AWS Network Firewall cost: endpoint hours plus data processed

Quick answer

AWS Network Firewall bills a fixed per-endpoint hourly fee (about $0.395/hour per firewall endpoint, one per Availability Zone) plus about $0.065 per GB of traffic processed. The always-on per-AZ endpoint fee dominates for most workloads (a multi-AZ deployment runs several endpoints around the clock), so centralizing inspection in a shared inspection VPC rather than per-VPC is the main lever.

AWS Network Firewall provides managed network filtering and intrusion prevention for VPC traffic. Its cost has two parts, a fixed hourly fee per firewall endpoint and a per-gigabyte data-processing charge, and the endpoint fee, which runs per Availability Zone whether or not traffic flows, is what surprises teams.

Endpoint hours plus data

Dimension	Rate (approximate)
Firewall endpoint	~$0.395 / hour, per AZ
Data processed	~$0.065 / GB inspected

You deploy a firewall endpoint per Availability Zone, each costing about $0.395 an hour (roughly $285 a month) regardless of traffic. So a firewall across three AZs runs three endpoints, close to $850 a month before data. Data processing at about 6.5 cents per gigabyte adds up for high-throughput inspection but is secondary for most.

Centralize inspection

Because the endpoint fee is per-AZ and per-firewall, deploying Network Firewall in every VPC multiplies the endpoint cost. The standard pattern to control it is a centralized inspection VPC: route traffic from multiple VPCs (via Transit Gateway) through one shared firewall, so you pay for one set of endpoints instead of a set per VPC. This amortizes the fixed fee across everything it protects.

Controlling Network Firewall cost

Centralize inspection in a shared VPC rather than deploying per-VPC, deploy endpoints only in the AZs you need, inspect only the traffic that requires it (do not route trusted internal traffic through the firewall unnecessarily), and weigh Network Firewall against cheaper alternatives (security groups, NACLs) for basic filtering. The per-AZ fixed fee makes centralization the key lever, the same amortize-the-fixed- fee logic as Azure Firewall.

FAQ

How is AWS Network Firewall priced?

A fixed per-endpoint hourly fee of about $0.395 (one endpoint per Availability Zone, roughly $285 per month each) plus about $0.065 per GB of traffic processed. The per-AZ endpoint fee runs whether or not traffic flows, so a multi-AZ deployment costs several hundred dollars a month before data processing.

Why is AWS Network Firewall expensive?

Because of the per-Availability-Zone endpoint fee (about $0.395 per hour each) that applies whether or not traffic flows. A firewall across three AZs runs three endpoints, close to $850 a month before data. Deploying it per-VPC multiplies this, which is why centralizing inspection is the main cost control.

How do I reduce Network Firewall cost?

Centralize inspection in a shared inspection VPC, routing traffic from multiple VPCs through one firewall via Transit Gateway, so you pay for one set of endpoints instead of one per VPC. Deploy endpoints only in needed AZs, inspect only traffic that requires it, and use security groups or NACLs for basic filtering.

What is a centralized inspection VPC?

An architecture where traffic from multiple VPCs is routed (typically via Transit Gateway) through a single shared Network Firewall in one inspection VPC, rather than deploying a firewall in each VPC. This amortizes the per-AZ endpoint fee across everything the firewall protects, sharply reducing the fixed cost compared to per-VPC firewalls.

Do I need Network Firewall or are security groups enough?

Security groups and network ACLs are free and handle stateful and stateless filtering, sufficient for many needs. Network Firewall adds managed intrusion prevention, deep packet inspection, and centralized policy at a significant fixed cost. Use it where you need those capabilities, and free security groups and NACLs for basic filtering.

Does C3X estimate Network Firewall cost?

C3X prices the aws_networkfirewall_firewall resource and its endpoints from your Terraform, so the per-AZ endpoint fee appears before deploy. Data processed depends on traffic, which you provide as a usage assumption.

What to do next

Catch the per-AZ firewall fee before you deploy. C3X reads your Terraform and prices Network Firewall and the rest of your stack against a live catalog. Start with the quickstart.