Network security & firewalls
AWS WAF vs Azure Web Application Firewall
AWS WAF maps to Azure Web Application Firewall, which runs on Application Gateway (regional) or Front Door (global).
Side-by-side comparison
| Aspect | Amazon Web Services | Microsoft Azure |
|---|---|---|
| Service | AWS WAF | Azure Web Application Firewall |
| Lifecycle | AWS WAF Classic is going through a planned end-of-life process, with Region-specific dates in the AWS Health Dashboard. Migrate to the current AWS WAF. | Generally available |
| What it is | Web application firewall for CloudFront, ALB, API Gateway, AppSync, Cognito, App Runner, and Verified Access, with managed rule groups, rate limiting, bot control, and fraud control. | WAF policies with managed rule sets (OWASP-based default rules), custom rules, rate limiting, and bot protection, deployed on Application Gateway (regional) or Front Door (global). |
| Pricing model | Per web ACL and rule per month plus per million requests, and extra for Bot Control and Fraud Control. | On Application Gateway, the WAF_v2 tier's hourly and capacity unit pricing. On Front Door, Premium includes managed rules, and Standard supports custom rules only. |
| Docs | AWS WAF docs | Azure Web Application Firewall docs |
| Pricing page | AWS WAF pricing | Azure Web Application Firewall pricing |
| Exams | SCS-C03 SAA-C03 | AZ-700 SC-500 |
Key differences
- Attachment. AWS WAF web ACLs attach to CloudFront, ALB, API Gateway, AppSync, Cognito, App Runner, and Verified Access. Azure WAF policies attach to Application Gateway, Front Door, or Application Gateway for Containers.
- Rule sets. AWS offers managed rule groups (including paid Bot Control and Fraud Control) and marketplace rules. Azure offers Microsoft's default rule set (OWASP-based), bot manager rules, custom rules, and rate limiting.
- AWS WAF Classic is going through a planned end-of-life process, so migrate any Classic web ACLs.
Pricing summary
Pricing models only. No prices are quoted because they change by region and over time.
- AWS
- Per web ACL and rule per month plus per million requests, and extra for Bot Control and Fraud Control. AWS WAF pricing →
- Azure
- On Application Gateway, the WAF_v2 tier's hourly and capacity unit pricing. On Front Door, Premium includes managed rules, and Standard supports custom rules only. Azure Web Application Firewall pricing →
Certification exam mapping
| Exam | Provider | Level | Status |
|---|---|---|---|
| AWS Certified Security – Specialty SCS-C03 | AWS | Specialty | current The current code (SCS-C03) is taken from the exam-prep link on the official certification page. Simplified Chinese, Spanish (Latin America), and Portuguese (Brazil) versions retire after Dec 31, 2026. |
| AWS Certified Solutions Architect – Associate SAA-C03 | AWS | Associate | current Italian version retires after Dec 31, 2026. |
| Microsoft Certified – Azure Network Engineer Associate AZ-700 | Azure | Associate | current |
| Microsoft Certified – Cloud and AI Security Engineer Associate SC-500 | Azure | Associate | current New certification. A practice assessment isn't available yet, which the page says usually means the exam recently left (or is in) beta. |
Relevance is based on each exam's published scope, not a line-by-line objective match. Check the official study guide.
FAQ
What is the Azure equivalent of AWS WAF?
AWS WAF maps to Azure Web Application Firewall, which runs on Application Gateway (regional) or Front Door (global).
How does pricing compare between AWS WAF and Azure Web Application Firewall?
AWS: Per web ACL and rule per month plus per million requests, and extra for Bot Control and Fraud Control. Azure: On Application Gateway, the WAF_v2 tier's hourly and capacity unit pricing. On Front Door, Premium includes managed rules, and Standard supports custom rules only. Check the official pricing pages for current rates.
Which certification exams cover this topic?
AWS Certified Security – Specialty (SCS-C03); AWS Certified Solutions Architect – Associate (SAA-C03); Microsoft Certified – Azure Network Engineer Associate (AZ-700); Microsoft Certified – Cloud and AI Security Engineer Associate (SC-500).