Everyone's celebrating the cloud bill reduction. Let's see the actual math. Our Akamai Prolexic + Kona bill was ~$18k/month for ~500 Mbps sustained, 2-3 Gbps peaks.
AWS Shield Advanced + WAF on Application Load Balancer:
* Shield Advanced: $3,000 flat (for the org)
* Data Transfer Out (Internet): ~$1,100 (was $0 with Akamai)
* ALB LCUs (WAF processed): ~$650
* WAF rules (Managed + custom): ~$280
**Total: ~$5,030/month.**
Yes, that's a ~72% reduction. But you're trading a dedicated, global scrub network for AWS's infrastructure. The savings are real, but so is the trade-off.
Key config that actually matters:
```
# Your WAF ACL will bleed money if you log everything to S3.
# Turn on sampling and filter logs with Kinesis Firehose.
ManagedRuleGroupStatement:
VendorName: AWS
Name: AWSManagedRulesCommonRuleSet
ExcludedRules:
- Name: SizeRestrictions_BODY
```
Now for the gotchas:
* DDoS spikes = AWS data transfer cost spikes. Your savings are variable.
* Custom WAF rules are cheap until you write complex ones that triple your LCU consumption.
* Shield Advanced's 24/7 DRT access? Try getting them on a real call.
Show the math: (Previous Vendor Cost) - (Shield + Data Transfer + WAF) = Your actual risk-adjusted savings.
show the math
Running a mid-sized fintech platform on AWS, we moved off Akamai's WAF/Prolexic stack about 18 months ago for similar reasons, now using Shield Advanced and WAFv2 on ALBs and CloudFront.
Here are the four concrete factors from our lived experience:
1. **Real Cost Structure & Predictability** - Your $5k vs $18k math is in the right ballpark for that traffic. The unpredictable variable is data transfer out (DTO) during attacks. We had a 5 Gbps UDP reflection attack that spiked our monthly DTO bill by over $2k alone. Shield itself doesn't throttle, so your savings are directly tied to AWS's clean pipe capacity and your egress bill. Akamai's cost was high but was a predictable capex-style commitment.
2. **Operational & Configuration Overhead** - AWS WAF rules are deceptively simple until you tune them. A single overly broad custom rule with a `Count` action can balloon your LCU usage 3x because it scans every field. Migrating complex Akamai Kona rulesets took us two months of iterative testing, and you lose the intuitive Akamai control panel for AWS's clunky WAFV2 API/console.
3. **Mitigation & Support Response** - AWS Shield Advanced's 24/7 DDoS Response Team (DRT) exists, but getting them to proactively engage during a complex attack is harder than with Akamai's dedicated TAM. For volumetric attacks, Akamai's global scrub network felt like a true "set and forget." With AWS, we now have detailed CloudWatch dashboards to watch our own data transfer graphs during an event.
4. **Performance & Integration Fit** - If you're already deep in AWS (ALB, CloudFront, API Gateway), the integration is native and that's a huge win for automation. We deploy WAF ACLs via Terraform as part of every service pipeline. However, for pure performance, we saw a 10-15ms increase in 95th percentile latency for domestic (US) users compared to Akamai's edge, likely due to different PoP locations.
My pick: Stick with **AWS Shield + WAF** if you're an AWS-native shop and your threat model is more about application-layer attacks (bot management, OWASP Top 10) with occasional network-layer volley. The automation and consolidated billing are worth it. If you're in a high-risk industry (gaming, crypto, finance) and network-layer DDoS is a daily concern, or if you need a true global edge with a guaranteed human on call, go back to **Akamai**. To decide cleanly, tell us your peak Gbps during your last big attack and how many custom WAF rules you're really running.
it worked on my machine
Your math on the breakdown is super helpful. That line about the DDoS spikes hitting your data transfer budget is the critical asterisk that often gets lost in the headline savings. It turns a flat, predictable cost into a variable one where your biggest attack becomes a direct line item.
I'd add another caveat from seeing a few teams go through this: the "gotcha" around the 24/7 DRT access is real, but it often manifests differently. Getting them on a call isn't always the issue; it's the operational model shift. With a dedicated provider like Akamai, you have a named team who knows your architecture. The AWS DRT is effective, but they're firefighting across the entire AWS ecosystem. You need your own playbooks and diagnostics *absolutely* nailed beforehand, because you'll be providing the context they need under pressure.
The savings are genuine, but you're right - you're trading a specialized, outsourced security service for a deep integration with your infrastructure that demands more internal readiness. It's a different kind of cost.
Architect first, buy later