Sold by: Fortinet Inc.
Deployed on AWS
The Complete OWASP Top 10 Ruleset delivers comprehensive web application protection to protect against the OWASP Top 10 web application threats
4.1
Overview
This product is not for AWS WAF Classic. Fortinets WAF rulesets are based on the FortiWeb web application firewall security service signatures, and are updated on a regular basis to include the latest threat information from FortiGuard Labs. The Complete OWASP Top 10 Ruleset provides a comprehensive package for web application protection offered by Fortinet to help cover the entire list of OWASP Top 10 web application threats. Includes protection for SQL Injection, Cross Site Scripting, General and Known Exploits, Malicious Bots and Common Vulnerabilities and Exposures (CVE).
For extended web application firewall features such as protection for zero attacks using AI-based behavioral attack detection, detailed attack log visibility, custom whitelisting and dedicated tools to fine tune and manage detections you can try Fortinet FortiWeb Cloud WAF-as-a-Service, a SaaS service that requires no hardware or software deployed https://aws.amazon.com/marketplace/pp/Fortinet-Inc-Fortinet-FortiWeb-Cloud-WAF-as-a-Serv/B07PXMWJT1 .
Fortinet Managed Rules for AWS WAF Video Tutorial https://pages.awscloud.com/mp-kickstart-fortinet.html?&trk=ta_a134p000003yoFjAAI&trkCampaign=AWSMP_pap_x_x_content-hub-resources&sc_channel=ta&sc_campaign=ta_awsmp_card&sc_outcome=Marketplace&sc_geo=mult
Pricing information: Pricing consists of two dimensions:
- $30 per month for each web ACL using the Fortinet Managed Rules, per region
- $1.8 per million requests in each region
Pricing examples:
pricing example: 2x web acl in a single region (ie us-east-1)
Managed rule group charges = $60.00 (2x units for 2x web ACLs) Managed rule group request charges = $1.80/million * 10 million = $18.00 Total AWS Marketplace charges = $78.00/month
pricing example: 2x web acl in two regions (ie us-east-1 & us-east-2)
Managed rule group charges = $60.00 (2x units for 2x web ACLs) Managed rule group request charges = $1.80/million * 10 million = $18.00 Total AWS Marketplace charges = $78.00/month
pricing example: 3x web acl in two regions and one using a CloudFront (ie us-east-1, us-east-2, CloudFront)
Managed rule group charges = $90.00 (3x units for 3x web ACLs) Managed rule group request charges = $1.80/million * 10 million = $18.00 Total AWS Marketplace charges = $108.00/month
Highlights
- Complete set to help protect against the OWASP Top 10
- Can be configured to log, alert and/or block
- Regular updates from FortiGuard Labs
Details
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Trust Center
Access real-time vendor security and compliance information through their Trust Center powered by Drata or Vanta. Review certifications and security standards before purchase.
Buyer guide
Gain valuable insights from real users who purchased this product, powered by PeerSpot.
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Pricing is based on actual usage, with charges varying according to how much you consume. Subscriptions have no end date and may be canceled any time.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Cost/unit |
|---|---|
Charge per month in each available region (pro-rated by the hour) | $30.00 |
Charge per million requests in each available region | $1.80 |
Dimensions summary
You pay for this rule set through two usage-based charges that apply together. The first is a monthly charge in each region where you deploy, pro-rated by the hour. This covers keeping the managed rule group active in that region. The second is a charge per million web requests inspected in each region. This scales with the traffic your protected applications receive. You deploy separately in each AWS region that needs coverage, so both charges repeat per region. There is no upfront commitment; costs track your actual regions and request volume.
Top-of-mind questions for buyers
Version choice does not change how you are billed. Both charges still apply: the monthly per-region charge and the per-million-requests charge. Static versions receive no new signatures until you switch versions manually. Each static version is supported for up to six months before revocation and a 30-day grace period.
A request is a single web request that the managed rule group inspects in a given region. Requests are counted per region and billed per million. Deploying to protect a global content delivery service applies globally; otherwise you count requests separately in each region where you add the rule group.
Both charges apply together on the same invoice. The monthly per-region charge is fixed for each region where you deploy. The per-million-requests charge grows with your traffic. For applications with heavy request volume, the request charge usually dominates. For low-traffic applications spread across many regions, the monthly charges add up faster.
community.fortinet.com
Helpful?
Vendor refund policy
Non-Refundable
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
Software as a Service (SaaS)
SaaS delivers cloud-based software applications directly to customers over the internet. You can access these applications through a subscription model. You will pay recurring monthly usage fees through your AWS bill, while AWS handles deployment and infrastructure management, ensuring scalability, reliability, and seamless integration with other AWS services.
Support
Vendor support
Support offered by Fortinet. Contact Fortinet directly by email - awswaf@fortinet.com . Please see FAQ for more info.
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Updated weekly
By Fortinet Inc.
By Cyber Security Cloud
Sentiment is AI generated from actual customer reviews on AWS and G2
Functionality
Ease of use
Customer service
Cost effectiveness
Positive reviews
Mixed reviews
Negative reviews
AI generated from product descriptions
OWASP Top 10 Protection Coverage
Comprehensive ruleset protecting against all OWASP Top 10 web application threats including SQL Injection, Cross Site Scripting, General and Known Exploits, Malicious Bots, and Common Vulnerabilities and Exposures (CVE)
Threat Intelligence Updates
Regular updates based on latest threat information from FortiGuard Labs security research
Configurable Response Actions
Rules can be configured to log, alert, and/or block detected threats
AWS WAF Integration
Managed rule group compatible with AWS WAF for web application firewall deployment
Multi-Region Support
Deployable across multiple AWS regions with per-region configuration capabilities
Threat Intelligence Integration
Rulesets regularly updated with latest threat alerts using Cyber Threat Intelligence
OWASP Top 10 Coverage
Managed rules designed to mitigate and minimize all vulnerabilities on OWASP Top 10 Web Application Threats list
Code Injection Prevention
Targeted rules for common code injection techniques including SQLi, NoSQLi, and OS command injection
Technology-Specific Vulnerability Detection
Managed rules targeting known exploits in Apache Struts2, Apache Tomcat, Oracle WebLogic, WordPress, Drupal, and Joomla
Malicious Bot Detection
Rulesets for identifying and blocking malicious bot traffic
OWASP Top 10 Attack Protection
Protects against web attacks including SQL injection, cross-site scripting (XSS), command injection, NoSQL injection, path traversal, and predictable resource exploitation as defined in OWASP Top 10.
Managed Rule Updates
Rules are written, managed, and regularly updated by security specialists to ensure protection against evolving threats without requiring manual intervention.
AWS WAF Integration
Rules are designed to be attached to AWS WAF instances for immediate deployment and protection enhancement.
Rule Management by Security Experts
Rulesets are continuously monitored and maintained by F5's security experts to address emerging threat vectors.
Rapid Deployment Capability
Rules can be attached to AWS WAF instances within minutes following a three-step deployment process.
Standard contract
No
No
No
Customer reviews
reviewer2897019
Firewall protection has secured our customer portal and provides long-term peace of mind
Reviewed on Sep 08, 2026
Review from a verified AWS customer
What is our primary use case?
I use the solution as a firewall for our customer portal.
How has it helped my organization?
The solution provides peace of mind with website protection.
What is most valuable?
The solution offers IP Protection, which I find very valuable.
What needs improvement?
There is room for improvement in providing better access to updates, more seamless renewals, and the ability to rename objects.
For how long have I used the solution?
I have used the solution for 12 years.
Which solution did I use previously and why did I switch?
I did not use any previous solutions.
How was the initial setup?
Inital setup was fairly involved, requiring multiple sessions with Fortinet support.
What's my experience with pricing, setup cost, and licensing?
It is probably best to bring your own license (BYOL).
Which other solutions did I evaluate?
I did not consider any alternate solutions.
What other advice do I have?
The renewals are not seamless, and although updates are advertised via email from AWS, actual software updates require contacting support for access.
Which deployment model are you using for this solution?
Public Cloud
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Amazon Web Services (AWS)
Ilario M.
Intuitive and NIS2 Compliance with Fortinet WAF
Reviewed on Sep 04, 2026
Review provided by G2
What do you like best about the product?
I like that Fortinet Managed Rules for AWS WAF is very intuitive and that we can manage groups and users precisely thanks to its integration with Azure AD. Additionally, we are Fortinet partners and receive dedicated discounts, which is an added advantage.
What do you dislike about the product?
nothing in particular
What problems is the product solving and how is that benefiting you?
Fortinet Managed Rules for AWS WAF helps me manage user access integrated with Azure AD, keeping us compliant with NIS2 regulations, and it's intuitive, allowing precise group and user management.
Mohammed R.
Good baseline WAF protection for teams without a security engineer
Reviewed on Sep 04, 2026
Review provided by G2
What do you like best about the product?
1.Fast to deploy — subscribe on Marketplace, attach to the existing web ACL, running same day
2.No rule writing or tuning required to get OWASP Top 10 coverage FortiGuard Labs handles signature updates, so we're not chasing new CVEs
3.Stays native to AWS — same console, CloudWatch metrics, sampled logs, Terraform workflow
4.Rule groups are separable (OWASP, SQLi/XSS, bots, API), so we only pay for what we use
5.COUNT mode let us validate against real traffic before blocking Strong coverage-to-effort ratio for a small team with no dedicated WAF engineer
2.No rule writing or tuning required to get OWASP Top 10 coverage FortiGuard Labs handles signature updates, so we're not chasing new CVEs
3.Stays native to AWS — same console, CloudWatch metrics, sampled logs, Terraform workflow
4.Rule groups are separable (OWASP, SQLi/XSS, bots, API), so we only pay for what we use
5.COUNT mode let us validate against real traffic before blocking Strong coverage-to-effort ratio for a small team with no dedicated WAF engineer
What do you dislike about the product?
1.False positives on legitimate traffic (file uploads, rich-text fields, complex query strings) take trial and error to isolate
2.Documentation is lighter than Fortinet's on-prem WAF products; limited guidance on which rule group to pick for a given workload
2.Documentation is lighter than Fortinet's on-prem WAF products; limited guidance on which rule group to pick for a given workload
What problems is the product solving and how is that benefiting you?
1.Gave us real OWASP Top 10 coverage without anyone writing or maintaining rule logic — we simply didn't have the headcount for that
2.FortiGuard handles signature updates, so new CVEs get covered faster than we could virtual-patch ourselves
3.Satisfies the WAF control for compliance and customer security questionnaires with something documented and defensible
2.FortiGuard handles signature updates, so new CVEs get covered faster than we could virtual-patch ourselves
3.Satisfies the WAF control for compliance and customer security questionnaires with something documented and defensible
Cristíano D.
Custom rules that facilitate management and give full control of processes
Reviewed on Sep 03, 2026
Review provided by G2
What do you like best about the product?
Because it allows creating custom rules and having better control of all processes. This makes it easier to manage the platform. It is a great differentiator of the product.
What do you dislike about the product?
It allows improving performance and minimizing impact, depending on the platform being used. However, it has a significant price and the return on investment of the product, the support
What problems is the product solving and how is that benefiting you?
With AI, we can solve various problems and, thanks to its support for integrations, it facilitates the optimization of all the integrations we need to implement for what is to come.
Ranjeet T.
Efficient Security Management with Easy Setup
Reviewed on Sep 01, 2026
Review provided by G2
What do you like best about the product?
I like how Fortinet Managed Rules for AWS WAF helps me manage both my internal and public domain requests. It effectively stops unauthorized access and ensures only genuine requests reach the server. I appreciate its capability to monitor my payment system and protect my entire subdomains. The setup and configuration process is very easy, and I find the log analysis feature quite useful.
What do you dislike about the product?
Nothing
What problems is the product solving and how is that benefiting you?
I use Fortinet Managed Rules for AWS WAF to manage internal and public domain requests, stop unauthorized access, and protect subdomains. It monitors my payment system effectively. The setup and configuration are also very easy, making log analysis straightforward.