AWS WAF

AWS WAF is Amazon Web Services' managed web application firewall. It inspects HTTP and HTTPS requests that reach an application and applies rules that allow, block, count or challenge them before they hit your origin. It attaches to Amazon CloudFront distributions and to other AWS front doors such as Application Load Balancer, Amazon API Gateway, AWS AppSync and Amazon Cognito.

Teams use AWS WAF to filter common web exploits, rate-limit abusive clients, restrict traffic by IP address, geography or request content, and manage bots. Rules are grouped into a protection pack (web ACL), and AWS offers managed rule groups so teams do not have to write every rule themselves. The Bot Control managed rule group classifies automated traffic and has Common and Targeted levels.

For builders shipping APIs and content that AI agents now call, the most relevant recent feature is AI traffic monetization, a Bot Control capability announced on June 15, 2026. A rule with the Monetize action returns an HTTP 402 Payment Required response with a machine-readable x402 price manifest. An agent that pays gets the content in the same request cycle. Payments can settle in USDC on Base or Solana to a wallet the publisher controls, and since November 5, 2026 they can also settle to a Stripe balance through a connected account. The capability requires a web ACL with CloudFront scope.

Pricing is usage-based rather than flat. AWS charges for each web ACL, for each rule inside it, and for the number of web requests the ACL processes, with regional variation. Bot Control and other managed rule groups carry their own fees, and AWS WAF charges are in addition to the pricing of the service it protects. According to AWS, AI traffic monetization itself is available at no additional charge beyond standard AWS WAF pricing. Always confirm current numbers on the official pricing page.

Alternatives include Cloudflare's WAF and Bot Management, with its own pay-per-crawl and Monetization Gateway features, and other edge security services from CDN vendors. AWS WAF is the natural choice when your application already sits behind CloudFront and you manage infrastructure in AWS. Official documentation lives in the AWS WAF Developer Guide.