Cloud WAF Capacity Calculator

WCU consumed = managed rule groups × WCU per group + custom rules × WCU per rule, measured against the 1500 WCU per web ACL budget. Every WAF rule has a published capacity cost, and a web ACL that exceeds 1500 WCUs simply refuses to deploy. Managed rule groups are the expensive part — the core rule set alone is 700 WCUs — so this calculator separates managed from custom capacity and reports how many more custom rules the remaining budget will hold.

Discovering the WCU ceiling during an active exploitation event, when you are trying to push one virtual-patch rule and the deployment fails, is a genuinely bad afternoon.

This calculator takes 10 inputs: Web ACLs deployed, AWS managed rule groups per web ACL, Average WCU per managed rule group, Custom rules per web ACL, Average WCU per custom rule, WCU capacity per web ACL, Requests inspected per month, Web ACL price, Rule price, Price per million requests. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Managed rule groups and anything that inspects the request body. The AWS core rule set is 700 WCUs, the known-bad-inputs set is 200, and a regex pattern set over the body can be 50 or more on its own. Rate-based rules are cheap at 2 WCUs, which makes them the best value control in the product.

Several, split by attachment point. A CloudFront-scope ACL and a regional ALB ACL each get their own 1500 WCU budget, so you get more capacity and a smaller blast radius per change — at the cost of an extra $5 per month and one more thing to keep in sync.