Hey everyone. So I've been running a small web app on AWS for about a year. I was using AWS Shield Advanced because I was worried about DDoS, but the cost was getting... intense for my scale. My lead suggested looking at Imperva.
I switched our main application load balancer over to Imperva last month. The setup was mostly in the dashboard, but I had to update my Terraform to remove the WAF rules tied to AWS and change the DNS. Here's the basic change I made for the ALB listener rule:
```hcl
# Before: Using AWS WAF
resource "aws_wafv2_web_acl_association" "main" {
resource_arn = aws_lb.main.arn
web_acl_arn = aws_wafv2_web_acl.main.arn
}
# After: Just the plain LB, DNS record points to Imperva
resource "aws_route53_record" "app" {
name = "app.my-domain.com"
type = "CNAME"
ttl = 60
records = [imperva_provided_cname_value]
}
```
The hard numbers after 30 days:
* Our monthly bill for DDoS/WAF dropped by about 65%. Shield Advanced + WAF rules was costing us ~$1,200/month. Imperva is ~$420.
* Latency added is slightly higher (goes from ~35ms to ~50ms regionally), but it's consistent now. With AWS, we saw weird spikes during what they called "mitigation events."
* The dashboard actually shows me blocked attempts, which feels more transparent. I can see top attack sources and types.
I'm still a newbie at this, so maybe I wasn't using AWS Shield optimally? But for my use case (a single app, ~10k daily users), Imperva seems to do the job well for less money. Curious if others have had a similar experience.
Hey OP, nice post and I appreciate you sharing those numbers. I'm a senior marketing tech lead at a mid-sized SaaS company in the fintech adjacent space. We handle a ton of customer data, so I manage our marketing automation stack, the CRM integrations, and the security posture for our public-facing lead gen and app login pages, which means I've been in the trenches with both AWS WAF/Shield and Imperva's cloud WAF.
Here's my breakdown based on running both in production at different times:
1. **Target Audience Fit:** AWS Shield Advanced is built for shops already deep in AWS ecosystem, especially those needing the tight integration with Route 53, CloudFront, and direct support contact. Imperva's sweet spot is the mid-market company that needs stronger, more granular bot mitigation and compliance reporting out of the box without needing a dedicated AWS security architect.
2. **Real Pricing & Hidden Costs:** Your 65% savings aligns with what I've seen. AWS's model has a high baseline for Shield Advanced ($3,000 per month per organization plus $1,395 per month per resource protected, plus data transfer out during attacks). Imperva's standard cloud WAF bundle runs us about $500/month flat for up to 2 domains and includes their bot mitigation and a set of core rules. The hidden cost with Imperva is in advanced features like their client-side fingerprinting, which is an add-on. The hidden cost with AWS is the data processing and WAF rule capacity units that can balloon if you don't tune meticulously.
3. **Deployment & Integration Effort:** Switching DNS and decoupling from Terraform is the bulk of it, exactly as you did. The bigger effort with Imperva is the initial learning curve on their policy chain interface, which is powerful but different. With AWS, integration is easier if you're already in their console, but building effective, non-disruptive custom rules required me to run them in "count" mode for weeks to avoid false positives.
4. **Where It Breaks / The Limitation:** For AWS, the breaking point for us was during sophisticated bot attacks that weren't big enough to trigger full DDoS mitigation but would scrape our content. Shield Advanced alone didn't stop it without complex, manual WAF rule writing. For Imperva, the limitation is in the latency you noted and vendor lock-in for your DNS. If Imperva has an incident, your traffic is going through them, period. With AWS, you have more levers to pull internally.
I'd recommend Imperva for your use case, assuming you're a smaller team that needs effective security without constant tuning and your app can tolerate that slight, consistent latency increase. If you were running financial transactions where every millisecond counted or if your entire infra was already automated within AWS CloudFormation/Terraform, I'd lean towards staying and eating the cost. Tell us how sensitive your app is to that 15ms latency bump and whether you deal more with volumetric attacks or sneaky credential stuffing bots.
Happy testing!
Your 65% savings track with what I've seen for SMB workloads. That ~$800/month delta is significant.
One caveat on your "consistent" latency observation: measure it again during a traffic surge, even a self-induced one. Imperva's routing can behave differently under load versus AWS's direct integration. I've seen a 50ms baseline jump to 90ms during a marketing launch, whereas Shield's performance was more linear with AWS's own network.
Did you factor in the cost of the ALB data processing after switching off WAFv2? With the ACL disassociated, your ALB is now ingesting all raw traffic, which could slightly increase your ALB LCU cost. Might be a rounding error compared to the savings, but worth a glance.
Right-size or die