Sold by: Fortinet Inc.
Deployed on AWS
Fortinet Managed Rules for AWS WAF - API Security provides protection against API based attacks, with rules based on threat intelligence from FortiGuard Labs, Fortinet threat intelligence and research organization.
4.1
Overview
Fortinets WAF rulesets are based on the FortiWeb web application firewall security service signatures. These signatures are updated on a regular basis to include the latest threat intelligence from FortiGuard Labs.
In addition to protection against the OWASP Top 10, this ruleset has been optimized to defend against attacks that target the API attack surface. Your APIs touch your most critical data, and to protect that data you need specific protection for blocking API based attacks.
Designed for AWS WAF v2 For extended web application firewall features including ML based API discovery and protection, , you can try Fortinet FortiWeb Cloud WAF-as-a-Service, a SaaS service that requires no hardware or software deployed https://aws.amazon.com/marketplace/pp/Fortinet-Inc-Fortinet-FortiWeb-Cloud-WAF-as-a-Serv/B07PXMWJT1 .
Highlights
- Comprehensive protection for your API attack surface
- Regular updates from FortiGuard Labs
- Can be configured to log, alert and/or block
Details
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Trust Center
Access real-time vendor security and compliance information through their Trust Center powered by Drata or Vanta. Review certifications and security standards before purchase.
Buyer guide
Gain valuable insights from real users who purchased this product, powered by PeerSpot.
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Pricing is based on actual usage, with charges varying according to how much you consume. Subscriptions have no end date and may be canceled any time.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Cost/unit |
|---|---|
Charge per month in each available region (pro-rated by the hour) | $30.00 |
Charge per million requests in each available region | $1.80 |
Dimensions summary
This listing bills you two ways at once. You pay a monthly subscription charge in each AWS region where you deploy the rule group. That charge is pro-rated by the hour, so partial months cost less. On top of that, you pay a usage charge for every million web requests inspected in each region. The two charges combine: the monthly fee covers access to the rule group, while the per-request fee scales with your application traffic. Because rules deploy per region, both charges repeat in each region you protect.
Top-of-mind questions for buyers
Each web request inspected by the rule group in a region counts toward your total. The charge applies per million inspected requests. Requests are counted separately in each AWS region where you deploy the rule group. Blocked and allowed requests both count once inspected.
Both charges apply at the same time. The monthly charge gives you access to the rule group in a region. The per-request charge scales with the volume of web traffic inspected. High-traffic applications see the per-request charge grow, while the monthly charge stays fixed per region.
Yes. Rule groups deploy per region. Both the monthly charge and the per-request charge repeat in each region where you deploy. You generally deploy in every region that has applications needing protection. One exception applies to global deployments served through content delivery.
community.fortinet.com
Helpful?
Vendor refund policy
N/A
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
Software as a Service (SaaS)
SaaS delivers cloud-based software applications directly to customers over the internet. You can access these applications through a subscription model. You will pay recurring monthly usage fees through your AWS bill, while AWS handles deployment and infrastructure management, ensuring scalability, reliability, and seamless integration with other AWS services.
Support
Vendor support
Support offered by Fortinet. Contact Fortinet directly by email - awswaf@fortinet.com . Please see FAQ for more info.
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Updated weekly
By Fortinet Inc.
By Cyber Security Cloud
Sentiment is AI generated from actual customer reviews on AWS and G2
Functionality
Ease of use
Customer service
Cost effectiveness
Positive reviews
Mixed reviews
Negative reviews
AI generated from product descriptions
Threat Intelligence Updates
Regular updates based on threat intelligence from FortiGuard Labs, Fortinet's threat intelligence and research organization
API Attack Protection
Optimized rulesets designed to defend against attacks targeting the API attack surface
OWASP Top 10 Coverage
Protection against OWASP Top 10 vulnerabilities through FortiWeb web application firewall security service signatures
AWS WAF Integration
Designed for AWS WAF v2 with configurable actions to log, alert, and block threats
Signature-Based Detection
WAF rulesets based on FortiWeb web application firewall security service signatures updated regularly with latest threat intelligence
Threat Intelligence Integration
Rulesets regularly updated with latest threat alerts using Cyber Threat Intelligence
OWASP Top 10 Coverage
Managed rules designed to mitigate and minimize all vulnerabilities on OWASP Top 10 Web Application Threats list
Code Injection Prevention
Targeted rules for common code injection techniques including SQLi, NoSQLi, and OS command injection
Technology-Specific Vulnerability Detection
Managed rules targeting known exploits in Apache Struts2, Apache Tomcat, Oracle WebLogic, WordPress, Drupal, and Joomla
Malicious Bot Detection
Rulesets for identifying and blocking malicious bot traffic
OWASP Top 10 Attack Protection
Protects against web attacks including SQL injection, cross-site scripting (XSS), command injection, NoSQL injection, path traversal, and predictable resource exploitation as defined in OWASP Top 10.
Managed Rule Updates
Rules are written, managed, and regularly updated by security specialists to ensure protection against evolving threats without requiring manual intervention.
AWS WAF Integration
Rules are designed to be attached to AWS WAF instances for immediate deployment and protection enhancement.
Rule Management by Security Experts
Rulesets are continuously monitored and maintained by F5's security experts to address emerging threat vectors.
Rapid Deployment Capability
Rules can be attached to AWS WAF instances within minutes following a three-step deployment process.
Standard contract
No
No
Customer reviews
Mohammed R.
Strong, Ready-to-Deploy Protection with Fortinet Managed Rules for AWS WAF
Reviewed on Sep 20, 2026
Review provided by G2
What do you like best about the product?
Fortinet Managed Rules for AWS WAF provides strong, ready-to-deploy protection against common web threats, helping us secure applications without the complexity of creating and managing custom WAF rules.
What do you dislike about the product?
One drawback of Fortinet Managed Rules for AWS WAF is that customization options can be somewhat limited for highly specific application requirements. In addition, troubleshooting false positives can occasionally require extra tuning and monitoring to ensure legitimate traffic is not blocked.
What problems is the product solving and how is that benefiting you?
Fortinet Managed Rules for AWS WAF helps us protect web applications from common threats such as SQL injection, cross-site scripting (XSS), bots, and other malicious attacks without having to build and maintain complex security rules ourselves.
Amrit P.
Strong Web Attack Protection with Easy Deployment
Reviewed on Sep 18, 2026
Review provided by G2
What do you like best about the product?
I like that Fortinet Managed Rules offer strong protection against common web attacks without requiring me to build everything from scratch. They’re straightforward to deploy, and I can tune them based on real traffic to cut down on false positives while keeping the protection effective.
What do you dislike about the product?
Some rules can be overly aggressive and may need tuning to reduce false positives. The default rule set doesn’t always align with application-specific traffic, so customization is sometimes necessary. When an application has unusual or complex request patterns, managing exceptions can quickly become time-consuming.
What problems is the product solving and how is that benefiting you?
It reduces the effort required to manually create and maintain WAF rules for common web attacks. As a result, we get a more consistent security baseline, save time, and still protect our applications from common threats.
Banking
Managed Rules with Centralized Security
Reviewed on Sep 18, 2026
Review provided by G2
What do you like best about the product?
Managed rules provide pre-configured, regularly updated security rules which make it easier to protect web applications from common threats without having to build and maintain everything from scratch. The centralized management and Fortinet’s threat intelligence also help simplify ongoing security operations.
What do you dislike about the product?
Need fine-tuning for false positives, especially for applications with custom or complex traffic patterns. It would be helpful to have more granular customization and clearer rule-level visibility when troubleshooting blocked requests.
What problems is the product solving and how is that benefiting you?
Fortinet Managed Rules for AWS WAF helps us protect web applications from common threats such as SQL injection, cross-site scripting, and malicious requests without having to create and maintain all the rules ourselves.
Anonymous
Effortless Protection with Fortinet Managed Rules
Reviewed on Sep 17, 2026
Review provided by G2
What do you like best about the product?
I use Fortinet Managed Rules for AWS WAF because it saves a lot of time with everything being managed end-to-end. It's easy to use and offers great coverage and security practices. I appreciate that it covers each web application with rules that include the OS top 10 and some custom detections, along with threat IDs. It's better than others in terms of cost and detection. The initial setup is straightforward and requires just one click. Overall, it's a reliable service that provides good results.
What do you dislike about the product?
The only area where I think Fortinet Managed Rules for AWS WAF could improve is in the threat intelligence aspect. It would be better if they could fine-tune the system to update more rapidly in nearly real-time when it comes to identifying malicious traffic from URLs. This would enhance its effectiveness against threats.
What problems is the product solving and how is that benefiting you?
It saves me time by managing and configuring rules end-to-end, offering strong security practices and easy use.
Suprim C.
Easy Integration and Strong Protection
Reviewed on Sep 09, 2026
Review provided by G2
What do you like best about the product?
The ready-to-use managed rules and easy AWS WAF integration are the most valuable features for me. They save time in rule management and provide reliable protection against common web threats. The interface is simple to manage, and Fortinet support is helpful when needed. Overall, it improves security while reducing the effort required for daily administration.
What do you dislike about the product?
The rules sometimes need fine-tuning for specific applications, especially when handling false positives. More detailed rule explanations and easier customization would make troubleshooting and policy tuning simpler.
What problems is the product solving and how is that benefiting you?
It reduces the effort of creating and maintaining WAF security rules manually. The managed rules provide ready-to-use protection against common web attacks, helping improve security while saving time on daily WAF management.