or per-response costs.

industry

Interactive Challenges: CAPTCHA completions cost $0.40 per 1,000 attempts, and serving a silent challenge page costs $0.15 per 1,000 responses.

6

WAF Engineering Time

medium implementation

Managing complex WAF rule configurations can be a significant hidden cost, with some reports suggesting 5-10 hours per month for proper management.

industry

Engineering Time: Managing complex WAF rule configurations can be a significant hidden cost, with some reports suggesting 5-10 hours per month for proper management.

7

Shield Advanced DTO Usage Fees

high overage

Shield Advanced incurs charges for data transfer out from protected resources, which can range from a few cents to over ten cents per GB.

industry

AWS Shield Advanced Specific Costs: * Data Transfer Out (DTO) Usage Fees: In addition to the fixed monthly fee, Shield Advanced incurs charges for data transfer out from protected resources like Amazon CloudFront, Amazon EC2, and Elastic Load Balancing (ELB).

8

Integration with other AWS services

low addon

AWS WAF charges are in addition to the pricing of services it protects, such as Application Load Balancer, Amazon API Gateway, and Amazon CloudFront.

industry

General Implementation Costs: * Integration with other AWS services: AWS WAF charges are in addition to the pricing of services it protects, such as Application Load Balancer (ALB), Amazon API Gateway, and Amazon CloudFront.

9

Initial Setup Engineering Effort

medium implementation

The engineering effort to design, configure, and test WAF rules can be substantial.

industry

Initial Setup: While AWS WAF itself has no initial implementation cost, the engineering effort to design, configure, and test rules can be substantial.

Frequently Asked Questions

01 What hidden costs should I budget for with AWS WAF + API Gateway Shield?

Beyond the license fee, budget for: WCU Overages ($0.20 per million requests for every 500 WCUs beyond the limit); Deep Body Inspections ($0.30 per million requests); Managed Rule Group Subscriptions ($20-$40 per month each); Interactive Challenges ($0.40 per 1,000 attempts); Shield Advanced DTO Usage Fees ($20,000 in one month). Exact totals depend on your deployment size and negotiated terms.

02 Does AWS WAF + API Gateway Shield charge for implementation?

AWS WAF + API Gateway Shield implementation is not included in the license cost. Managing complex WAF rule configurations can be a significant hidden cost, with some reports suggesting 5-10 hours per month for proper management..

03 How much does AWS WAF + API Gateway Shield support cost?

Premium support pricing for AWS WAF + API Gateway Shield depends on your tier and contract terms. See the sourced cost breakdown above for any verified figures we have.

04 Are there overage or storage costs with AWS WAF + API Gateway Shield?

Complex WAF rule sets exceeding the default 1,500 WCU limit can incur an additional charge.. Estimated impact: $0.20 per million requests for every 500 WCUs beyond the limit.

05 What add-ons cost extra with AWS WAF + API Gateway Shield?

Add-on pricing for AWS WAF + API Gateway Shield varies by feature. The sourced cost breakdown above lists any verified add-on costs we have.

Now You Know the Real Cost — See AWS WAF + API Gateway Shield Plans

Check current AWS WAF + API Gateway Shield pricing

Prices and terms change; verify against the live pricing page.

See AWS WAF + API Gateway Shield Pricing