AWS WAF Bot Control cost shows up after the web ACL is already on the bill. Bot Control is a managed rule group with its own subscription and its own request fee, on top of the web ACL, the rule, and the request charges you already pay for AWS WAF. The free allotment hides the add-on until traffic, or a second protection level, steps past it. Finance sees a WAF line that jumped. The person who enabled the rule group often cannot say which requests were inspected.
Rutagon treats that line as a configuration problem with a price, not as a reason to turn protection off. The waste pattern is targeted inspection on every request, a subscription on every web ACL, and no scope-down statement in front of the expensive rules. The WAF and Shield architecture work is where the rule belongs. This article is the meter.
The two meters in AWS WAF Bot Control cost
AWS publishes the split on the WAF pricing page, and the Bot Control behavior itself is in the Bot Control documentation. Common Bot Control includes the first 10 million requests each month at no request fee. Targeted Bot Control includes the first 1 million requests each month at no request fee. Both still have a subscription. The pricing examples put that subscription at $10.00 for one web ACL, and at $10.00 times the number of web ACLs when several are in play. The page states that these security-feature prices are the same across Regions, that the subscription is prorated hourly, and that they sit on top of ordinary AWS WAF charges. Shield Advanced savings on WAF do not apply to this add-on.
The request fee is where the free tier ends. In the common-level example, inspection beyond the 10 million free requests is $1.00 per million. A web ACL seeing 22 million requests is billed $1.00 per million on the 12 million above the allotment, which the example totals at $12.00, plus the $10.00 subscription. In the targeted-level example, three web ACLs and 35 million requests become a $30.00 subscription and $10.00 per million on the requests above the 1 million free allotment. That is a different product with a different slope. Enabling "targeted" because the console offered it, on the full request path, is the bill we get asked to explain.
Ordinary WAF charges do not disappear. The same examples bill the web ACL at $5.00, bill $1.00 for the managed rule group itself as a rule, bill $1.00 for each rule you wrote, and bill web requests at $0.60 per million. Bot Control cost is the add-on. Quoting only the $10.00 subscription understates the line once you are past the free requests, and it ignores the base WAF charges sitting beside it.
level: common or targeted
free_requests: 10 million on common, 1 million on targeted
subscription: $10.00 per web ACL in the pricing examples, prorated hourly
above_free: $1.00 per million on common, $10.00 per million on targeted
scope_down: shrinks inspected requests, does not remove the subscription
Those units are the published examples, not a quote for your account. The slope is the point. Targeted inspection is ten times the per-million add-on of common inspection in those examples, and its free allotment is a tenth as large. A staging web ACL left on targeted protection inspects real traffic at the production slope.
Where the requests come from
Bot Control labels requests. Your own rules can match the labels and decide to count, challenge, or block. The inspection fee is about evaluation by the managed rule group, not about how many requests you eventually block. A count action still inspected the request. Blocking a bot does not refund the inspection.
Scope-down is the control that changes the meter. The pricing example with a scope-down statement sends half of a 20 million request month into Bot Control. Ten million inspected requests sit inside the common free allotment, so the example's request fee is zero. The $10.00 subscription remains. That is the trade. You keep the subscription on the web ACL, and you stop paying the per-million add-on for paths that do not need bot inspection. A health check, a static asset path, and a machine endpoint with its own auth are the usual exclusions. We write the scope-down to match paths you can name, not to "inspect less" in the abstract.
A second web ACL is a second subscription. Teams create one web ACL per environment and attach the same managed rule group to each. Three web ACLs in the targeted example are $30.00 before a single overage request. Dev and staging often do not need the targeted level. They often do not need Bot Control at all if nothing on the internet is hunting them. We list web ACLs in both Regional scope and the CloudFront scope. A CloudFront web ACL is invisible to a Regional listing, and it still carries the subscription.
The managed rule group also counts as a rule on the base WAF bill. Adding Bot Control is not only the Bot Control line. It is the $1.00 rule-group charge in the examples as well. Stacking several managed rule groups multiplies that rule charge and can push web ACL capacity into the extra capacity-unit fee. We read the web ACL capacity before we add another group to "see what happens."
What we change, and what we leave
The diagnostic is a list of web ACLs, the Bot Control level on each, the requests inspected, and whether a scope-down statement exists. Cost Explorer will not tell you the level. The web ACL configuration will. We put the inspected-request count next to the free allotment for that level so the overage is obvious: requests above 10 million for common, requests above 1 million for targeted.
The fixes are boring. Drop targeted inspection where common labels are enough. Put a scope-down in front of the paths that are not user-facing. Remove the managed rule group from web ACLs that protect an internal API with no bot problem. Keep it on the public application that is actually being scraped. API Gateway rate limiting is a different control for abusive clients that you can identify without paying Bot Control to classify them. Use the cheap control on the path that does not need fingerprinting.
We do not turn the rule group off on a login path to save the subscription if that path is where credential stuffing shows up. The $10.00 on one web ACL is not the decision. The targeted per-million fee on every asset request is the decision. Scope the inspection to the paths that justify the slope.
Challenge and CAPTCHA actions have their own prices on the WAF page, separate from Bot Control. A rule that challenges every labeled bot can add that fee on top of inspection. We count challenge responses before we celebrate a block rate. A clever action with an unscoped match is another meter.
AWS cloud infrastructure is where we make the change in the web ACL and in the infrastructure code so the console edit does not return. A scope-down that exists only in the console is gone on the next apply. The statement belongs in the template that owns the web ACL.
Rutagon runs this as a short cost pass: the web ACLs, the level, the scope-down, the overage against the published free allotment, and a fix order. We do not invent a blended rate. The pricing page is the source, and the example arithmetic is the source of the $10.00 subscription and the $1.00 or $10.00 per million add-on. If AWS changes the example, the configuration review still asks the same question: which requests are you inspecting above the free allotment, and why.
Frequently Asked Questions
What is included before AWS WAF Bot Control cost starts on requests?
Common Bot Control includes the first 10 million requests in a month. Targeted Bot Control includes the first 1 million. The pricing examples still show a $10.00 subscription per web ACL even when the request fee is zero. "Free tier" on the pricing page is the request allotment, not a waiver of the subscription.
Why is targeted so much steeper than common?
In the published examples, common inspection above the free allotment is $1.00 per million requests, and targeted inspection above its smaller allotment is $10.00 per million. Targeted protection is the level that tries to detect clients that do not identify themselves. Point it at the paths that need that detection. Pointing it at every request on every web ACL is how the add-on dominates the WAF bill.
Does a scope-down statement remove the subscription?
No. The example that cuts inspected traffic in half still bills the $10.00 subscription. The request fee drops because fewer requests are evaluated, and it can fall to zero if what remains fits inside the free allotment. The subscription stays with the web ACL for as long as the managed rule group is attached.
Are Shield Advanced credits applied to Bot Control?
The pricing page says the Shield Advanced savings on AWS WAF do not apply to the security features in that table, and Bot Control is one of those features. Budget the add-on on its own. Do not net it against a Shield credit you have not read.
Does blocking the bot reduce the fee?
The fee follows inspection by the managed rule group, not the final action. A count, a challenge, or a block can all sit on a request that was already inspected. Shrink the set of requests that reach the rule group if the goal is a smaller request fee. Changing the action from block to count does not, by itself, leave the meter.
Ask for an AWS cost diagnostic that separates Bot Control subscriptions from request overage. Contact Rutagon at rutagon.com/contact, 907-841-8407, or contact@rutagon.com.