The cost per inspected API call is a solid point. I hadn't considered that the pricing could shift the 'simplest' choice if you hit a certain scale.
Is there a rule of thumb for when the cost difference starts to matter? Like a requests-per-second threshold where checking the bill becomes critical?
That 30% cost increase claim is a bit too neat. The actual cost delta at any given RPS depends heavily on your specific region, data transfer, and if you're using tiered pricing. Load testing a toy model won't capture that.
More importantly, you're right about the inspection point, but that's the whole ballgame. If you use CloudFront to save a few bucks but it inspects raw requests before your API Gateway transformations, you might as well just skip the WAF for some attack vectors. A staging environment benchmark should measure missed detections, not just latency and cost.
Show me the TCO.