# AWS WAF Web ACL

> AWS WAF stacks three meters on every web ACL: a monthly fee per ACL, a monthly fee per rule inside it, and a charge per million requests inspected. ACLs detached from any resource keep paying the first two. ZopNight discovers ACLs on the 6-hour cycle and flags unattached ones.

Source: https://zop.dev/integrations/aws/waf
Updated: 2026-08-19

---

An AWS WAF web ACL filters web traffic for CloudFront, ALB, and API Gateway, billed per web ACL per month, per rule, and per million requests. Web ACLs detached from any resource keep billing their monthly fees.

## Three stacked charges per ACL

WAF pricing compounds: the web ACL itself bills monthly, every rule and rule group inside it bills monthly on top, and request inspection bills per million requests processed. Managed rule groups from AWS or Marketplace vendors add their own subscription fees. The structural point is that two of the three meters, the ACL and the rules, are traffic-independent. A web ACL with a dozen rules protecting nothing bills its full monthly configuration cost; only the request meter goes quiet when the traffic does.

## Attachment checks ZopNight performs

A dedicated provider discovers web ACLs on the 6-hour cycle, with per-ACL cost from Cost Explorer or CUR 2.0. The primary recommendation is the unattached ACL: one associated with no CloudFront distribution, load balancer, or API stage is pure fixed cost with zero protective effect, usually left over from a decommissioned frontend. Rule-heavy ACLs on low-value surfaces get surfaced through the cost attribution itself. When a staging API's WAF configuration costs more than the staging API, the number makes the argument.

## Configuration waste in the rule layer

Beyond full orphans, waste hides inside live ACLs. Duplicate managed rule groups (Core rule set plus a vendor bundle covering the same OWASP categories) double the monthly rule spend for overlapping coverage. Per-environment ACL copies multiply configuration fees across dev, staging, and prod when dev traffic needs none of it. And rules added during a specific attack (an IP block list from an incident in 2023, say) linger indefinitely, billing monthly for a threat that ended.

## Reviewing web ACLs and associations

The WAF console lists web ACLs per scope, regional and CloudFront, with their associated resources and rule inventory. Unassociated ACLs are visible at a glance and safe to delete once confirmed unreferenced by automation. For live ACLs, the sampled-requests view shows which rules actually match anything, which is the evidence for pruning.