Single service comparison

AWS WAF attaches web ACLs to AWS edge/load-balancer resources and bills per ACL, per rule, and per inspected request, supporting thousands of rules under a single ACL and global propagation via CloudFront. Huawei Cloud WAF is configured by adding protected websites/domains in cloud (CNAME), dedicated, or ELB-redirected mode, with editions (Standard/Professional/Platinum) gating domains, QPS, and features such as geolocation, anti-crawler, and IPv6 rather than per-rule metering.

Rule authoring differs in granularity and ecosystem. AWS provides AWS Managed Rules, Marketplace rule groups, and full custom rule language with regex, rate-based, and label-based logic plus Bot Control and Fraud Control managed groups. Huawei WAF ships built-in OWASP, CC, anti-crawler, geolocation, tamper protection, and zero-day virtual patches maintained by its SOC, but exposes fewer composable managed groups and a narrower custom rule DSL; expect to rewrite complex AWS rules rather than import them.

Operations and HA diverge. AWS WAF is stateless across AWS edge locations with cross-region replication for CloudFront ACLs and integrates with CloudWatch and Security Hub. Huawei WAF runs in 25 regions with intra-/cross-AZ and cross-region DR claiming 99.95% SLA, pairs with AAD for volumetric DDoS, LTS/Cloud Eye for logs and metrics, and HSS for host-side posture; coverage of network-layer and L3-L4 attacks is via separate CFW/AAD, not the WAF itself.

Inventory all AWS WAF web ACLs, their attached resources (CloudFront, ALB, API Gateway), managed/marketplace rule groups, custom rules with regex/rate logic, action and logging configuration, and CloudWatch alarms. Decide target topology: Huawei WAF in cloud (CNAME) sits in front of Elastic Load Balance/CDN origins, with DDoS handled by AAD and east-west/network controls by CFW. Confirm Huawei region coverage (25 regions) and edition limits on domains, QPS, and IPv6/geo/anti-crawler before selecting Standard/Professional/Platinum.

Re-create protection policy in Huawei WAF console or API. Map AWS managed rule groups to Huawei built-in protection (OWASP top 10, CC attack prevention, web tamper, anti-crawler, geolocation) and translate custom rules to Huawei custom rules, accepting differences in the rule DSL, label support, and rate-based logic. Reissue TLS certificates via Cloud Certificate Manager, configure origin server addresses/ports/weights, and set custom block pages and TLS minimum versions to match PCI-DSS posture.

Stand up Huawei WAF in detect-only/count mode first, replay representative traffic or run staging cut-over with shadow comparison against AWS WAF. Validate detection parity for OWASP, bot, and CC scenarios using WAF event data and LTS logs; check origin health (404/502/504 troubleshooting), latency, and failover across AZs. Plan DNS switchover to the Huawei WAF CNAME and roll back to the AWS CNAME if false-positive or coverage gaps appear.

Account for gaps and pricing-model change. AWS pay-per-rule/pay-per-request has no direct Huawei equivalent; Huawei bills per edition/month plus protected assets and LTS log volume, so recalculate TCO at peak QPS and retention. Marketplace rule groups and deep AWS service integrations (Security Hub,GuardDuty,Firehose logging) have no one-to-one Huawei equivalent; expect to compose WAF with CFW, AAD, DEW, and HSS, and to operate detection/response through LTS and Cloud Eye rather than AWS-native telemetry.