How to gain visibility into WAF service costs I have by client / project / application?

You can get better visibility into WAF service cost by using User-defined cost allocation tags. Tags are key value pairs that can be attached to various AWS resources, such as WAF WebACLs, and then used as filters or dimensions in the Billing and Cost Management Console. Please follow these steps:

1. Set up tagging strategy for your resources. If WAF costs should be split by project, the Tag key can be "project", or "waf-project".

2. Add Tags to resources. If you're using CloudFormation or AWS SDK to manage the WebACLs, Tags can be added while the resources are being created. Alternatively, you can tag WebACL resources with the following AWS CLI command:

aws wafv2 tag-resource \                                                            
--resource-arn webacl-arn \
--tags Key=project,Value=project-name

You can use the TagResource API to add tags to resources with AWS SDK too. It's not possible to manage WebACL tags in the AWS Console today.

3. In 24 hours the tag keys will be visible in the Billing and Cost Management Console under User-defined cost allocation tags page. Enable tag-based cost allocation monitoring for these tags (like "project" or "waf-project").

4. You will be able to use these tags within next 24 hours in the Cost Explorer to Group by or Filter resource usage.

Please note that you need separate WebACLs for unique clients/projects/applications to make this approach work. You can, however, reuse the resources for the same clients/projects/applications.