Compare products
Put two or three cybersecurity products side by side and see how they differ on deployment, pricing, features, integrations and compliance.
| Product | AWS WAF by AWS View product | Cloudflare WAF by Cloudflare View product |
|---|---|---|
| Overview | ||
| What it is | AWS WAF is a cloud web application firewall service from AWS. Learn how it supports web application layer 7 defense, what features stand out and which WAF tools compete. | See what Cloudflare WAF offers: edge rate limiting. It is built for OWASP Top 10 vulnerability mitigation, supports cloud deployment and competes with other WAF tools. |
| Product type | Cloud Web Application Firewall Service | Cloud-Native Web Application Firewall (WAF) |
| Best for | Cross-industry, E-commerce, Financial Services, Healthcare, Technology, Public Sector | E-commerce, Banking, Healthcare, Government, Technology, Cross-industry, Financial Services |
| Pricing | ||
| Pricing model | Contact Vendor | Contact Vendor |
| Free trial | Free trial: no | Free trial: yes |
| Deployment | ||
| Deployment options | Cloud | Cloud |
| Deployment details | Cloud; AWS Cloud-native managed edge and regional service | Cloud Edge Anycast Network; Cloud Edge Anycast Platform |
| Data residency | Regional or global CloudFront edge deployment depending on resource type | Global Anycast edge (330+ cities worldwide) |
| Key features | ||
| What it offers |
|
|
| Platform & access | ||
| API access | API access: yes | API access: yes |
| Single sign-on (SSO) | SSO: yes | SSO: yes |
| Role-based access (RBAC) | RBAC: yes | RBAC: yes |
| Multi-tenant | Multi-tenant: yes | Multi-tenant: yes |
| Mobile app | Mobile app: yes | Mobile app: no |
| Supported platforms | Amazon CloudFrontApplication Load BalancersAmazon API GatewayAWS AppSyncAWS Verified Access | Web ApplicationsREST APIsE-commerce PlatformsContent Management Systems |
| Compliance | SOC 1/2/3, ISO 27001, ISO 27017, ISO 27018, PCI DSS, HIPAA eligible, FedRAMP High | PCI-DSS 4.0SOC 2 Type IIISO/IEC 27001HIPAAGDPR |
| Integrations & coverage | ||
| Integrations | Amazon CloudFrontApplication Load BalancerAmazon API GatewayAWS AppSyncAmazon CognitoAWS Firewall ManagerAmazon CloudWatch | Cloudflare Bot ManagementAPI ShieldSplunkDatadogTerraformAWSAzure |
| Industries | Cross-industryE-commerceFinancial ServicesHealthcareTechnologyPublic Sector | E-commerceBankingHealthcareGovernmentTechnologyCross-industry+1 more |
| Regions | Global (all AWS Regions and CloudFront edge locations) | Global (330+ cities) |
| Vendor | ||
| Company | AWS | Cloudflare |
| Headquarters | Seattle, Washington, USA | San Francisco, California, USA |
| Company size | 100,000+ | 5,000+ |
| Founded | 2006 | 2010 |
Overview
What it is
AWS WAF
AWS WAF is a cloud web application firewall service from AWS. Learn how it supports web application layer 7 defense, what features stand out and which WAF tools compete.Cloudflare WAF
See what Cloudflare WAF offers: edge rate limiting. It is built for OWASP Top 10 vulnerability mitigation, supports cloud deployment and competes with other WAF tools.Product type
AWS WAF
Cloud Web Application Firewall ServiceCloudflare WAF
Cloud-Native Web Application Firewall (WAF)Best for
AWS WAF
Cross-industry, E-commerce, Financial Services, Healthcare, Technology, Public SectorCloudflare WAF
E-commerce, Banking, Healthcare, Government, Technology, Cross-industry, Financial ServicesPricing
Pricing model
AWS WAF
Contact VendorCloudflare WAF
Contact VendorFree trial
AWS WAF
Free trial: noCloudflare WAF
Free trial: yesDeployment
Deployment options
AWS WAF
Cloud
Cloudflare WAF
Cloud
Deployment details
AWS WAF
Cloud; AWS Cloud-native managed edge and regional serviceCloudflare WAF
Cloud Edge Anycast Network; Cloud Edge Anycast PlatformData residency
AWS WAF
Regional or global CloudFront edge deployment depending on resource typeCloudflare WAF
Global Anycast edge (330+ cities worldwide)Key features
What it offers
AWS WAF
- OWASP Top 10 protection
- AWS Managed Rules
- Bot Control and account fraud prevention
- Custom rate limiting and IP rules
- Real-time web traffic inspection
- CAPTCHA and silent challenge actions
- CloudWatch metrics and full logging
- Web application layer 7 defense
Cloudflare WAF
- Cloud-native edge WAF
- OWASP Top 10 mitigation
- Cloudflare Managed Rulesets
- Custom Wirefilter rules
- ML zero-day detection
- Edge rate limiting
- Real-time logs
- OWASP Top 10 vulnerability mitigation
Platform & access
API access
AWS WAF
API access: yesCloudflare WAF
API access: yesSingle sign-on (SSO)
AWS WAF
SSO: yesCloudflare WAF
SSO: yesRole-based access (RBAC)
AWS WAF
RBAC: yesCloudflare WAF
RBAC: yesMulti-tenant
AWS WAF
Multi-tenant: yesCloudflare WAF
Multi-tenant: yesMobile app
AWS WAF
Mobile app: yesCloudflare WAF
Mobile app: noSupported platforms
AWS WAF
Amazon CloudFrontApplication Load BalancersAmazon API GatewayAWS AppSyncAWS Verified Access
Cloudflare WAF
Web ApplicationsREST APIsE-commerce PlatformsContent Management Systems
Compliance
AWS WAF
SOC 1/2/3, ISO 27001, ISO 27017, ISO 27018, PCI DSS, HIPAA eligible, FedRAMP High
Cloudflare WAF
PCI-DSS 4.0SOC 2 Type IIISO/IEC 27001HIPAAGDPR
Integrations & coverage
Integrations
AWS WAF
Amazon CloudFrontApplication Load BalancerAmazon API GatewayAWS AppSyncAmazon CognitoAWS Firewall ManagerAmazon CloudWatch
Cloudflare WAF
Cloudflare Bot ManagementAPI ShieldSplunkDatadogTerraformAWSAzure
Industries
AWS WAF
Cross-industryE-commerceFinancial ServicesHealthcareTechnologyPublic Sector
Cloudflare WAF
E-commerceBankingHealthcareGovernmentTechnologyCross-industry+1 more
Regions
AWS WAF
Global (all AWS Regions and CloudFront edge locations)
Cloudflare WAF
Global (330+ cities)
Vendor
Company
AWS WAF
AWSCloudflare WAF
CloudflareHeadquarters
AWS WAF
Seattle, Washington, USACloudflare WAF
San Francisco, California, USACompany size
AWS WAF
100,000+Cloudflare WAF
5,000+Founded
AWS WAF
2006Cloudflare WAF
2010