We have a web application on AWS, and we wanted just one minimum utility firewall to take care of one site with limited traffic. It is an internal website that is used by less than 200,000 employees. To protect that site, we use Barracuda WAF.
The internal website and the firewall were deployed only last year. We are running it on a minimal configuration, and no extensive changes were made. We will be making changes to the configuration periodically based on the requisites.