Shield Advanced covering your WAF costs is true, with four boundaries: only protected resources, only standard features, and subject to a request ceiling. Bot Control, CAPTCHA and web ACLs above 1,500 WCUs are still billed separately.
One line from the documentation circulates widely: "if you use AWS Shield Advanced, you do not have to pay separately for AWS WAF."
That is true - with boundaries. Security costs are easy to misjudge precisely because rules that "look like savings" always come with conditions. This page sets out the four boundaries.
Security baseline configuration has its own page (architecture-facing); this one covers money only: what is covered and what is still billed.
First: Shield has two tiers, and one is always free
| Shield Standard | Shield Advanced | |
|---|---|---|
| Cost | Free | Monthly fee plus a data-transfer usage fee |
| How to enable | Automatic, nothing to configure | Requires a subscription (one-year commitment) |
| Coverage | Common network and transport layer DDoS | Stronger protection + application layer + response team |
The first row is worth remembering on its own: Shield Standard is automatically enabled and free for all customers - you pay nothing for it and configure nothing. So "should we have DDoS protection" already defaults to yes; Shield Advanced is a different, more expensive and heavier thing.
Which WAF costs Shield Advanced covers
Per the documentation, once you subscribe to Shield Advanced, standard WAF costs for the resources you protect are covered. The covered parts are specific:
- The cost per protection pack (web ACL).
- The cost per rule.
- The base price per million requests for inspection.
The coverage carries two quantitative ceilings:
- Up to 1,500 WCUs (web ACL capacity units).
- The default body size for request body inspection.
There is also a request ceiling: the subscription includes up to 50 billion requests per month to protected WAF resources; usage beyond that is billed per the pricing page.
One detail worth noting: requests that Shield Advanced identifies as DDoS do not count towards that 50 billion. The design makes sense - being attacked should not cost you extra, otherwise protection becomes a penalty.
Four boundaries it does not cover
These four qualify the "no separate WAF charge" claim, and they are where cost misjudgements come from:
- Only resources protected by Shield Advanced. WAF usage for other resources in the same account is still billed. The subscription is not "WAF is free account-wide" - it is "WAF is free for the resources you named".
- Only standard features. Bot Control and the CAPTCHA rule action and similar are non-standard and still billed separately.
- Web ACLs above 1,500 WCUs are not covered. The documentation lists this explicitly as a non-standard cost.
- Inspecting request bodies beyond the default body size is not covered. Larger body inspection is an additional charge.
⛔ Put the four together and a more accurate conclusion emerges: "Shield Advanced makes WAF free" holds conditionally - free for protected resources, standard features, within limits. So if you already use Bot Control or need large body inspection, that spend does not disappear when you subscribe. The full list is on the official WAF pricing page.
An easy trap: automatic mitigation consumes your WCU budget
Combining two documented facts produces a non-obvious consequence:
- Fact one: enabling Shield Advanced automatic application layer DDoS mitigation adds a rule group to your protection pack that uses 150 WCUs.
- Fact two: web ACLs above 1,500 WCUs fall outside the free coverage.
⛔ The inference: if your web ACL is already near 1,500 WCUs, enabling automatic mitigation may push it over the threshold - so some of what was covered starts being billed. In other words, this "automatic protection" feature can itself create extra cost, depending how much WCU headroom you have. Check your current WCU figure before enabling.
This is a classic case of two correct facts combining into a non-intuitive conclusion - looking at either one alone reveals nothing, which is why it deserves calling out.
What Shield Advanced itself costs
The subscription has three components, and understanding them explains why it only suits particular situations:
| Component | Notes |
|---|---|
| Monthly fee | Billed per organization (the FAQ indicates a figure in the low thousands of USD per month) |
| Data transfer usage fee | Billed on data transferred out from protected resources (CloudFront / load balancing / EC2 / Global Accelerator) |
| Commitment | A one-year subscription commitment, and it auto-renews |
On renewal, the documentation gives a clear window: AWS notifies you at least 30 days ahead, and you can cancel the upcoming renewal by contacting AWS between 30 and 5 days before the renewal date.
Two details relevant to multi-account and channel structures: (1) under consolidated billing, multiple accounts pay the monthly fee only once - provided the payer account owns those accounts and their resources; (2) but AWS Channel Resellers pay a separate monthly fee for each member account. The same subscription costs differently under the two structures.
When it is actually worth it
Given that cost structure, the logic is straightforward - it is insurance for important assets, not a general cost-saving tool:
- Worth considering: you run public-facing critical workloads where downtime or an attack costs far more than the subscription, or your business sits in a sector or stage prone to DDoS.
- Probably not worth it: internal systems, non-critical workloads, or very low traffic (nowhere near the request ceiling). There, Shield Standard plus standard WAF rules enabled as needed is usually enough, at far lower cost.
- Do the arithmetic first: factor in your current WAF spend and how automatic mitigation would change your WCU usage - see what the subscription saves and what it adds, rather than only noticing "WAF is free now".
There is also a dependency people miss: to reach the DDoS Response Team (DRT) for manual mitigation, you need Enterprise or Business support. So if you are buying Shield Advanced precisely for "someone helps me when it happens", the support plan is part of this cost - evaluate them together, see how to choose an AWS support plan.
FAQ
Does Shield Standard cost anything?
No, and it needs no enabling. Shield Standard is free for all customers and automatically configured for your applications, protecting against common network and transport layer DDoS. So the baseline layer is already with you.
With Shield Advanced, is all WAF spend in the account free?
No. Coverage applies to standard WAF features for the resources you protect with Shield Advanced. WAF usage for unprotected resources is still billed, and non-standard features (Bot Control, CAPTCHA) remain separately charged.
Does a DDoS attack create extra charges?
Requests Shield Advanced identifies as DDoS do not count towards the 50 billion monthly allowance - attack traffic itself does not consume it. The documentation also provides DDoS cost protection: scaling charges incurred on protected resources during an attack can be credited (subject to the one-year commitment).
I buy AWS through a channel - how is the Shield Advanced monthly fee billed?
There is a structural difference: the pricing page states that AWS Channel Resellers pay a separate monthly fee for each member account, whereas under an ordinary consolidated billing multi-account structure it is paid once (provided the payer account owns the accounts and resources). So your account structure directly changes this cost - the official pricing page and your channel terms are authoritative.
Can discounts cover security service costs?
It depends which kind. Cross-service overall discounts (the private pricing type) have broad coverage and may include security services; compute-only commitment discounts do not touch it. The difference between those layers is in AWS private pricing, and the full layering in AWS discounts, the complete picture. A channel discount lowers what you actually pay - a different layer from official discounts, and stackable: see AWS discounts and reseller pricing, and the cross-provider comparison in cloud discount mechanisms compared.