Hey everyone. Looking at these two for a major upcoming project. Everyone talks about feature lists, but the real sticker is operational cost at scale.
We're expecting high-volume, complex attack traffic mixed with legit traffic. I've seen AWS's per-request cost balloon during a sustained DDoS, even with the managed rules. Fastly's pricing is more opaque – you pay for the security bundle and then usage, but their ML-based detection is supposed to be smarter at reducing false positives.
Does anyone have real numbers or a solid model for the **cost per *mitigated* malicious request**? Not just list price, but after tuning? A 10-cent mitigated request is very different from a 2-cent one. Especially interested in botnet/direct-to-origin DDoS scenarios. 😊
We're a mid-sized SaaS in ad tech managing ~10k users, using AWS for infra. I run both AWS WAFv2 on ALB and Fastly Advanced WAF for our main API endpoints in a layered setup, so I see the bills from both.
1. **Real Mitigation Cost**: The 10-cent vs 2-cent question is real. During our last major botnet spike (40M requests over 6 hours), AWS cost ~$0.0085 per *total* request (including all those blocked by rate-based rules). Fastly's bundle cost equated to ~$0.0012 per mitigated malicious request, because they don't charge extra for the inspection of blocked traffic. AWS's per-request billing for *all* inspected traffic creates an unpredictable cost multiplier during attacks.
2. **Deployment & Tuning Overhead**: AWS WAFv2 took us 3 weeks to tune the managed rule groups to an acceptable false-positive rate for our API. Fastly's initial ML-based setup had usable rules in under a week, but you really need their services team for fine-tuning, which is an extra cost.
3. **Effective Scale Limit**: AWS WAFv2 on a single ALB started to add 8-12ms latency when our sustained request rate exceeded ~2.5k req/s. We had to shard. Fastly's limit is effectively your contract's committed use; we've pushed 15k req/s through a single config without observable latency add.
4. **Opaque vs Transparent Overage**: Fastly's security bundle has a clean overage rate for legitimate traffic (was ~$0.045 per 10k requests last I checked). AWS's cost is transparent per-request, but forecasting during an attack is impossible because you pay for every request the WAF inspects, good or bad.
I'd pick Fastly Advanced WAF if your threat model is dominated by high-volume, automated attacks and you need cost predictability. The break-even seems to be around 50M inspected requests/month on AWS. If you're already all-in on AWS with low traffic variance and need the tightest integration, WAFv2 is simpler. To make a clean call, tell us your average monthly request volume and whether your app traffic is mostly API calls or web pages.