How do you keep bot traffic from running up WAF costs on a public API?

Start with the traffic breakdown before adding more rules. Look at request volume, paths, source patterns, and which rules are actually matching. That should give you a better idea of whether a few targeted rate limits would catch most of the noise.

Edge caching may also help for responses that can safely be shared. It won't fix every kind of bot traffic, but reducing repeated requests to the origin can make the rest of the bill easier to understand.

It's worth comparing another edge provider instead of assuming the WAF has to come from the same company as the origin. Cloudflare is one option mentioned for filtering bot traffic, but compare its current plans and limits against your actual request volume.

Also think through how the origin is protected. Putting a service in front doesn't help much if unwanted traffic can bypass it and reach the origin directly.

Separate the CDN request charges from WAF inspection charges when you compare prices. The discussion points to CloudFront flat-rate plans not charging for requests rejected by WAF, but that doesn't necessarily mean the rule evaluation is free. Check the current terms for the exact plan and rules you're considering.

Filtering traffic costs somebody money, so a per-request charge isn't automatically unreasonable. The frustrating part is that you can't control how much junk arrives. I'd compare the cost of inspection with the load and risk of letting more of those requests reach the application.

I wouldn't jump straight to blocking every country outside your time zone. That can cut traffic, but it can also block legitimate users. Use geography as a targeted rule only if it fits where the API is actually meant to be used.