Network Firewall cost rarely starts with throughput. It starts with topology, because each inspection endpoint adds an hourly meter before traffic processing begins. Data processing charges then vary with the volume moving through the firewall.
For multi-account teams, AWS Network Firewall pricing is an architecture decision as much as a security decision. A centralized inspection VPC can protect dozens of workload accounts without creating a separate firewall bill for each account. However, endpoint associations, traffic volume, egress traffic, and routing choices can quickly increase the total.
All figures below are USD estimates for August 2026. Regional pricing can vary, so validate every production estimate and its monthly charges against the AWS Network Firewall pricing page and AWS Pricing Calculator before approving a design.
Key Takeaways
- AWS Network Firewall pricing is driven primarily by provisioned endpoint-hours and the volume of data processed, not by the number of protected accounts.
- A centralized inspection VPC can serve many workload accounts, while the firewall owner pays the primary endpoint, secondary endpoint, and data processing charges.
- Multi-AZ designs improve availability but add a separate primary endpoint-hour charge for each selected Availability Zone.
- NAT gateways, Transit Gateway, data transfer, logging, AWS Config, Firewall Manager, and advanced threat protection can add separate charges beside the base firewall bill.
- Reduce total cost by removing unused endpoint associations, modeling traffic by path and Region, and balancing endpoint coverage against availability requirements.
AWS Network Firewall pricing: the two base meters
AWS Network Firewall bills primarily for two things: a provisioned Network Firewall Endpoint and data processing charges for traffic passing through it. In US East (N. Virginia), or us-east-1, the current published primary endpoint hourly rate is $0.395 per endpoint-hour; the base traffic processing price is $0.065 per GB.
Provisioned firewall endpoints create fixed costs, and production coverage may require one in each Availability Zone. They continue accruing charges while active, even during quiet periods. Data processing charges are variable, so traffic processing grows with egress, east-west traffic, and inbound paths.
The following figures are US East estimates based on current regional pricing. Rates vary by Region, and AWS China Regions use separate pricing structures.
| Meter | Estimated US East rate | What drives it |
|---|---|---|
| Primary firewall endpoint | $0.395 per hour | One provisioned primary endpoint in an Availability Zone |
| secondary VPC endpoints | $0.158 per hour | A secondary endpoint created for an associated VPC design |
| Primary endpoint data processing | $0.065 per GB | Traffic processed by the firewall endpoint |
| Advanced Inspection and advanced threat protection | Varies by Region and policy | Enabled inspection and threat-defense capabilities |
A continuously provisioned primary endpoint creates about $288.35 per 730-hour month in fixed monthly charges, before traffic charges. That estimate assumes one primary endpoint remains active for all 730 hours in a 30.4-day billing month; a secondary endpoint follows the same provisioned-hour model.
Data processing charges apply to bytes that pass through the firewall endpoint, regardless of where the traffic started or where it ends.
A packet path can also create separate data transfer charges through Transit Gateway, a NAT gateway, inter-AZ paths, logging, or other network services. These services are separate from firewall billing, and they don’t waive the firewall’s data processing charges.
The AWS Network Firewall documentation is useful for separating the firewall service from the VPC routing components around it. That distinction matters when teams try to reconcile a large network bill.
Centralized inspection changes who owns the bill
A centralized deployment normally places Network Firewall in a dedicated inspection VPC owned by the security or networking account. Workload VPCs in application accounts send selected traffic there, often through AWS Transit Gateway. That account owns the firewall and firewall policy, administers the associated protection policy, and receives endpoint and data processing charges.
The protected-account count does not directly create a Network Firewall bill. Fixed costs follow firewall endpoints and their hourly rate; route tables determine whether selected traffic reaches the inspection VPC. Security groups do not replace that path, and more workload accounts create higher data processing charges as they send inspected bytes.
In a centralized design, the firewall owner account pays for primary endpoints and associated cross-account endpoint meters. Protected accounts do not each receive an automatic Network Firewall endpoint charge.
Primary endpoints sit in the firewall’s inspection VPC, with one placed in each selected Availability Zone. AWS commonly recommends coverage across at least two zones for production availability, with each Availability Zone hosting an endpoint. A three-AZ design carries three primary hourly charges because each Availability Zone adds one endpoint meter, even when traffic stays low.
Secondary VPC endpoints have a different role and lower hourly rate. In US East, the published estimate is $0.158 per secondary endpoint-hour, compared with $0.395 for a primary endpoint-hour. They can be appropriate when the architecture needs an associated VPC endpoint, but they aren’t free connectivity objects.
That lower rate can reduce hourly cost compared with a new primary endpoint, but broad associations can still create a large fixed bill. Each provisioned association remains an hourly meter. For example, 40 separate secondary endpoint associations create 40 meters, regardless of how many policies use them.
Distributed deployments reverse that trade-off. Each account or VPC may have independent inspection endpoints and local routing control. That structure can isolate teams and simplify unusual traffic paths. It also duplicates endpoint charges, policy management, log delivery, traffic processing, and operational ownership.
Calculate a monthly multi-AZ firewall estimate
A useful estimate separates fixed infrastructure from variable inspection. Model monthly charges with separate endpoint-hour and byte meters, keeping data processing charges separate from endpoint hours. Start with this model:
Monthly Network Firewall estimate = primary endpoint hours + hours for secondary endpoints + base GB processed + feature-specific meters
In formula form:
(Primary endpoints x hours x primary rate) + (Secondary endpoints x hours x secondary rate) + (GB x base data rate) + feature-specific meters
Each Network Firewall Endpoint contributes an hourly meter, while the variable component depends on each gigabyte processed. Apply the relevant hourly rate to every endpoint.
Trace traffic processing by path before estimating. Review the current regional price card and your firewall policy to identify which bytes are billable data processing charges. Do not assume every GB receives every charge. Apply feature-specific meters only to paths that trigger them.
Example: a three-AZ centralized firewall
Assume the following for this USD estimate:
- The inspection VPC is in
us-east-1and spans three Availability Zones. - Three primary endpoints run continuously for 730 hours.
- The firewall processes 10,000 GB during the month.
- The design has no secondary VPC endpoints.
- TLS inspection, Advanced Inspection, advanced threat protection, active threat defense, managed rule groups, AWS Config rules, NAT gateway, logging, Transit Gateway, and data transfer charges are excluded.
| Cost component | Calculation | Estimated monthly cost |
|---|---|---|
| Primary endpoint hours | 3 Availability Zone endpoints x 730 x $0.395 | $865.05 |
| Base data processing | 10,000 GB x $0.065 | $650.00 |
| Total Network Firewall cost | Endpoint cost + data processing | $1,515.05 |
The $650 variable amount comes from data processing charges for 10,000 GB. It is separate from the fixed endpoint amount.
The same firewall endpoints can serve traffic from 5 or 50 accounts through one inspection VPC. Account count affects the bill only when it changes endpoint inventory, traffic volume, feature use, or supporting network services.
Traffic growth shifts the balance as traffic processing increases. At 1,000 GB per month, primary endpoint hours dominate. At 100,000 GB per month, base data processing alone reaches $6,500 under the stated US East assumption. FinOps reviews should track both dimensions, because a stable endpoint count can hide a steep rise in inspected bytes.
Example: the fixed impact of secondary endpoints
Assume a US East design requires 12 secondary VPC endpoints that stay provisioned for 730 hours. This is an endpoint-only estimate. It excludes primary endpoints, data processing charges, the feature meters listed above, NAT, Transit Gateway, logging, and all other AWS charges.
12 x 730 x $0.158 = $1,384.08 per month
That $1,384.08 represents fixed monthly charges. It comes before accounting for traffic and primary endpoint costs that support the wider architecture. Each secondary endpoint adds a fixed hourly meter. Teams should inventory every secondary endpoint association rather than treating it as a minor configuration detail.
A real invoice may use 720, 730, or 744 hours depending on the month. Use actual billing-period hours for budget forecasts. AWS’s cost-reduction discussion on re:Post also reinforces the need to evaluate endpoint hours and processed data together.
NAT Gateway service chains, TLS inspection, and threat defense
Many egress architectures route egress traffic through Network Firewall before it reaches a NAT gateway. A qualifying service chain may reduce the gateway’s hourly and data processing charges. The firewall’s own endpoint and traffic processing costs still apply.
For a qualified path, the pricing outcome can remove the NAT gateway processing charge that would otherwise sit beside the Network Firewall charge. It does not make the inspected GB free. The firewall’s data processing charges remain, and data transfer charges may still apply around the chain.
In February 2026, AWS extended the hourly and data-processing discounts for a NAT gateway to a qualifying secondary endpoint. AWS also removed the additional data-processing charge for Advanced Inspection, which includes TLS inspection, in 13 Regions. Details are in AWS’s February 2026 pricing announcement.
The affected Advanced Inspection Regions include Bahrain, Hong Kong, Tokyo, Osaka, Mumbai, Milan, Sao Paulo, Northern California, Cape Town, Seoul, Singapore, Sydney, and Melbourne. Regional pricing means a policy deployed across several Regions can have different economics. Evaluate the service chain consistently in every inspected Availability Zone.
With Advanced Inspection, TLS inspection decrypts eligible traffic so firewall rules can inspect session contents. It requires certificate management, compatible client behavior, and carefully defined exclusions. A security team should limit decryption to traffic that policy and compliance requirements permit. Those exclusions can reduce both inspection volume and operational risk.
Active threat defense and other advanced managed rule groups need separate cost reviews. Advanced threat protection isn’t included in the base $0.065 per-GB meter. Forecast each advanced threat protection capability using its current regional feature rate and the GB it processes.
CloudWatch Logs, Amazon S3 log storage, AWS KMS requests, Vended Logs delivery, and AWS Config rules can add monthly charges beside the firewall bill. Include the NAT gateway and its data processing charges in the estimate, then compare them with the firewall’s data processing charges. A firewall policy that logs every allowed session may generate more observability spend than a protection policy focused on alerts and denied traffic.
Firewall Manager adds governance charges, not per-account firewall fees
Firewall Manager can deploy and maintain a protection policy across AWS Organizations, organizational units, accounts, and Regions. It can apply that protection policy across selected account and OU scopes while reducing manual policy drift. The firewall policy’s scope, resource associations, and AWS Config rules belong in the total cost of ownership calculation.
Firewall Manager has governance charges for policy scopes and resource associations, while compliance activity can add separate costs. The important billing boundary remains unchanged. Firewall Manager does not convert a centralized inspection VPC into a per-protected-account Network Firewall service. The account that owns the firewall remains responsible for endpoint and traffic-processing charges.
A multi-account monthly estimate should separate these lines:
- Network Firewall endpoint-hours, data processing charges, and advanced feature charges belong to the firewall owner.
- Policy and policy-scope charges belong to the governance layer.
- AWS Config rules, configuration items, and evaluations can add charges when compliance policies span many accounts and Regions.
- Shield Advanced, AWS WAF, and Route 53 Resolver DNS Firewall have separate service charges.
Organization-wide AWS Config rules can add charges for configuration items and evaluations across accounts and Regions. Firewall Manager can coordinate these services and related security groups, including controls for advanced threat protection.
Chargeback for the protection policy needs an agreed allocation method for monthly charges. Some organizations distribute firewall costs by inspected GB per business unit. Others allocate fixed endpoint charges by account, environment, or Transit Gateway attachment. A hybrid model usually fits better because endpoint availability is a shared platform cost. Data processing charges and data transfer charges should follow traffic demand.
Reduce multi-account TCO without reducing coverage
The lowest Network Firewall bill is not always the best architecture. A cheaper design that creates a single-AZ dependency or bypasses inspection during failover is an operational liability. Cost control starts with clean routing and deliberate availability requirements.
First, map every path that should be inspected. Include egress traffic to the internet, inbound application flows, VPC-to-VPC traffic, on-premises routes, and partner connectivity. Security groups help control access, but they are not a substitute for routing traffic through the inspection path. Then confirm return traffic follows a symmetric path through the firewall. Asymmetric routing can cause failed sessions and misleading traffic estimates.
Next, match endpoint coverage to each fault domain and Availability Zone. Two or three placements, each in a separate Availability Zone, may be justified for a shared production platform. Development environments with limited business impact may use a smaller footprint in one Availability Zone if their availability policy allows it. The decision should come from service requirements, not a copied production template.
Endpoint count deserves recurring review. Remove unused VPC associations, retired inspection VPCs, and firewall endpoints left behind after an account migration. This reduces fixed costs and data processing charges when route changes also reduce inspected volume. Also check whether new accounts need local secondary associations or can use an existing centralized route.
For higher-throughput environments, compare Network Firewall with third-party firewalls using a complete service-chain model, including a NAT gateway where required. Appliance estimates for third-party firewalls must include EC2 instances, AWS Marketplace licensing, EBS volumes, Gateway Load Balancer, Gateway Load Balancer endpoints, autoscaling capacity, multi-AZ redundancy, support, and surrounding network services, such as a NAT gateway. Include data processing charges and distinguish managed service pricing from appliance licensing; a low instance price rarely captures the full operating cost. Also compare advanced threat protection, active threat defense, and managed rule groups.
Network Firewall avoids appliance instance sizing and license management, but its per-GB charges can become material on large traffic volumes. AWS lists a default traffic bandwidth quota of 100 Gbps per firewall endpoint in supported Regions. Treat that as a quota reference, not a promised application throughput figure, and validate quotas and performance under your traffic profile.
Use Cost and Usage Report data to track endpoint-hours at the hourly rate, separately from data processing charges and cost per gigabyte processed. Segment traffic processing by account and endpoint, and use AWS Config rules to flag unused associations. Compare monthly charges with changes to route tables, new Transit Gateway attachments, firewall policy releases, protection policy changes, and shifts in encrypted traffic. Separate data transfer charges from inspection costs, then investigate unexpected spend as a traceable architecture event.
Frequently Asked Questions
Does AWS Network Firewall charge per protected account?
No. The number of protected accounts does not directly create a Network Firewall charge. Costs are driven by endpoint inventory, processed traffic, enabled features, and supporting network services.
Who pays for a centralized Network Firewall deployment?
The account that owns the inspection VPC and firewall normally receives the endpoint and data processing charges. Organizations can use chargeback methods to allocate shared costs across workload accounts or business units.
How much does a primary Network Firewall endpoint cost?
In the US East estimate used in this article, a primary endpoint costs $0.395 per endpoint-hour. One continuously running endpoint costs approximately $288.35 over a 730-hour month, before data processing and other service charges.
Do NAT Gateway and advanced inspection charges replace Network Firewall charges?
No. A qualifying service chain may reduce certain NAT gateway charges, but the firewall’s endpoint and data processing charges still apply. Advanced Inspection and advanced threat protection also require separate regional pricing reviews.
How can teams reduce AWS Network Firewall costs?
Inventory endpoints and associations, remove unused resources, and model inspected traffic by route, account, Region, and Availability Zone. Maintain the availability coverage required by the workload while comparing centralized and distributed designs with all related network and logging charges included.
Final cost perspective
A multi-account firewall bill is driven by where inspection happens, how many firewall endpoints exist in each Availability Zone, and how much traffic crosses them. Traffic processing creates variable data processing charges. The number of protected accounts matters only when it changes those underlying meters.
Start with endpoint inventory, model traffic by Region and path, then add NAT gateway service-chain effects, data transfer charges, and advanced threat protection requirements. A centralized design can offer strong cost control, provided the organization treats routing, endpoint associations, and FinOps ownership as one design decision.
