| Google Armor | AWS WAF | CloudFlare WAF | |
|---|---|---|---|
| Infrastructure DDOS protection | YES | YES integrated with AWS shield standard | YES |
| Application DDOS protection | YES | YES | YES |
| maximum IP address ranges you can add to an application | unknown | 10,000 | 500 for Free plan 1,000 for Pro 2,000 for Business 10,000 for Enterprise |
| Application rate limiting control The maximum number of requests from a single IP address that are allowed in a period |
NO | YES | YES |
| Application rate limiting period option | - | 5 minutes | 1 minutes or 1 second |
| Directly server protection | NO. Requires load balancer | NO. Requires load balancer or Cloudfront | YES |
| Google Armor | AWS WAF | CloudFlare WAF | |
|---|---|---|---|
| Full featured Infrastructure DDOS protection | $0 | $3,000 /month for advanced shield | $0 |
| Application firewall Policy | $5 /policy/month | $5 /policy/month | $0 |
| Rule | $1 /rule/policy/month | $1 /rule/policy/month | Free for first 3 rules, then $1 per rule |
| HTTP requests | $0.75 /1,000,000 reqs | $1 /1,000,000 reqs traffics blocked by access control or rate limiting will still be counted.(confirmed with AWS support) |
$0 |
| Application Rate limit | - | $1 per /rule/policy/month | Free for first rule, then $1 per rule |
| Application Rate limit requests | - | No additional charge | $0.05 /10,000 passed requests |