Sold by: Fortinet Inc.
Deployed on AWS
Fortinet Managed Rules for AWS WAF - API Security provides protection against API based attacks, with rules based on threat intelligence from FortiGuard Labs, Fortinet threat intelligence and research organization.
4
Overview
Fortinets WAF rulesets are based on the FortiWeb web application firewall security service signatures. These signatures are updated on a regular basis to include the latest threat intelligence from FortiGuard Labs.
In addition to protection against the OWASP Top 10, this ruleset has been optimized to defend against attacks that target the API attack surface. Your APIs touch your most critical data, and to protect that data you need specific protection for blocking API based attacks.
Designed for AWS WAF v2 For extended web application firewall features including ML based API discovery and protection, , you can try Fortinet FortiWeb Cloud WAF-as-a-Service, a SaaS service that requires no hardware or software deployed https://aws.amazon.com/marketplace/pp/Fortinet-Inc-Fortinet-FortiWeb-Cloud-WAF-as-a-Serv/B07PXMWJT1 .
Highlights
- Comprehensive protection for your API attack surface
- Regular updates from FortiGuard Labs
- Can be configured to log, alert and/or block
Details
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Trust Center
Access real-time vendor security and compliance information through their Trust Center powered by Drata or Vanta. Review certifications and security standards before purchase.
Buyer guide
Gain valuable insights from real users who purchased this product, powered by PeerSpot.
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Pricing is based on actual usage, with charges varying according to how much you consume. Subscriptions have no end date and may be canceled any time.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Cost/unit |
|---|---|
Charge per month in each available region (pro-rated by the hour) | $30.00 |
Charge per million requests in each available region | $1.80 |
Dimensions summary
This listing bills you two ways at once. You pay a monthly subscription charge in each AWS region where you deploy the rule group. That charge is pro-rated by the hour, so partial months cost less. On top of that, you pay a usage charge for every million web requests inspected in each region. The two charges combine: the monthly fee covers access to the rule group, while the per-request fee scales with your application traffic. Because rules deploy per region, both charges repeat in each region you protect.
Top-of-mind questions for buyers
Each web request inspected by the rule group in a region counts toward your total. The charge applies per million inspected requests. Requests are counted separately in each AWS region where you deploy the rule group. Blocked and allowed requests both count once inspected.
Both charges apply at the same time. The monthly charge gives you access to the rule group in a region. The per-request charge scales with the volume of web traffic inspected. High-traffic applications see the per-request charge grow, while the monthly charge stays fixed per region.
Yes. Rule groups deploy per region. Both the monthly charge and the per-request charge repeat in each region where you deploy. You generally deploy in every region that has applications needing protection. One exception applies to global deployments served through content delivery.
community.fortinet.com
Helpful?
Vendor refund policy
N/A
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
Software as a Service (SaaS)
SaaS delivers cloud-based software applications directly to customers over the internet. You can access these applications through a subscription model. You will pay recurring monthly usage fees through your AWS bill, while AWS handles deployment and infrastructure management, ensuring scalability, reliability, and seamless integration with other AWS services.
Support
Vendor support
Support offered by Fortinet. Contact Fortinet directly by email - awswaf@fortinet.com . Please see FAQ for more info.
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Updated weekly
By Fortinet Inc.
By Cyber Security Cloud
Sentiment is AI generated from actual customer reviews on AWS and G2
Functionality
Ease of use
Customer service
Cost effectiveness
Positive reviews
Mixed reviews
Negative reviews
AI generated from product descriptions
Threat Intelligence Updates
Regular updates based on threat intelligence from FortiGuard Labs, Fortinet's threat intelligence and research organization
API Attack Protection
Optimized rulesets designed to defend against attacks targeting the API attack surface
OWASP Top 10 Coverage
Protection against OWASP Top 10 vulnerabilities through FortiWeb web application firewall security service signatures
AWS WAF v2 Integration
Designed for AWS WAF v2 platform with managed rule deployment capability
Configurable Response Actions
Ability to configure rules to log, alert, and/or block detected threats
Threat Intelligence Integration
Rulesets regularly updated with latest threat alerts using Cyber Threat Intelligence
OWASP Top 10 Coverage
Comprehensive protection against all OWASP Top 10 Web Application Threats
Code Injection Prevention
Managed rules targeting code injection techniques including SQLi, NoSQLi, and OS command injection
Technology-Specific Vulnerability Protection
Dedicated rules for known exploits in Apache Struts2, Apache Tomcat, Oracle WebLogic, WordPress, Drupal, and Joomla
Malicious Bot Detection
Malicious Bots rulesets included for bot-based threat mitigation
OWASP Top 10 Attack Protection
Provides protection against web attacks including SQL injection, cross-site scripting (XSS), command injection, NoSQL injection, path traversal, and predictable resource exploitation.
Managed Rule Updates
Rules are written, managed and regularly updated by F5's security specialists to ensure protection against evolving threats without requiring manual intervention.
AWS WAF Integration
Rules can be attached to AWS WAF instances for immediate deployment and protection enhancement.
Automated Threat Detection
Utilizes security expertise to identify and mitigate vulnerabilities that are part of the OWASP Top 10 attack vectors.
Pay-as-You-Go Licensing Model
Rules are licensed on a consumption-based pricing structure where usage determines costs.
Standard contract
No
No
Customer reviews
Mohamed J.
Managed Rules Feel Too Broad—False Positives and Limited Rule-Trigger Visibility
Reviewed on Aug 11, 2026
Review provided by G2
What do you like best about the product?
What I like best is the combination of **strong, continuously updated threat protection and ease of management**. Fortinet’s managed rules add protection against common web and API attacks, including OWASP Top 10 threats, SQL injection, XSS, known exploits, CVEs, and malicious bots, while the rules are regularly updated through FortiGuard Labs. This reduces the amount of time and effort required to maintain WAF rules manually.
What do you dislike about the product?
The main drawback is that managed rules can sometimes be **too broad or generate false positives**, requiring additional tuning and exclusions for specific applications. It would also be helpful to have more granular visibility into why a particular rule triggered and simpler customization options without increasing the management overhead.
What problems is the product solving and how is that benefiting you?
Fortinet Managed Rules for AWS WAF help reduce the effort required to protect our web applications and APIs from common threats such as SQL injection, XSS, and known exploits. The continuously updated rules reduce manual rule maintenance, improve our security coverage, and help our team respond to emerging threats more quickly while saving time on WAF management.
Eddy Omar L.
Ready-to-Use Security Rules That Simplify API Protection
Reviewed on Aug 11, 2026
Review provided by G2
What do you like best about the product?
It’s a library of preconfigured, ready-to-use signatures and rules that makes security protections extremely easy to deploy and maintain. These rules are updated regularly to ensure up-to-date security. To be specific they help to secure API from injection attacks (CSS. CEVs, etc)
What do you dislike about the product?
Rules can become complex to set up, and the UI doesn’t really help, which makes management and enrolling new personnel difficult. Also, these rules can only be applied to WAS apps/services.
What problems is the product solving and how is that benefiting you?
It helped us harden our API by applying a preconfigured OWASP Top 10 ruleset. As a result, we were able to align with security standards and best practices, making our API connections/integrations and management more secure. Also, performance was not impacted.
Youcef E.
Set-and-Forget Security with Auto-Updating Rules
Reviewed on Aug 11, 2026
Review provided by G2
What do you like best about the product?
I like that Fortinet Managed Rules for AWS WAF protects our web apps against OWASP Top 10 attacks, including SQL injection, XSS, and bot attacks. The managed rulesets save us from writing custom rules manually, and layering them with rate limiting and geo-blocking enhances security. I appreciate that it blocks attacks at the edge without the need for manual rule upkeep, and we no longer have to write and update signatures ourselves. The automatic handling of new CVEs allows our developers to stay focused on features while security remains current. I love the 'set and forget' threat protection with rules updating automatically, requiring zero manual patching. The initial setup was smooth, taking under 30 minutes and attaching to the ALB in the AWS console without needing any config files, and it worked out of the box.
What do you dislike about the product?
I occasionally experience false positives, where some legitimate traffic gets flagged, especially with multi-step web apps. Additionally, I feel the logging could be more granular. Another concern is the pricing, which jumps at certain request volume tiers.
What problems is the product solving and how is that benefiting you?
I use Fortinet Managed Rules for AWS WAF to protect web apps from attacks like SQL injection without manual rule upkeep. It saves time by auto-updating rules, allowing my team to focus on development while maintaining current security.
Marketing and Advertising
Reliable protection with minimal maintenance
Reviewed on Aug 11, 2026
Review provided by G2
What do you like best about the product?
I like that Fortinet Managed Rules provide strong, continuously updated protection against common web threats without requiring me to manually maintain a large set of WAF rules. The integration with AWS WAF is straightforward, and Fortinet’s threat intelligence makes it a good low-maintenance security layer.
What do you dislike about the product?
The main downside is the limited visibility and control compared with custom AWS WAF rules. Troubleshooting false positives can sometimes be difficult, and the documentation could provide more detail about exactly why specific requests are blocked.
What problems is the product solving and how is that benefiting you?
It helps protect our web applications from common attacks and malicious traffic without requiring us to build and maintain every WAF rule ourselves. This reduces the operational overhead for the team and gives us an additional security layer that is easy to integrate with our existing AWS infrastructure.
Jovan Jovanovic
Integration with existing infrastructure has improved efficiency and centralized management
Reviewed on Nov 20, 2025
Review provided by PeerSpot
What is our primary use case?
The main use case for Fortinet FortiWeb is handling huge amounts of data from the customer side when they lack proper data structure. Customers request a solution that can manage large volumes of data and classify it, which is the primary reason they select Web Application Firewalls.
Additionally, they seek to protect and separate applications within their network between production and non-production environments, as well as define bandwidth allocation for approved applications and restrict forbidden ones.
What is most valuable?
Fortinet does not have the best Web Application Firewall in the world, but they do have interoperable systems. From the customer side, especially if they are already buying FortiGates, firewalls, mail, proxy, and other solutions, it becomes much easier for them to purchase Fortinet FortiWeb. This is because there is one technical support team and a single point of contact from the vendor side when they need technical expertise.
The main benefits provided to users who already have other Fortinet solutions include better economics and easier maintenance due to unified technical support and a convenient single point of contact. Updates are much easier because Fortinet has one operating system for all their products. If the customer buys a manager as the central console of the whole system, they can operate all systems from one console and deploy all updates, renewals, or other changes.
What needs improvement?
Fortinet can improve their technical support, especially the response time. There appears to be an issue with their SLA. When a customer opens a ticket, it is picked up within one or two hours. However, after the customer submits a specific question and requests troubleshooting help from Fortinet support, it takes at least three to five days to provide a proper answer. The response time from the support team is an area that requires improvement.
For how long have I used the solution?
We are a distributor and I continue to work with Fortinet solutions as a reseller distributor.
What do I think about the stability of the solution?
I have not received any complaints or reports of issues from our partners or our technical team regarding stability. Perhaps three or four years ago there was an incident at a customer site in Serbia, but that was not related to Fortinet. The issue was related to network segmentation because they could not reach all logs from their network. The problem was not from Fortinet but from the Cisco ASA, not the switch.
What do I think about the scalability of the solution?
For scalability on a scale from one to ten, Fortinet FortiWeb is very scalable and it is easy to improve the bandwidth and the system. You can add additional boxes that combine together to achieve a bigger throughput for investigation and research.
How was the initial setup?
I have not received any complaints from the partner side regarding troubles or issues with implementation. The implementation of Fortinet FortiWeb and WAF into the Fortinet ecosystem proceeded very smoothly.
What about the implementation team?
That is a question for the technical part of my team and is not within my area of responsibility.
What other advice do I have?
We primarily sell Fortinet's flagship model, which is FortiGate, their next-generation firewall. After that, we sell switches, wireless devices, and solutions such as mail, web protection, and EDR. These are the most sold products in Serbia from Fortinet's portfolio.
We have recently closed a deal in Serbia with Fortinet FortiWeb.
The documentation is excellent, particularly the implementation manual. The pricing is very competitive compared to most vendors producing similar solutions. When comparing Fortinet FortiWeb to F5 BIG-IP, which is their matching solution, Fortinet FortiWeb uses smaller boxes while meeting the same technical specifications. This automatically makes Fortinet FortiWeb cheaper than F5. F5 is considered the most sold vendor in this area for Web Application Firewalls globally, and Fortinet FortiWeb offers better pricing in comparison. I would rate this product a ten out of ten.