Web Application Firewall (WAF) 3.0 supports the pay-as-you-go billing method. This method uses security capacity units (SeCUs) to calculate bills based on actual resource usage. This topic describes the pay-as-you-go billing method of WAF 3.0.

Overview

SeCU has the following attributes:
  • The unit price of a SeCU is USD 0.01.
  • The SeCU usage is measured every hour. For example, the SeCU usage is measured from 10:00:00 to 10:59:59.
  • The SeCU usage is rounded up to the nearest integer. For example, if only 0.5 SeCUs are used during the period from 10:00:00 to 10:59:59, you are still charged 1 SeCU during the period.
SeCU resource plans have the following attributes:
  • The subscription billing method is used.
  • Each SeCU resource plan has a validity period.
  • After the SeCU resource plan is exhausted or expires, your account balance is used to pay the bill.
  • The balance of your account can be used to pay the bill only if your account has sufficient balance.

Billable items

The fees of a pay-as-you-go WAF 3.0 instance include request processing fees and feature fees. The following table describes the fees in detail:

Fee Description
Request processing fee Basic request fee

Within each billing period of one hour, you are charged 1 SeCU for every 5,000 requests. These requests include both normal requests and attack requests, but not server responses.

Note
  • During the public preview period, you are only charged 1 SeCU for every 7,500 requests.
  • If the number of requests that are processed in an hour is zero, the request processing fee is 0 SeCU.
  • The SeCU usage is calculated based on the number of requests rounded up to the nearest multiple of 5,000. For example, if 13,425 requests are processed in an hour, the request processing fee is 3 SeCUs.

The basic request fee includes the fees for the basic protection rule feature and the whitelist feature.The fees for the two features are not included in the feature fee.

Bot management fee

You are charged the bot management fees only for requests that match protection rules.

You are charged 1 SeCU for every 10,000 requests that are matched and processed by WAF in an hour.

Note The SeCU usage is calculated based on the number of requests rounded up to the nearest multiple of 10,000. For example, if 13,425 requests are matched and processed in an hour, the request processing fee is 2 SeCUs.
Feature fee You are charged based on the actual usage of features. For example, you are charged for enabling a feature and for the number of rules that you configure for a feature. For more information, see Feature fees.
Table 1. Feature fees
Feature Billable item SeCU usage per hour
Basic protection rule N/A 0 SeCU
Whitelist N/A 0 SeCU
IP address blacklist Number of rules that are configured in the IP address blacklist

(The rules include enabled and disabled rules.)

2 SeCUs per rule
Custom rule Number of basic rules that are configured

(The rules include enabled and disabled rules.)

1 SeCU per rule
Number of advanced rules that are configured

(The rules include enabled and disabled rules.)

Note Custom rules that meet one of the following conditions are advanced rules. All other rules are basic rules.
  • The rule type is Throttling.
  • The following match fields are used: Body and Body Parameter.
  • The following logical operators are used: regular expression match and regular expression mismatch.
2 SeCUs per rule
Scan protection Number of scan protection rules that are configured

(The rules include enabled and disabled rules. Each scan protection template contains three rules.)

1 SeCU per rule
Custom response Number of custom response rules that are configured

(The rules include enabled and disabled rules. Each custom response template contains one rule.)

10 SeCUs per rule
Bot management Number of bot management templates that are configured 50 SeCUs per template
Number of domain names that are added in CNAME record mode Number of domain names that are added in CNAME record mode

(The domain names include second-level domain names and wildcard domain names.)

  • One domain name: 0 SeCU
  • Domain names outside one domain name: 2 SeCUs per domain name
Exclusive IP address Number of domain names for which exclusive IP addresses are enabled (The domain names are added in CNAME record mode.) 15 SeCUs per domain name
IPv6 protection Status of IPv6 protection for domain names that are added in CNAME record mode
  • IPv6 protection is disabled for all domain names: 0 SeCU
  • IPv6 protection is enabled for one or more domain names: 15 SeCUs
Use the intelligent load balancing feature Status of intelligent load balancing for domain names that are added in CNAME record mode
  • Intelligent load balancing is disabled for all domain names: 0 SeCU
  • Intelligent load balancing is enabled for one or more domain names: 15 SeCUs
Log Service for WAF The logging fee for WAF is included in the bill of Log Service. N/A

Billing examples

Example 1

Assume that five domain names are added in CNAME record mode, two rules are created for the IP address blacklist, and no requests are processed in an hour.

The request processing fee for the hour is 0 SeCU. The feature fee is 10 SeCUs, including 8 SeCUs for the domain names added in CNAME record mode and 2 SeCUs for the two rules created for the IP address blacklist. The total fee is USD 0.1, which is calculated based on the following formula: 0.01 × 10.

Example 2

Assume that 12 domain names are added in CNAME record mode, exclusive IP addresses and intelligent load balancing are enabled for two domain names, one scan protection template is created, and 50,001 requests are processed in an hour.

The request processing fee for the hour is 11 SeCUs. The feature fee is 70 SeCUs, including 22 SeCUs for the domain names added in CNAME record mode, 30 SeCUs for the domain names for which exclusive IP addresses are enabled, 15 SeCUs for the domain names for which intelligent load balancing is enabled, and 3 SeCUs for three scan protection rules. The total fee is USD 0.81, which is calculated based on the following formula: 0.01 × 81.