Everyone defaults to Cloudflare. It's the default answer. But AWS WAF is right there if you're already on AWS.
Mid-market e-commerce, so you're dealing with payment skimming attempts, cart abuse, and the occasional volumetric junk. Need solid OWASP coverage without murdering your conversion rate.
Used both. Here's the real talk:
* Cloudflare: Managed rulesets are smarter, easier to tune. The reputation database is vast. But you're paying for the whole suite. If you just need a WAF, feels like overkill.
* AWS WAF: Deeply integrated if your stack is already in AWS (ALB, CloudFront, API Gateway). Can be cheaper at scale. But the managed rules feel dumber, and the interface is a crime against humanity. More work to get the same result.
Is the Cloudflare "magic" worth the premium over the AWS grind? Or is it just brand hype?
CRM is a means, not an end.
I'm a lead infra architect for a ~400-person online retailer running a monolithic Rails app on AWS, migrating from Cloudflare to AWS WAF for our main storefront to claw back some cost and complexity.
1. **Real pricing and the hidden tax**
Cloudflare's WAF isn't sold standalone; you're buying into Pro ($20/mo) or Business ($200/mo) plans per zone. For a mid-market site with a few domains, you're looking at a few hundred to a thousand bucks monthly before any add-ons. AWS WAF charges per rule group ($5 per managed rule set per month), per web ACL ($5 per month), and per million requests ($0.60). At our scale (~50M requests/month), AWS costs about $120 monthly. Cloudflare was over $800. The hidden tax with Cloudflare is the entire suite you'll never use; with AWS, it's the engineering hours to make it work.
2. **Deployment and integration grind**
If your traffic hits an ALB, CloudFront, or API Gateway first, AWS WAF attaches in two clicks. The real effort is in tuning. Cloudflare's managed rules have sensible defaults and one-click modes like "Security - High." AWS's managed rule groups from AWS Marketplace (like the OWASP 10 set) are notoriously noisy. Expect to spend a week building a manual allow-list for your legitimate traffic patterns, otherwise you'll block your own checkout. Cloudflare's dashboard gives you a unified view; AWS scatters logs across WAF, ALB access logs, and CloudWatch.
3. **Where each one clearly wins**
Cloudflare wins on immediate, intelligent protection out-of-the-box. Its reputation database and behavioral analysis catch low-and-slow payment skimming attempts that AWS's static rule sets will miss unless you write custom rate-based rules. AWS wins on raw integration and cost control inside the AWS bubble. You can write WAF rules in Terraform, deploy via CodePipeline, and inspect blocked requests directly in Athena. For volumetric DDoS, Cloudflare's network absorbs it; with AWS, you're scaling (and paying for) Shield Advanced.
4. **The support and operational reality**
Cloudflare support on Pro plans is community and tickets; Business gets you a human. They're fast for outages, slow for config reviews. AWS support is pay-walled; basic support won't help you tune a WAF. You're on your own or paying for Enterprise support. Operationally, Cloudflare's cache complicates debugging - you might see a block but not the origin request. AWS gives you full request/response inspection, but you'll need to build the tooling yourself.
I'd pick AWS WAF if your entire stack is already on AWS and you have at least one engineer who can dedicate two weeks to tuning and monitoring it. If your team is leaner or payment fraud is your primary threat, Cloudflare's intelligence is worth the premium. To make the call clean, tell us your monthly request volume and whether you have a dedicated security person.
monoliths are not evil