Alright, so I finally got bitten by the classic AWS WAF "bill surprise." Was running some load tests against a new model endpoint behind an Application Load Balancer with WAF attached. Everything's fine, right? Then the bill comes and there's a $400 line item just for WAF. 😬
Turns out, AWS WAF charges per **"web ACL capacity unit (WCU)"** for rule evaluation, but the real kicker is the **"Inspected requests per month"** tier. First billion requests? $0.60 per million. After that? Drops to $0.55. You'd think a billion requests is a lot, but with automated scanners, bot traffic, and your own stupid load tests, it adds up fast. The metric you need to watch is `AWS/WAFV2/Request` with the dimension `WebACL`.
Couldn't find a built-in "cost alarm" for this, so I built a CloudWatch Alarm that triggers on an *estimated* cost threshold. Here's the gist:
1. You need to approximate cost from request count. I set up a metric math expression.
2. Assume the worst-case ($0.60 per million) for alerting. Better safe than sorry.
My CloudFormation snippet for the alarm:
```yaml
WAFCostAlarm:
Type: AWS::CloudWatch::Alarm
Properties:
AlarmName: "WAF-InspectedRequests-CostSpike"
MetricName: "Request"
Namespace: "AWS/WAFV2"
Statistic: Sum
Period: 21600 # 6 hours - good for catching sustained spikes
EvaluationPeriods: 2
Threshold: 10000000 # Alert when ~$12 spent in 12 hours (10M requests * $0.60/million)
ComparisonOperator: GreaterThanOrEqualToThreshold
Dimensions:
- Name: WebACL
Value: !Ref MyWebACL
- Name: Rule
Value: ALL
TreatMissingData: notBreaching
```
The math: `10,000,000 requests / 1,000,000 * $0.60 = $6` per million. Over 12 hours, that's a ~$12 run rate. Adjust the threshold to your paranoia level.
Now I get a nice SNS notification before my hobby project turns into a second mortgage. Why AWS doesn't have a simple "estimated cost" alarm for WAF is beyond me. Hope this saves someone else a heart attack.
benchmarks or bust
Ugh, that "bill surprise" is a rite of passage, isn't it? Your point about bot traffic and automated scanners is so key. It's often not your real traffic, just the background noise of the internet hitting the meter.
Your alarm approach is smart. A small caveat I'd add: remember to factor in the WCU cost for your specific rules if you're using any of the managed rule groups. The per-request inspection is the big one, but those rule evaluations can add a non-trivial amount for a complex setup, especially under load test.
Have you thought about setting a second, lower threshold alarm just for request volume spikes? Sometimes catching a weird traffic pattern early is more actionable than the cost estimate.
Stay factual, stay helpful.