Pricing summary / tiers

With AWS Network Firewall, you pay an hourly rate for each firewall endpoint per region and Availability Zone. You also pay for the amount of traffic processed by your firewall endpoint, billed by the gigabyte per region and Availability Zone. Data processing charges apply for each gigabyte processed through the firewall endpoint regardless of the traffic's source or destination.

Advanced inspection

You pay an additional hourly rate per region and Availability Zone for Advanced Inspection when you use the TLS inspection feature. In some regions, you may also pay additional charges for the amount of traffic processed by your firewall endpoint for Advanced Inspection when using the TLS inspection feature, billed by the gigabyte per region and Availability Zone. You also incur standard AWS data transfer charges for all data transferred via the AWS Network Firewall.

NAT gateway discount

If you create a NAT gateway and place it next to your AWS Network Firewall in a service chain within your AWS account, standard NAT gateway per-hour and data processing usage charges are waived. This waiver is applied on a one-to-one basis with the standard Network Firewall Endpoint per-hour usage and standard Network Firewall Traffic Processing usage. To receive this benefit, your NAT Gateway and Network Firewall must be in the same region, and the NAT Gateway must be configured in the same networking path as your Network Firewall endpoint. Excluded from this benefit are Network Firewall Advanced Inspection Endpoint and Network Firewall Advanced Inspection Traffic Processing. 

Pricing table - By region

Example 1 - Network Firewall with NAT Gateway Pricing

In this example, you have created a network firewall and a NAT gateway, and you have an Amazon EC2 instance with traffic routed to the Internet through the network firewall and NAT gateway. Your EC2 instance sends a 1 GB file to one of your S3 buckets. The EC2 instance, network firewall, NAT gateway, and S3 bucket are in the same region (US East (N. Virginia)), and the network firewall, NAT gateway, and EC2 instance are in the same availability zone. The following charges apply:

  • Network Firewall Endpoint Hourly Charges: $0.395 for each hour your firewall endpoint is provisioned.
  • Network Firewall Data Processing Charges: $0.065 for 1 GB of data processed by the firewall.
  • NAT Gateway Hourly Charges: No charge for each hour your firewall endpoint is provisioned.
  • NAT Gateway Data Processing Charges: No charge per gigabyte of NAT gateway processing for each gigabyte processed by your firewall.
  • EC2 Data Transfer Charges: Standard EC2 data transfer charges apply. But because your EC2 instance and S3 bucket are in the same region, there is no charge for data transfer between EC2 and S3. There is also no charge for data transfer between your NAT gateway and EC2 instance since the traffic stays in the same availability zone using private IP addresses. If your NAT gateway and EC2 instance were in different availability zones, EC2 data transfer charges would apply. See the Data Transfer section of the EC2 Pricing page for more details.

Total charges are therefore $0.065 for 1 GB of data processed by your firewall when using NAT gateway plus $0.395 for each hour your firewall is provisioned. There are no data transfer charges in this example. However, if you send the same file to a non-AWS Internet location, EC2 data transfer charges will apply to data transferred out from EC2 to the Internet.

Note: To avoid NAT gateway data processing charges, you can create a gateway VPC endpoint and route traffic to and from S3 through the VPC endpoint instead of going through a NAT gateway. There are no data processing or hourly charges for using gateway VPC endpoints. For details on how to use VPC endpoints, see VPC Endpoints Documentation.

Example 2 - Network Firewall with NAT Gateway Pricing

In this example, you have 2 network firewalls in two AZs of US East (N. Virginia) region and have 5,000 GB of outbound traffic per month (30 days). If you are connecting to the Internet from a private subnet, you may decide to also use 2 NAT gateways in each AZ.

Your total usage for AWS Network Firewall is

  • 1,440 hrs of usage (720 hrs in a month * 2 network firewall endpoints)
  • 5,000 GB of outbound traffic processed

Because each firewall is entirely zonally isolated for high availability, you pay no cross-AZ charges. Therefore, the charges would be $568.80 = ($0.395 * 1,440 hrs) plus $325 = ($0.065/GB * 5,000 GB processed). The Total Monthly Charge would be $893.80 per month.

For the NAT gateway, you would therefore receive 1,440 hours of NAT gateway and 5,000 GB of NAT gateway GB processed at no additional cost in this same month.

Example 3 - Network Firewall with Advanced Inspection Pricing

In this example, you have created a network firewall in Europe (Ireland) and have 5,000 GB of traffic per month. The following charges apply:

  • Network Firewall Endpoint Hourly Charges: $0.395 for each hour your firewall endpoint is provisioned in Europe (Ireland).
  • Network Firewall Advanced Inspection Endpoint Hourly Charges: $0.489 for each hour your firewall endpoint is provisioned in Europe (Ireland).
  • Network Firewall Data Processing Charges: $0.065 for 1 GB of data processed by the firewall in Europe (Ireland).
  • Network Firewall Advanced Inspection Data Processing Charges: There is no additional charge for Advanced Inspection data processed by the firewall in Europe (Ireland).

Total endpoint charges would be $636.48 = ($0.395 * 720 hours per month) + ($0.489 * 720 hours per month). Total data processing charges would be $325 = ($0.065/GB * 5,000 GB processed). Your total bill would be $961.48 for the month.

Example 4 - Network Firewall with Advanced Inspection and NAT Gateway Pricing

In this example, you have created a network firewall and a NAT gateway in Asia Pacific (Sydney) and have 5,000 GB of traffic per month. The following charges apply:

  • Network Firewall Endpoint Hourly Charges: $0.395 for each hour your firewall endpoint is provisioned in Asia Pacific (Sydney).
  • Network Firewall Advanced Inspection Endpoint Hourly Charges: $0.711 for each hour your firewall endpoint is provisioned in Asia Pacific (Sydney).
  • Network Firewall Data Processing Charges: $0.065 for 1 GB of data processed by the firewall in Asia Pacific (Sydney).
  • Network Firewall Advanced Inspection Data Processing Charges: $0.009 for 1 GB of Advanced Inspection data processed by the firewall in Asia Pacific (Sydney).
  • NAT Gateway Hourly Charges: No charge for each hour your firewall endpoint is provisioned in Asia Pacific (Sydney) based on standard Network Firewall Endpoint hourly usage. Network Firewall Advanced Inspection Endpoint hourly charges is excluded from the NAT Gateway-Network Firewall bundled pricing benefit.
  • NAT Gateway Data Processing Charges: No charge per gigabyte of NAT gateway processing for each gigabyte traffic processed by your firewall in Asia Pacific (Sydney) based on standard Network Firewall Traffic Processing. Network Firewall Advanced Inspection Traffic Processing is excluded from the NAT Gateway-Network Firewall bundled pricing benefit.

Total endpoint charges would be $796.32 = ($0.395 * 720 hours per month) + ($0.711 * 720 hours per month). Total data processing charges would be $370 = ($0.065/GB * 5,000 GB processed) + ($0.009/GB * 5,000 GB processed). Your total bill would be $1,166.32 for the month.