Help me : WAF charges me On Free account

Question

I need your support for amazon WAF is charging me while i have my free tier account , i have never used it or even check it , as well to make sure i open it and check if i create any WEB ACL or Rules

![Enter image description here](/media/postImages/original/IMriHrwJ3pSrulu-xzOPjxNA)

![Enter image description here](/media/postImages/original/IMwKVujajGQ6SD4_4U1_Cobw)

I had to pay $12.56 for a free account in August/September 2023, Can anyone help me, can the amount I paid for this service be refunded ?
![Enter image description here](/media/postImages/original/IMuV1D5YsETGODWj-qfoRmCg)

- August 2023
![Enter image description here](/media/postImages/original/IMxwxcRsFATc-KuK2MyKK-xA)

- September 2023
![Enter image description here](/media/postImages/original/IM9BKQqdGuSEW-_2jtqNpFvQ)

![Enter image description here](/media/postImages/original/IMboOrgC_3Sv69c4wtgmoJDQ)

I followed this guide but I didn't find any ACLs

```ACCEPTED ANSWER
This is for WAF Web ACLs that exist in your account that can be configured for CloudFront from the shared content.

We recommend that you check the following questions as they are identical to the following questions.
https://repost.aws/ja/questions/QUUuif84GFT7aboMppZDVJag/service-charge-free-tier-account#ANIxN0Z35nT4SqeTBm2AnfsA

It can be removed by following the methods in the following document.
Incidentally, when deleting a Web ACL, you can select the corresponding Web ACL by setting the region to Global on the Web ACL screen.
https://docs.aws.amazon.com/waf/latest/developerguide/web-acl-deleting.html

You can also check the API history in CloudTrail to see what caused it to be created.
I think there is a history of "CreateWebACL".
https://docs.aws.amazon.com/waf/latest/developerguide/logging-using-cloudtrail.html```

Accepted Answer

Hi,
As Joseeee rightly mentioned, if you are unsure how it got created and when etc, it is very likely that it was created along with other resources (ex. CloudFront) and got deleted while deleting those resources (if used CloudFormation or other automation tools). The easiest and best way to find out what happened and how, is to search "CloudTrail Event History" for WebACL creation and deletion. Let me help step by step:

1. Navigate to CloudTrail service -> click on "Event History" in the left navigation pane.
2. Select "Event name" from the drop down, and write "CreateWebACL" in the field, as shown in image below.

![CloudTrail Event History](/media/postImages/original/IMdR1sPrvUSgCrEqfFfmGr7g)

The CloudTrail Event History, by default, keep records for past 90 days only. If you were charged only for past 2 months, then it is possible we will see the "CreateWebACL" calls in the CloudTrail Event History. If the WebACL was created prior to 90 days, we will see nothing here.

Once the above is done, and if you see an event there, it proves that the WebACL was created. The event will also show you who created the WebACL, and when. That way, you will understand how the WebACL was created, and hence the charges.

Now, if you do not see anything above, lets follow the steps below.

1. Navigate to CloudTrail service -> click on "Event History" in the left navigation pane.
2. Select "Event name" from the drop down, and write "DeleteWebACL" in the field, as shown in image below.

![CloudTrail Event History](/media/postImages/original/IMdA0kQnumTFmi6aPOky3MaQ)

Here you will highly likely see some events, as you do not have any WebACLs in the Global region right now (I can see in the screenshot you shared), and you are seeing charges till date (falls within 90 days). This will prove that the WebACL was present and it was deleted recently. Since it is deleted, you would not be charged after when it was deleted.

Also, to clarify, the charges are for AWS WAF latest (as it shows v2 in the bills). I can see that you were charged for "requests" as well in the month of August, it is possible that the WebACL would have been associated with a CloudFront Distribution that was created around that time. How did you create the CloudFront distribution (manually using console OR CloudFormation OR some other automation)? Have you deleted/removed any CloudFront distribution in past few days? You might want to review those steps/scripts etc.

Lastly, if following above steps do not provide any leads, I would suggest to raise a case with the Billing team. They have tools in place to see why you were charged, and can take necessary actions.

I hope it helps.

**If the answer is helpful, please click "Accept Answer" and upvote it. **

Answer

It's very likely another service you're using created this on your behalf during the setup (ie. Cloudfront).

If it's not showing in this page, can you try clicking on the **Switch to AWS WAF Classic** link on the left hand side? You want to make sure that any policy under the AWS WAF Classic are removed as well.

If you have already removed it, look in [Cost Explorer](https://us-east-1.console.aws.amazon.com/cost-management/home#/) for the daily usage/cost of AWS WAF. This can help identify if the service is still running and you'll accrue additional charges on a day to day basis.

I believe support may be able to help you identify where this resource is as well.

Answer

I don't know if you have solved this or not. But I have the same issue, turns out I have cloudfront distribution to serve my static site from S3. In the General Settings, there is Security - WAF that turns out enable when i setup the cloudfront.

Answer

Thank you for the  quick help from everyone

Help me : WAF charges me On Free account

Relevant content