Pricing for WAF - blocking requests

Yes, you're correct in your understanding. As of October 25, 2024, CloudFront no longer charges for requests that are blocked by AWS WAF - this means you would save on both the CloudFront request fees and data transfer charges for those blocked requests. However, AWS WAF will still charge you for evaluating and blocking these requests.

For your specific case with millions of 404 requests, using AWS WAF could be cost-effective. The WAF pricing includes:

• $5.00 per month for each web ACL (for CloudFront distributions)
• $1.00 per month for each rule you add
• $0.80 per million requests processed

You could create a rate-based rule in AWS WAF to block these excessive 404 requests. For example, you could set up a rule that specifically targets requests for those missing TV channel logos and blocks them.

For high-volume workloads like yours, you might also want to consider AWS Shield Advanced, which can be more cost-effective as it includes AWS WAF at no additional charge - you would only pay for Shield Advanced itself. This approach can optimize costs for request-heavy workloads.

Another cost-saving strategy would be to use scope-down statements in your WAF rules to limit what gets analyzed, focusing only on the problematic request patterns.

Given the volume of requests you're dealing with (36.4 million in a day), implementing WAF to block these requests would likely be more cost-effective than continuing to serve 404 responses through CloudFront, as you would eliminate the data transfer costs associated with those responses.
Sources
Pricing - AWS WAF - Amazon Web Services (AWS)
Amazon CloudFront no longer charges for requests blocked by AWS WAF - AWS
Cost considerations - Guidelines for Implementing AWS WAF
Block IP address after rate-limit reached of requests responding with a 4xx | AWS re:Post