We are using it to monitor the requests on our site, to block sudden surges of users on our website, and also to prevent DDoS attacks.
Junior Associate - IT at a tech services company with 201-500 employees
Can block sudden surges of users on the website and provides protection against DDoS attacks
Pros and Cons
- "The most valuable feature is the addition of managed tools that help us create customizable rules. In case we want to block a particular request, we can make use of those rules."
- "One area that could be improved is the DDoS protection."
What is our primary use case?
What is most valuable?
The addition of managed tools that help us create customizable rules. In case we want to block a particular request, we can make use of those rules.
What needs improvement?
One area that could be improved is the DDoS protection. We had a DDoS attack recently, and even though we had set a limit of 1,000 requests per five minutes, AWS WAF was not able to block all of the requests.
AWS wasn't able to clarify all the DDoS attacks. It may have been due to a wrong configuration in the rules, but AWS didn't block all the requests.
For how long have I used the solution?
It's been deployed in a project for one year.
Buyer's Guide
AWS WAF
March 2025

Learn what your peers think about AWS WAF. Get advice and tips from experienced pros sharing their opinions. Updated: March 2025.
845,040 professionals have used our research since 2012.
What do I think about the stability of the solution?
I would rate the stability a ten out of ten. It is a very stable solution. There are over 16 end users using the solution.
What do I think about the scalability of the solution?
I would rate the scalability a nine out of ten. There is room for improvement.
How was the initial setup?
The initial setup is easy. You don't need to do too many things.
What about the implementation team?
The deployment was done manually on the console, there is no need of propriety. It took around an hour and half.
What's my experience with pricing, setup cost, and licensing?
The pricing totally depends on the number of requests entering the WAF. For example, in case we have a DDoS type of attack, at that time, the price will surge quickly. For example, it will go up to two hundred dollars within three to four days. So it totally depends on the number of requests it is processing.
There are additional costs to the standard license because it totally depends on the number of incoming requests.
What other advice do I have?
Overall, I would rate the solution an eight out of ten.
I would recommend that understanding how the rules work exactly and finding patterns based on those rules is the most important thing in AWS WAF. It's quite easy to deploy at first, but afterward, it's essential to know how to handle it properly. Enabling the managed tools of AWS can sometimes block legitimate requests too. So, it's important to understand the type of requests you want to allow and how to configure the rules accordingly. It's quite an interesting aspect of AWS WAF.
Disclosure: My company has a business relationship with this vendor other than being a customer:

Head of Digital Product Office at a energy/utilities company with 10,001+ employees
An excellent solution that's extremely scalable, very stable, and has great AI functionality
Pros and Cons
- "The ability to take multiple data sets and match those data sets together is the solution's most valuable feature. The data lake that comes with it is very useful because that allows us to match data sets with different configurations that we wouldn't normally be able to match."
- "The solution is cloud-based, and therefore the billing model that comes with it could be more intuitive, in my opinion. It's very easy to not fully understand how you tag things for billing and then you can quite easily run up a high bill without realizing it. The solution needs to be more intuitive around the tagging system, which enables the billing. Right now, I have a cloud architect that does that on our behalf and it isn't something that a business user could use because it still requires quite a lot of technical knowledge to do effectively."
What is our primary use case?
We primarily use the solution for its rich insights to improve customer experience.
What is most valuable?
The ability to take multiple data sets and match those data sets together is the solution's most valuable feature. The data lake that comes with it is very useful because that allows us to match data sets with different configurations that we wouldn't normally be able to match.
The AI functionality and the machine learning are very good.
What needs improvement?
The solution is cloud-based, and therefore the billing model that comes with it could be more intuitive, in my opinion. It's very easy to not fully understand how you tag things for billing and then you can quite easily run up a high bill without realizing it. The solution needs to be more intuitive around the tagging system, which enables the billing. Right now, I have a cloud architect that does that on our behalf and it isn't something that a business user could use because it still requires quite a lot of technical knowledge to do effectively.
For how long have I used the solution?
I've been using the solution for almost a year.
What do I think about the stability of the solution?
The solution is very stable.
What do I think about the scalability of the solution?
The solution is extremely scalable.
How are customer service and technical support?
We have Amazon managed services, and, as part of our agreement, we have the lower end of that managed service. The solution is not a business-critical system for us, so we have a four hour SLA for resolution. That's pretty good. We're very satisfied with technical support.
Which solution did I use previously and why did I switch?
Previous to this solution, we used Microsoft Azure.
Amazon allows you to provision more services once you have the initial platform in place. Using Amazon Marketplace, it's so simple to provide additional services and functionality so it allows you to grow the capability of the platform with very little integration into other systems because it's all built into the marketplace. With Azure, it's only capable of some products and they don't have APIs available to integrate as well as Amazon does.
How was the initial setup?
The initial setup was straightforward. Deployment took about three months. For the setup of the platform, we had six people. For the maintenance of the platform, we now have three people maintaining it.
What about the implementation team?
We brought Amazon on to set everything up for us. They made implementation very easy.
What other advice do I have?
We use the public cloud deployment model. We use the Amazon cloud.
From a technology perspective, Amazon is very simple. It requires, in order for it to run effectively, quite a mature cloud-based culture within your organization, however. My advice to others would be to get their operating model internally right before going ahead with the implementation.
I would rate the solution nine out of ten.
Disclosure: I am a real user, and this review is based on my own experience and opinions.
Buyer's Guide
AWS WAF
March 2025

Learn what your peers think about AWS WAF. Get advice and tips from experienced pros sharing their opinions. Updated: March 2025.
845,040 professionals have used our research since 2012.
Senior Administrator at a media company with 51-200 employees
Advanced security with effective OWASP filtering rules and easy connectivity
Pros and Cons
- "They filter a lot of attacks out."
- "Rule exclusion could be a bit more transparent."
What is our primary use case?
The primary use case for AWS WAF involves securing applications for our customers, who are mainly software developers. Their application is positioned behind the firewall.
How has it helped my organization?
DDoS attacks are being blocked by AWS WAF, which is something some of my customers really need as they are targeted quite often.
What is most valuable?
The most valuable feature of AWS WAF is the OWASP filtering rules. They filter a lot of attacks out. Moreover, the service includes DDoS protection.
What needs improvement?
Rule exclusion could be a bit more transparent. However, it works great overall.
For how long have I used the solution?
I have been working with AWS WAF for two years now.
What do I think about the stability of the solution?
AWS WAF is stable. I have no complaints regarding its stability.
What do I think about the scalability of the solution?
It is easy to scale up AWS WAF. I would rate it an eight out of ten on the scale of scalability.
How are customer service and support?
I have never needed customer support for AWS WAF.
How would you rate customer service and support?
Positive
Which solution did I use previously and why did I switch?
The old team I worked at is still using Enable Insight remote monitoring, but personally, I am now using Datadog.
How was the initial setup?
AWS WAF is easy to connect, and I would rate the overall setup process as a seven since it's still a lot of work.
What about the implementation team?
I manage the AWS WAF for my clients and am responsible for the implementation.
What was our ROI?
The return on investment is difficult to determine. When a successful hack attempt is stopped, the investment is already returned.
What's my experience with pricing, setup cost, and licensing?
The customers think AWS WAF is expensive. Compared to hardware solutions, it is slightly more expensive, but it includes extra services. Personally, I find it fairly priced.
Which other solutions did I evaluate?
I did not explicitly evaluate any alternate solutions for AWS WAF.
What other advice do I have?
If security is an issue and you want to be secure, you should use AWS WAF.
I'd rate the solution eight out of ten.
Which deployment model are you using for this solution?
Public Cloud
Disclosure: My company has a business relationship with this vendor other than being a customer:
Last updated: Nov 12, 2024
Flag as inappropriateA highly stable product that provides a good interface and is easy to configure
Pros and Cons
- "The interface is good."
- "The price could be improved."
What is our primary use case?
We use the solution to secure our public web server and run our document management process. We have service-oriented web servers and interactive web servers.
What is most valuable?
Custom rules are valuable to us. We have country-specific rules that we apply. The solution meets all our requirements. We never had a problem with the tool. The interface is good. We never had downtime. The solution does its job.
What needs improvement?
The price could be improved.
For how long have I used the solution?
I have been using the solution for more than two years.
What do I think about the stability of the solution?
The tool is highly stable.
What do I think about the scalability of the solution?
The tool is highly scalable. Almost all AWS products are highly scalable. I am the only user in my organization. The solution is running regularly. We check the logs whenever we have some issues. We do not include it in our security management system. It's a very small application. We use it to manage some documents.
How was the initial setup?
The initial setup is easy. The deployment took an hour. The setup and maintenance is easy. We do not face any issues with configuration.
What about the implementation team?
We deployed the solution in-house.
What's my experience with pricing, setup cost, and licensing?
The solution is reasonably priced.
What other advice do I have?
We never had DDoS attacks. We do not check logs deeply. The service is a very small portion of our application server. It is not a business-critical service. We check logs only when we have any performance or connectivity issues. Overall, I rate the product a nine out of ten.
Which deployment model are you using for this solution?
Public Cloud
Disclosure: I am a real user, and this review is based on my own experience and opinions.
DevOps Engineer at Hippo Video
It is user-friendly and has documentation on how to use it; it is stable and has a simple setup
Pros and Cons
- "What I like best about AWS WAF is that it's a simple tool, so I could understand the basics of AWS WAF in two to three hours."
- "AWS WAF would be better if it uses AI or machine learning to detect a potential attack or a potential IP that creates an attack even before it happens. I want AWS WAF to capture the IP and automatically write the rule to automate the entire process."
What is our primary use case?
We faced many potential threats, such as hackers flooding in the requests, so we started using AWS WAF to block those IPs and stop those attacks. If multiple IPs are trying to attack our product, we'll also use AWS WAF by selecting the endpoints the hackers were attacking and then blocking those endpoints. Our cybersecurity team primarily uses AWS WAF.
What is most valuable?
What I like best about AWS WAF is that it's a simple tool, so I could understand the basics of AWS WAF in two to three hours. From the start, I know its purpose and its use case.
AWS WAF also has documentation. It's a user-friendly tool, and it's easy to know how to block the IPs and endpoints.
What needs improvement?
AWS WAF would be better if it uses AI or machine learning to detect a potential attack or a potential IP that creates an attack even before it happens. I want AWS WAF to capture the IP and automatically write the rule to automate the entire process. I want an AI feature in AWS WAF in the future.
For how long have I used the solution?
I only saw how AWS WAF works for seven months when the cybersecurity team used it, so my knowledge of the tool is basic. I'm not an expert on AWS WAF.
What do I think about the stability of the solution?
AWS WAF is a stable product.
How are customer service and support?
I have yet to contact the AWS WAF technical support.
Which solution did I use previously and why did I switch?
As the company is an Amazon customer, the company looked into what other Amazon services could prevent the attack and came across AWS WAF when the attack happened. The tool was also easy to use and could prevent attacks and safeguard the company's product, so the company decided to use AWS WAF.
How was the initial setup?
The initial setup for AWS WAF was simple. It was a basic setup process, though I have no idea about deployment time.
What's my experience with pricing, setup cost, and licensing?
AWS WAF costs $5 monthly plus $1 for the rule. It's cheap, cost-wise. It's worth the money.
What other advice do I have?
AWS WAF has three users within the company.
If I were to advise you on using AWS WAF, I'd tell you first to understand how the attack is happening. For example, is it a single server attack or multiple servers or regions? It would be best to find out which target is being attacked. You need to know the basics before using AWS WAF. You also need to know the rules. You need to understand how to secure your endpoints. Users should have a basic understanding of AWS WAF and its purposes before using it. You need basic cybersecurity knowledge.
I'm new to cybersecurity, so AWS WAF is the first cybersecurity product I used and based on my experience and usage, it's a ten out of ten. AWS WAF is a user-friendly, on-point tool, and I could understand it easily.
My company is an Amazon customer.
Disclosure: I am a real user, and this review is based on my own experience and opinions.
Advisory and IT Transformation Consultant at a tech services company with 10,001+ employees
Helps secure applications, highly stable, and good support
Pros and Cons
- "The most valuable feature of AWS WAF is the extra layer of security that I have when connecting to my web applications."
- "AWS WAF could improve by making the overall management easier. Many people that have started working with AWS WAF do not have an easy time. They should make it easy to use."
What is most valuable?
The most valuable feature of AWS WAF is the extra layer of security that I have when connecting to my web applications.
What needs improvement?
AWS WAF could improve by making the overall management easier. Many people that have started working with AWS WAF do not have an easy time. They should make it easy to use.
The AWS WAF documentation sometimes is not clear and could improve for all levels of people using the solution, such as developers. The interface could be easier to use.
For how long have I used the solution?
I have been using AWS WAF for approximately three years.
What do I think about the stability of the solution?
AWS WAF is a highly stable solution.
What do I think about the scalability of the solution?
We have approximately 35 applications that are using the AWS WAF.
How are customer service and support?
The support from AWS WAF is good, I have used them often.
Which solution did I use previously and why did I switch?
I was previously using Cisco and I switched to AWS WAF because I was working mostly with cloud environments and needed more services. Additionally, I have used Microsoft Azure.
How was the initial setup?
The initial setup is AWS WAF complex. The steps to complete the implementation could be easier, such as making the web traffic go through the WAF and then through the web service. The information for connectivity could be documented or done easier. The whole process can take approximately 20 minutes.
What's my experience with pricing, setup cost, and licensing?
The price of AWS WAF is expensive if you do not know how to manage your software up or down. I price of the solution is average amongst the other competitors but it would be better if it was less expensive.
What other advice do I have?
My advice to others is they should give AWS WAF a try. It works well, secures the applications, and it improves them against attacks.
Which deployment model are you using for this solution?
Public Cloud
Disclosure: My company has a business relationship with this vendor other than being a customer: Partner
A stable tool offering good performance and technical support while needing an easy setup phase to get started
Pros and Cons
- "AWS WAF is a stable solution. The performance of the solution is very good."
- "AWS WAF should provide better protection to its users, and the security features need to improve."
What is our primary use case?
AWS WAF is a tool we use in my company since we don't currently have a firewall. We can be safer if we have a firewall, and the receive protection side can avoid any vulnerability attacks.
What is most valuable?
AWS WAF is a firewall we use from time to time in my company.
What needs improvement?
I don't think any improvement is needed in AWS WAF.
As technology develops and grows, AWS WAF will have to improve as a product.
AWS WAF should provide better protection to its users, and the security features need to improve.
For how long have I used the solution?
I have been using AWS WAF for six years. There is no specific version of the product since the vendor provides the services for the solution, and my company just uses it.
What do I think about the stability of the solution?
AWS WAF is a stable solution. The performance of the solution is very good.
Stability-wise, I rate the solution a ten out of ten.
What do I think about the scalability of the solution?
My company doesn't rely on AWS WAF's scalability since it's a tool that is totally on the cloud. If the tool goes down by any chance, AWS provides the solution on the steps that need to be taken.
Around 30 employees in my company use AWS WAF.
The product is not extensively used in my company.
My company has no plans to increase the number of users of AWS WAF. If our client wants to increase the number of users, we need to act on the server.
How are customer service and support?
The solution's technical support is good.
How was the initial setup?
The product's setup phase was pretty easy.
Sharing the code files and database configurations are the two steps we follow for deploying the product.
What about the implementation team?
The product's setup phase was carried out in-house.
What's my experience with pricing, setup cost, and licensing?
There are no separate licensing costs we pay for since it is included in the plan we purchase.
What other advice do I have?
AWS WAF has been releasing the product on a test-case basis.
It's always good to take precautionary methods for the production website. If everything goes fine, do work in your staging and UAT, not in the production part. The aforementioned details are the precautionary methods we have to follow.
Overall, I rate the solution a ten out of ten.
Disclosure: I am a real user, and this review is based on my own experience and opinions.
Solution architect at NTT
Protects web applications against attacks; stable and scalable firewall with a straightforward setup
Pros and Cons
- "Stable and scalable web application firewall. Setting it up is straightforward."
- "Technical support for AWS WAF needs improvement."
What needs improvement?
Support for AWS WAF needs improvement.
For how long have I used the solution?
I've been using AWS WAF for a very short period, e.g. just a few weeks.
What do I think about the stability of the solution?
I find AWS WAF to be a stable product.
What do I think about the scalability of the solution?
AWS WAF is a scalable product.
How are customer service and support?
Technical support for AWS WAF could still be improved, e.g. support could be faster, more knowledgeable, and friendlier.
How was the initial setup?
The initial setup for AWS WAF was straightforward. It could take between two days to two weeks.
What about the implementation team?
We implemented AWS WAF through our in-house team and a consultant.
What other advice do I have?
I've been using a mix of AWS products, including AWS WAF.
I'm satisfied with AWS WAF, and I've had no issues with it. I can't really find fault in the product. It's a good product.
We have hundreds of AWS WAF users within our company. We also have plans of increasing the number of users of the product.
The advice I would give to people who want to start using AWS WAF is that it's a good option if they're migrating to the cloud. It can take up a lot of legacy systems, e.g. it's scalable. Most of my customers are on the cloud, and for anyone who's struggling, it would be good to start anytime. Start small and scale, rather than just going fully onto the cloud.
Users need to pay for the product license.
My rating for AWS WAF is eight out of ten.
Which deployment model are you using for this solution?
Public Cloud
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Amazon Web Services (AWS)
Disclosure: I am a real user, and this review is based on my own experience and opinions.

Buyer's Guide
Download our free AWS WAF Report and get advice and tips from experienced pros
sharing their opinions.
Updated: March 2025
Product Categories
Web Application Firewall (WAF)Popular Comparisons
Prisma Cloud by Palo Alto Networks
Microsoft Azure Application Gateway
Azure Front Door
F5 Advanced WAF
Fortinet FortiWeb
NetScaler
Cloudflare Web Application Firewall
Imperva Web Application Firewall
Imperva DDoS
Akamai App and API Protector
Azure Web Application Firewall
Radware Alteon
NGINX App Protect
Fastly
Barracuda Web Application Firewall
Buyer's Guide
Download our free AWS WAF Report and get advice and tips from experienced pros
sharing their opinions.
Quick Links
Learn More: Questions:
- What are the limitations of AWS WAF vs alternative WAFs?
- Can you share your experience on migration from Akamai Kona Site to Amazon CloudFront and AWS WAF?
- How does AWS WAF compare to Microsoft Azure Application Gateway?
- Which lesser known firewall product has the best chance at unseating the market leaders?
- Which WAF solution would you recommend to cater to 100 to 125 concurrent sessions?
- What do you recommend for a securing Web Application?
- Fortinet vs Sophos? Help choose a NGFW solution that can replace Microsoft TMG.
- Imperva WAF vs. Barracuda: Which One is Better?
- F5 vs. Imperva WAF?
- When should companies use SSL Inspection?