AWS Network Firewall pricing calculator
Estimate Endpoint and Traffic Processing Costs. Estimate your costs using AWS list prices.
Estimates from AWS list prices, not an AWS quote. Discounts, taxes and credit terms may affect your bill.
01 · How AWS Network Firewall pricing works
What you pay for
- Firewall endpoint: $0.395 per hour per AZ endpoint (secondary endpoints $0.158/hour).
- Traffic processing: $0.065 per GB.
- Advanced inspection (TLS/active threat defense) per endpoint-hour and per GB.
- NAT gateway hourly and per-GB charges are waived one-to-one when a NAT gateway is used with a Network Firewall endpoint, per the pricing page.
Common cost traps
- One endpoint per AZ is billed 24/7 (~$288/month each) before traffic.
- Inspecting east-west traffic between VPCs processes every GB.
- Advanced inspection adds per-hour and per-GB charges on top.
Ways to reduce cost
- Use a centralized inspection VPC with Transit Gateway instead of endpoints in every VPC.
- Pair with NAT gateways to benefit from the NAT charge waiver.
- Inspect only the traffic that needs it with route-table design.
Free Tier & account eligibility
Free Tier depends on account age. Accounts created on or after 15 July 2025 get a $100 sign-up credit plus up to $100 more for completing onboarding activities; on the Free plan these last 6 months (or until used up), on the Paid plan unused Free Tier credits stay usable for 12 months from sign-up. Accounts created before 15 July 2025 keep the legacy Free Tier (12-month offers plus always-free offers). Always-free offers apply on both plans. Network Firewall has no free tier; new-plan accounts can pay from Free Tier credits.
02 · AWS credits & runway
Do credits cover AWS Network Firewall?
Network Firewall endpoint hours, traffic processing and advanced inspection are eligible usage and are offset by credits. General rules: credits only offset charges from the billing cycle in which they were applied onward (never past bills), they apply only to the services listed on the credit in Billing and Cost Management > Credits, they expire on the date shown there, and accounts on the AWS Free plan cannot receive Activate credits until they upgrade to the Paid plan.
Check my creditsExcluded charges & conditions
- Upfront payments for Savings Plans and Reserved Instances (All Upfront, and the upfront part of Partial Upfront). The recurring hourly fee of a No Upfront commitment is billed as normal usage and can be offset.
- AWS Marketplace charges (Activate credits make an exception for third-party foundation models used through Amazon Bedrock).
- AWS Enterprise Support, Enterprise On-Ramp, Unified Operations, resold support and partner-led support.
- Amazon Route 53 domain name registration and transfer fees.
- Taxes (sales, use, VAT and similar), AWS Professional Services, Training and Certification, Mechanical Turk, AWS Managed Services, and any use for cryptocurrency mining.
Illustrative credit runway
Single-service examples from the supplied data, not your calculator result. Months = credit amount ÷ monthly cost, before credit expiry. Credits can expire before these theoretical months are used; coverage and other AWS services can shorten runway.
| Usage profile | Monthly estimate | $10,000 | $25,000 | $100,000 |
|---|---|---|---|---|
| Small | $320.85 | 31.2 mo. | 77.9 mo. | 311.7 mo. |
| Medium | $1,226.70 | 8.2 mo. | 20.4 mo. | 81.5 mo. |
| Large | $8,697.25 | 1.1 mo. | 2.9 mo. | 11.5 mo. |
Small profile assumptions
1 firewall endpoint 24/7, 500 GB processed | Firewall endpoint: 730 endpoint-hours x $0.395 = $288.35; Traffic processed: 500 GB x $0.065 = $32.50 | Total ~$320.85/month, us-east-1 on-demand list prices, before Free Tier, taxes and support.
Medium profile assumptions
2 endpoints (2 AZs) 24/7, 10 TB processed | Firewall endpoints: 1,460 endpoint-hours x $0.395 = $576.70; Traffic processed: 10,000 GB x $0.065 = $650.00 | Total ~$1,226.70/month, us-east-1 on-demand list prices, before Free Tier, taxes and support.
Large profile assumptions
3 endpoints 24/7 with advanced inspection, 100 TB processed with threat protection | Firewall endpoints: 2,190 endpoint-hours x $0.395 = $865.05; Advanced inspection: 2,190 endpoint-hours x $0.38 = $832.20; Traffic processed: 100,000 GB x $0.065 = $6,500.00; Advanced threat protection: 100,000 GB x $0.005 = $500.00 | Total ~$8,697.25/month, us-east-1 on-demand list prices, before Free Tier, taxes and support.
04 · Questions
AWS Network Firewall pricing FAQ
What is the minimum cost?
About $288 per month per AZ endpoint plus $0.065 per GB processed.
Is NAT gateway cost waived?
Yes, NAT gateway hours and GB processed are waived one-to-one for traffic also processed by Network Firewall.
Do credits cover it?
Yes, it is eligible usage.
How can I reduce cost?
Centralize inspection, pair with NAT gateways, and avoid inspecting traffic that does not need it.
05 · Sources & estimate notes
Content pack dated 2026-10-19. Calculator rates remain their existing snapshots; this content update is not a price refresh.
Verification notes
- Runway prices come from the calculator repository snapshot rate card network-firewall (no AWS Price List mapping in the build). Confirm the main unit prices on https://aws.amazon.com/network-firewall/pricing/ before publishing.