Is AWS WAF's 5,000 WCU limit the same as a 5,000-rule limit?

No, WCU (Web ACL Capacity Units) is a weighted cost, not a rule count, a simple IP-match rule costs far fewer WCU than a rule using regex or a managed rule group, which can cost hundreds of WCU on its own. A web ACL built mostly from AWS Managed Rule groups can hit the 5,000 WCU ceiling with far fewer than 5,000 actual rules, so budget WCU based on the specific rule types you're using, not a flat count.

Which provider's request body inspection limit is actually configurable versus fixed?

Cloud Armor's default is 8KB but is configurable up to 128KB; Azure Application Gateway v2's 128KB figure is closer to its practical ceiling; AWS WAF defaults to 64KB, configurable down to 16KB for specific use cases. None of these are unlimited, if you need to inspect very large JSON bodies for injection, verify the actual configured limit on your specific policy rather than assuming the provider default.

Do all four providers offer a non-blocking test mode before enforcing rules?

Yes, though the terminology differs: AWS WAF calls it Count mode, Azure calls it Detection mode versus Prevention mode, Cloud Armor calls it Preview mode, and OCI calls it Detection mode. All four let you validate a new rule set against real traffic without actually blocking anything, the universal recommended step before flipping any new WAF policy to enforcing.

Multi-Cloud WAF Compare

IAM & SecurityMulti-Cloud

Compare WAF services across AWS WAF, Azure WAF, Google Cloud Armor, and OCI WAF.

Filter Comparison

Category

Showing 20 of 20 features.

Feature	AWS	Azure	GCP	OCI
Service Name Core Features	AWS WAF	Azure Web Application Firewall	Google Cloud Armor	OCI Web Application Firewall
Deployment Points Core Features	CloudFront, ALB, API Gateway, AppSync, Cognito, App Runner, Verified Access	Application Gateway, Front Door, CDN (classic)	Cloud Load Balancing (HTTP/S, TCP/SSL Proxy, CDN)	Load Balancer, Flexible Load Balancer, edge WAF
Pricing Model Core Features	Per web ACL/month + per rule/month + per million requests	Per policy/month + per rule set; Front Door WAF: per million requests	Per policy/month + per rule/month + per million requests	WAF policy free; per million incoming requests processed
Max Rules per Policy Core Features	5,000 WCU (Web ACL Capacity Units) per web ACL	100 custom rules per policy; unlimited managed rules	200 rules per security policy	Configurable rule sets; no published hard limit
Processing Latency Core Features	Sub-millisecond inline inspection at edge/regional	Sub-millisecond inline inspection at Application Gateway/Front Door	Sub-millisecond at Google edge PoPs globally	Low latency inline inspection at load balancer or edge
Managed Rule Sets Rule Management	AWS Managed Rules (Core, SQLi, XSS, Admin, Linux, etc.) + Marketplace rules	OWASP CRS 3.2/3.1/3.0/2.2.9; Microsoft bot manager rules	Pre-configured WAF rules (SQLi, XSS, LFI, RFI, RCE, scanner)	Pre-built protection rules (OWASP, common vulnerabilities)
Custom Rules Rule Management	Match statements on IP, geo, size, regex, SQL injection, XSS, labels	Match conditions on IP, geo, request size, headers, cookies, URI	Custom rules with CEL expression language for flexible matching	Custom protection rules with request inspection conditions
Rate Limiting Rule Management	Rate-based rules per IP or custom key (up to 10K req/5-min window)	Rate limit rules on Front Door WAF per source IP	Rate limiting by IP, header, or path with configurable thresholds	Rate limiting per IP with configurable request thresholds
Geo Blocking Rule Management	Country-level geo match conditions in rule statements	Geo-filtering by country code in custom rules	Region-level geo blocking in security policy rules	Geo blocking with country and region codes
IP Reputation Lists Rule Management	AWS Managed IP Reputation List (Amazon threat intelligence)	Microsoft Threat Intelligence feed integration	Google Threat Intelligence IP deny lists (named IP lists)	Threat intelligence feed for known bad IPs
Bot Management Rule Management	AWS WAF Bot Control (common bots, targeted bots, AI-generated)	Bot protection managed rule set on Front Door	reCAPTCHA Enterprise integration for bot mitigation	CAPTCHA challenge and JavaScript challenge for bots
OWASP Top 10 Protection Capabilities	Core Rule Set covers SQLi, XSS, SSRF, LFI, RFI	Full OWASP CRS coverage with tunable sensitivity	Pre-configured rules for SQLi, XSS, LFI, RFI, RCE	Built-in OWASP protection rules with customization
API Protection Protection Capabilities	API Gateway WAF integration; JSON body inspection for API payloads	WAF on Application Gateway for REST APIs; JSON inspection	Cloud Armor + API Gateway; JSON payload inspection	WAF policy on API Gateway for REST API protection
Request Body Inspection Protection Capabilities	JSON body parsing; up to 64 KB body inspection (configurable to 16 KB)	Up to 128 KB body inspection (Application Gateway v2)	Body inspection up to 8 KB (configurable to 128 KB)	Request body inspection with configurable size limits
Response Inspection Protection Capabilities	No response body inspection; custom response headers and codes	No response body inspection; custom error pages	No response body inspection; custom deny responses	Response code inspection and custom block pages
Logging Operations	Full request logs to S3, CloudWatch Logs, or Kinesis Data Firehose	Diagnostic logs to Log Analytics, Storage, or Event Hub	Cloud Logging with per-request security policy logs	WAF logs to OCI Logging with request detail
Testing / Simulation Operations	Count mode (monitor without blocking) per rule	Detection mode vs Prevention mode per policy	Preview mode for rules before enforcement	Detection mode for monitoring before enforcement
Multi-Account Management Operations	AWS Firewall Manager for centralized WAF policy management	Azure Firewall Manager; Azure Policy for WAF enforcement	Organization-level security policies via hierarchical rules	Compartment-level policies across tenancy
Terraform Support Operations	aws_wafv2_web_acl, aws_wafv2_rule_group, aws_wafv2_ip_set	azurerm_web_application_firewall_policy	google_compute_security_policy, _rule	oci_waf_web_app_firewall, oci_waf_web_app_firewall_policy
Dashboard & Analytics Operations	WAF dashboard in console; CloudWatch metrics and alarms	WAF monitoring workbook; Azure Monitor metrics	Cloud Armor security policy dashboard; SCC integration	WAF metrics in OCI Monitoring; console dashboard

About This Tool

A feature-by-feature comparison of AWS WAF, Azure Web Application Firewall, Google Cloud Armor, and OCI Web Application Firewall across deployment points, rule capacity, request body inspection limits, and pricing model. The limits genuinely differ in ways that affect architecture: AWS WAF caps a web ACL at 5,000 WCU (Web ACL Capacity Units, not a simple rule count) while Cloud Armor caps at 200 rules per policy and Azure at 100 custom rules per policy, and request body inspection defaults differ from 8KB (Cloud Armor, configurable to 128KB) to 128KB (Azure Application Gateway v2), which matters directly for whether a WAF can actually inspect a large JSON API payload for injection attempts.

Real-World Scenario

A platform team migrating a payments API from AWS to a multi-cloud footprint assumes their existing 40-rule AWS WAF web ACL will translate directly into a similarly-sized Cloud Armor policy, only to discover mid-migration that several of their AWS Managed Rules groups don't have a one-to-one Cloud Armor equivalent, and the closest substitutes push their new policy uncomfortably close to Cloud Armor's 200-rule ceiling. They use the comparison table to map each AWS managed rule category to its nearest Cloud Armor pre-configured WAF rule, consolidate several narrow custom rules into fewer broader ones to stay under the limit, and document the two rules that have no clean equivalent as a known gap for the security team to accept or mitigate separately.

When to Use This Tool

•Sizing a migration from AWS WAF to Cloud Armor by checking whether an existing web ACL's WCU-based rule complexity fits inside Cloud Armor's 200-rules-per-policy limit, since WCU and rule count aren't directly convertible one-to-one.
•Confirming request body inspection size before relying on a WAF to catch injection attempts in a large API payload, since the default across providers ranges from 8KB to 128KB and an oversized body may simply pass through uninspected.
•Comparing each provider's bot management offering (AWS WAF Bot Control, Azure's Front Door bot protection, Cloud Armor's reCAPTCHA Enterprise integration, OCI's CAPTCHA/JS challenge) before committing to one as part of a multi-cloud architecture standard.
•Checking Terraform resource names across providers (aws_wafv2_web_acl, azurerm_web_application_firewall_policy, google_compute_security_policy, oci_waf_web_app_firewall) while writing a cross-cloud IaC module that needs provider-specific WAF blocks.

Pro Tips

TIP

AWS WAF's WCU-based pricing model means adding one more AWS Managed Rules group (each can cost hundreds of WCU) can push a web ACL over its 5,000 cap even when the raw custom-rule count looks nowhere near a limit, always check current WCU consumption before adding a new managed rule group, not just custom rule count.

TIP

Cloud Armor's default request body inspection at 8KB is easy to miss when migrating from a provider with a larger default, a JSON payload with an injection attempt buried past the first 8KB of a large request body simply won't be inspected unless you explicitly raise the configured limit.

TIP

None of the four providers inspect response bodies, only requests, a WAF is not a substitute for validating what your own backend returns, especially for reflected-content or data-leakage concerns that only show up in the response.

How It Works Under the Hood

The comparison table is a static, hand-maintained dataset of feature rows tagged by category (Core Features, Rule Management, Protection Capabilities, Operations); the filter and search controls narrow the visible rows by category or free-text match against the feature name or any provider's cell content, there's no live API call to any provider, so treat the figures as a snapshot to verify against current provider docs before a purchasing or architecture decision.

Frequently Asked Questions

Is AWS WAF's 5,000 WCU limit the same as a 5,000-rule limit?: No, WCU (Web ACL Capacity Units) is a weighted cost, not a rule count, a simple IP-match rule costs far fewer WCU than a rule using regex or a managed rule group, which can cost hundreds of WCU on its own. A web ACL built mostly from AWS Managed Rule groups can hit the 5,000 WCU ceiling with far fewer than 5,000 actual rules, so budget WCU based on the specific rule types you're using, not a flat count.
Which provider's request body inspection limit is actually configurable versus fixed?: Cloud Armor's default is 8KB but is configurable up to 128KB; Azure Application Gateway v2's 128KB figure is closer to its practical ceiling; AWS WAF defaults to 64KB, configurable down to 16KB for specific use cases. None of these are unlimited, if you need to inspect very large JSON bodies for injection, verify the actual configured limit on your specific policy rather than assuming the provider default.
Do all four providers offer a non-blocking test mode before enforcing rules?: Yes, though the terminology differs: AWS WAF calls it Count mode, Azure calls it Detection mode versus Prevention mode, Cloud Armor calls it Preview mode, and OCI calls it Detection mode. All four let you validate a new rule set against real traffic without actually blocking anything, the universal recommended step before flipping any new WAF policy to enforcing.

Related Learning Guides

Multi-Cloud IAM Rosetta Stone12 min read
Multi-Cloud Identity Federation Guide15 min read

Was this tool helpful?

Disclaimer: This tool runs entirely in your browser. No data is sent to our servers. Always verify outputs before using them in production. AWS, Azure, and GCP are trademarks of their respective owners.