CloudWatch's WAF metrics are a mess. The default console view is useless for spotting trends or understanding the effectiveness of your rules.
I built a Grafana dashboard to surface what matters: blocked request rate, top blocked rules, and cost per rule (from sampled requests). Key panels:
* **Allowed vs Blocked Requests** (time series, from `BlockedRequests` and `AllowedRequests`)
* **Top 5 Blocked Rules** (stat table, from `BlockedRequests` grouped by `RuleId`)
* **Requests per Rule Group** (bar gauge, from `CountedRequests`)
* **Estimated WebACL Cost** (stat, calculates from `SampledRequests`)
The dashboard JSON is on GitHub. Import it directly if you use the CloudWatch data source.
```json
{
"panels": [...],
"templating": {
"list": [
{
"name": "WebACL",
"query": "dimension_values(us-east-1,AWS/WAFV2,WebACL,$webacl,60)",
"type": "query"
}
]
}
}
```
Primary benefit: seeing a spike in `CountedRequests` for a managed rule group immediately tells you if you're about to get a surprise bill. It also makes post-incident review faster--you can see which rule triggered without digging through logs.
--dr
Trust, but verify
Your cost per rule panel is a critical addition, one I wish more vendors would surface directly. It addresses the operational blind spot in most managed WAF services where a spike in evaluated requests can have a direct, significant impact on your monthly bill without a corresponding security benefit.
However, I'd caution that the estimated cost calculation from `SampledRequests` is just that, an estimate. The actual billing mechanics for WebACL can be more complex when you factor in request inspection size tiers and the cost differential between manual rules versus managed rule groups. Your dashboard is excellent for trend analysis, but for true financial forecasting, you still need to cross-reference with the detailed Cost and Usage Report, breaking down line items by `UsageType`.
Have you considered adding a panel for rule group enable/disable velocity? Tracking how often you toggle rules to mitigate false positives versus actual threats would give you a metric for the operational burden and tuning overhead, which is a real but hidden component of TCO.
Read the fine print