Cloud NGFW for AWS Pricing
Cloud NGFW pay-as-you-go (PAYG) pricing.
| Where Can I Use This? | What Do I Need? |
|---|
|
|
- Cloud NGFW subscription
- Palo Alto Networks Customer Support Account (CSP)
- AWS Marketplace account
- User role (either tenant or administrator)
|
Cloud NGFW is available as a pay-as-you-go (PAYG) subscription in the
AWS Marketplace. With this model, you pay only for what you
use each month, with all charges consolidated on the invoice you receive from AWS. You
can also enjoy AWS Marketplace benefits such as consolidated billing
Amazon Web Services Enterprise Discount Program (EDP).
You pay an hourly rate for each Cloud NGFW resource. You also pay for the amount of
traffic, billed by the gigabyte, processed by the NGFW resource. Additionally, you pay
an hourly rate and for the amount of traffic processed by your Cloud NGFW resource when
you configure security services add-ons (such as Threat Prevention, Advanced URL
Filtering, DNS Security, or WildFire) or the centralized management add-on (Panorama
management). The rate charged for the traffic also depends on the aggregate traffic
processed by all NGFWs in the tenant during the month (referred to as tiered traffic
pricing).
Credit Pricing Model
You can procure and associate
Software NGFW Credits to your tenant by paying an upfront cost
for a long-term contract of one, two, or three years. You purchase these credits while
taking advantage of AWS Marketplace benefits such as consolidated billing, AWS EDP, and
automated or configurable renewals. Software NGFW credits allow you to consume Cloud
NGFW resources in your tenant at a lower cost up to a specific capacity until your
contract expires. You can add contract credits to your tenant through the
Software NGFW
Credits process.
The Cloud NGFW platform manages all credit enforcement as follows:
The platform ensures a tenant has an active Cloud Marketplace
subscription and meters consumption hourly as PAYG units.
When a customer allocates credits to a tenant, the platform begins
to meter that tenant's usage both as hourly PAYG units and equivalent Credit
units.
It continuously validates if the tenant's consumption exceeds the
allocated credits.
If a customer goes over their limit, the platform calculates the
overage and sends PAYG metering records to the Cloud Provider’s marketplace
metering service.
Thus, the platform seamlessly switches between Software NGFW
credits and an active Marketplace subscription to ensure uninterrupted
service. For example, when credits expire, the tenant automatically reverts
to PAYG.
If your monthly average consumption exceeds the purchased
credits, overages are charged at PAYG rates.
If you add Software NGFW credits during a free-trial period,
your contract starts immediately and overrides the free trial.
Metering and Billing
Cloud NGFW consumption translates to pay-as-you-go hourly pricing or as Software NGFW
credits as described in the tables below.
Base NGFW Resource Consumption
You pay an hourly rate for each Cloud NGFW resource. You also pay for the amount of
traffic, billed by the gigabyte, processed by the NGFW resource.
| SKU Type | Base SKU | Standard SKU | Premium SKU |
| Base Charge | $1.50 / hour (125.0 Credits) | $0.00 / hour (Base rate applies) | $1.50 Base + $1.50 Premium / hour (Total: $3.00 / hr) (250.0 Credits) |
| Traffic Tier 1 (up to 15 TB) | $0.065 / GB (5.4 Credits) | Included in Base (Base rate applies) | $0.065 / GB (5.4 Credits) |
| Traffic Tier 2 (15 TB to 30 TB) | $0.045 / GB (3.87 Credits) | Included in Base (Base rate applies) | $0.045 / GB (3.87 Credits) |
| Traffic Tier 3 (Above 30 TB) | $0.030 / GB (2.5 Credits) | Included in Base (Base rate applies) | $0.030 / GB (2.5 Credits) |
| Each Additional AZ | $0.50 / hour (41.7 Credits) | $0.00 / hour (Base rate applies) | $0.50 Base + $0.50 Premium / hour (Total: $1.00 / hr) (83.4 Credits) |
Usage hour is metered on each NGFW resource you
deploy. Traffic is metered across all NGFW resources deployed in your Cloud
NGFW tenant.
Cloud-Delivered Security Services (CDSS) add-on Consumption
Your security services add-on consumption is metered on each NGFW resource for each hour
you have enabled the add-on and for the amount of traffic processed by that NGFW, when
you configured it. The charged rate for the traffic also depends on the aggregate
traffic processed by all NGFWs in the tenant during the month (referred to as
tiered
traffic pricing).
| Threat Prevention add-on | Price (per hour) | Price (per GB) | Equivalent Cloud NGFW Credits | Equivalent Software NGFW Credit with Premium Support | Equivalent Software NGFW Credit without Premium Support |
| Usage Hour* (Base) | Up to 3 AZs | $ 0.300 | | 25.0 | 11.40 | 9.66 |
| Each additional AZ | $ 0.100 | | 8.3 | 3.80 | 3.22 |
| Usage Hour* (Standard) | Up to 3 AZs | $ 0.300 | | 25.0 | 11.40 | 9.66 |
| Each additional AZ | $ 0.100 | | 8.3 | 3.80 | 3.22 |
| Usage Hour (Premium) | Up to 3 AZs | $ 0.600 | | 50.0 | 22.90 | 19.41 |
| Each additional AZ | $ 0.200 | | 16.7 | 7.60 | 6.44 |
| Traffic Secured | First 15 TB/month | | $ 0.013 | 1.1 | 0.5 | 0.42 |
| Next 15 TB/month | | $ 0.009 | 0.7 | 0.3 | 0.25 |
| Above 30 TB/month | | $ 0.006 | 0.5 | 0.2 | 0.17 |
| Advanced Threat Prevention
add-on | Price (per hour) | Price (per GB) | Equivalent Cloud NGFW Credits | Equivalent Software NGFW Credit with Premium Support | Equivalent Software NGFW Credit without Premium Support |
| Usage Hour* (Base) | Up to 3 AZs | $ 0.450 | | 37.5 | 17.1 | 14.49 |
| Each additional AZ | $ 0.150 | | 0.3 | 5.7 | 4.83 |
| Usage Hour* (Standard) | Up to 3 AZs | $ 0.450 | | 37.5 | 17.10 | 14.49 |
| Each additional AZ | $ 0.150 | | 0.3 | 5.70 | 4.83 |
| Usage Hour* (Premium) | Up to 3 AZs | $ 0.900 | | 75 | 34.30 | 29.07 |
| Each additional AZ | $ 0.300 | | 25.00 | 11.40 | 9.66 |
| Traffic Secured | First 15 TB/month | | $ 0.020 | 1.7 | 0.8 | 0.68 |
| Next 15 TB/month | | $ 0.014 | 1.2 | 0.5 | 0.42 |
| Above 30 TB/month | | $ 0.009 | 0.8 | 0.3 | 0.25 |
| Advanced DNS Security add-on | Price (per hour) | Price (per GB) | Equivalent Cloud NGFW Credits | Equivalent Software NGFW Credit with Premium Support | Equivalent Software NGFW Credit without Premium Support |
| Usage Hour* (Base) | Up to 3 AZs | $ 0.450 | | 37.5 | 17.1 | 14.49 |
| Each additional AZ | $ 0.1485 | | 12.37 | 5.7 | 4.83 |
| Usage Hour* (Standard) | Up to 3 AZs | $ 0.450 | | 37.5 | 17.10 | 14.49 |
| Each additional AZ | $ 0.1485 | | 12.37 | 5.70 | 4.83 |
| Usage Hour* (Premium) | Up to 3 AZs | $ 0.900 | | 75 | 34.30 | 29.07 |
| Each additional AZ | $ 0.300 | | 24.75 | 11.40 | 9.66 |
| Traffic Secured | First 15 TB/month | | $ 0.019 | 1.626 | 0.8 | 0.68 |
| Next 15 TB/month | | $ 0.0135 | 1.125 | 0.5 | 0.42 |
| Above 30 TB/month | | $ 0.009 | 0.75 | 0.3 | 0.25 |
| Advanced WildFire add-on | Price (per hour) | Price (per GB) | Equivalent Cloud NGFW Credits | Equivalent Software NGFW Credit with Premium Support | Equivalent Software NGFW Credit without Premium Support |
| Usage Hour* (Base) | Up to 3 AZs | $ 0.450 | | 37.5 | 17.1 | 14.49 |
| Each additional AZ | $ 0.1485 | | 12.375 | 5.7 | 4.83 |
| Usage Hour* (Standard) | Up to 3 AZs | $ 0.450 | | 37.5 | 17.10 | 14.49 |
| Each additional AZ | $ 0.1485 | | 12.375 | 5.70 | 4.83 |
| Usage Hour* (Premium) | Up to 3 AZs | $ 0.900 | | 75 | 34.30 | 29.07 |
| Each additional AZ | $ 0.300 | | 24.75 | 11.40 | 9.66 |
| Traffic Secured | First 15 TB/month | | $ 0.0195 | 1.626 | 0.8 | 0.68 |
| Next 15 TB/month | | $ 0.0135 | 1.125 | 0.5 | 0.42 |
| Above 30 TB/month | | $ 0.009 | 0.75 | 0.3 | 0.25 |
| Advanced URL Filtering
add-on | Price (per hour) | Price (per GB) | Equivalent Cloud NGFW Credits | Equivalent Software NGFW Credit with Premium Support | Equivalent Software NGFW Credit without Premium Support |
| Usage Hour* (Base) | Up to 3 AZs | $ 0.450 | | 37.5 | 17.1 | 14.49 |
| Each additional AZ | $ 0.150 | | 12.5 | 5.7 | 4.83 |
| Usage Hour* (Standard) | Up to 3 AZs | $ 0.450 | | 37.5 | 17.10 | 14.49 |
| Each additional AZ | $ 0.100 | | 8.3 | 5.70 | 4.83 |
| Usage Hour* (Premium) | Up to 3 AZs | $ 0.900 | | 75 | 34.30 | 29.07 |
| Each additional AZ | $ 0.300 | | 25.00 | 11.40 | 9.66 |
| Traffic Secured | First 15 TB/month | | $ 0.020 | 1.7 | 0.8 | 0.68 |
| Next 15 TB/month | | $ 0.014 | 1.2 | 0.5 | 0.42 |
| Above 30 TB/month | | $ 0.009 | 0.8 | 0.3 | 0.25 |
| DLP add-on | Price (per hour) | Price (per GB) | Equivalent Cloud NGFW Credits | Equivalent Software NGFW Credit with Premium Support | Equivalent Software NGFW Credit without Premium Support |
| Usage Hour* (Base) | Up to 3 AZs | $ 0.600 | | 50.0 | 22.9 | 19.41 |
| Each additional AZ | $ 0.200 | | 16.7 | 7.6 | 6.44 |
| Usage Hour* (Standard) | Up to 3 AZs | $ 0.600 | | 50.0 | 22.90 | 19.41 |
| Each additional AZ | $ 0.200 | | 16.7 | 7.60 | 6.44 |
| Usage Hour* (Premium) | Up to 3 AZs | $ 1.200 | | 100 | 45.70 | 38.73 |
| Each additional AZ | $ 0.400 | | 33.3 | 15.20 | 12.88 |
| Traffic Secured | First 15 TB/month | | $ 0.026 | 2.2 | 1 | 0.85 |
| Next 15 TB/month | | $ 0.018 | 1.5 | 0.7 | 0.59 |
| Above 30 TB/month | | $ 0.012 | 1.0 | 0.5 | 0.42 |
*Usage hour is metered on each NGFW resource with
CDSS add-on enabled.
Centralized Management add-on Consumption
You can use a Panorama or Strata Cloud Manager to manage policy rules in your Cloud NGFW
resources. In that case, your centralized management add-on consumption is metered on
each NGFW resource for each hour you have associated with a Panorama or Strata Cloud
Manager and for the amount of traffic processed by that NGFW resource, when you
configured it. The rate you’re charged for the traffic also depends on the aggregate
traffic processed by all NGFWs in the tenant during the month (referred to as
tiered
traffic pricing).
You don't pay for additional device
licenses for managing policy rules in Cloud NGFW resources. Panorama does not count
these NGFW resources against its managed device license count.
Cloud NGFW sends logs to the same Strata Logging Services
associated with your Panorama or Strata Cloud Manager. You don't pay for additional
storage. When used with Cloud NGFW for AWS, Strata Logging Services automatically
scales along with the Cloud NGFW for AWS resources. As traffic throughput increases
on these Cloud NGFW resources, so does your available storage so that you don't need
to worry about making manual adjustments to storage to save your log
data.
| Palo Alto Networks Centralized
Management add-on (Panorama) | Price (per hour) | Price (per GB) | Equivalent Cloud NGFW Credits | Equivalent Software NGFW Credit with Premium Support | Equivalent Software NGFW Credit without Premium Support |
| Usage Hour (Base) | Up to 3 AZs | $ 0.300 | | 25.0 | 11.40 | 9.66 |
| Each additional AZ | $ 0.100 | | 8.3 | 3.80 | 3.22 |
| Usage Hour (Standard) | Up to 3 AZs | $ 0.300 | | 25.0 | 11.40 | 9.66 |
| Each additional AZ | $ 0.100 | | 8.3 | 3.80 | 3.22 |
| Usage Hour (Premium) | Up to 3 AZs | $ 0.600 | | 50.0 | 22.90 | 19.41 |
| Each additional AZ | $ 0.200 | | 16.7 | 7.60 | 6.44 |
| Traffic Secured | First 15 TB/month | | $ 0.013 | 1.1 | 0.50 | 0.42 |
| Next 15 TB/month | | $ 0.009 | 0.7 | 0.30 | 0.25 |
| Above 30 TB/month | | $ 0.006 | 0.5 | 0.20 | 0.17 |
| Palo Alto Networks Centralized
Management add-on (Strata Cloud Manager) | Price (per hour) | Price (per GB) | Equivalent Cloud NGFW Credits | Equivalent Software NGFW Credit with Premium Support | Equivalent Software NGFW Credit without Premium Support |
| Usage Hour (Base) | Up to 3 AZs | $ 0.450 | | 37.5 | 17.10 | 14.49 |
| Each additional AZ | $ 0.150 | | 12.5 | 5.70 | 4.83 |
| Usage Hour (Standard) | Up to 3 AZs | $ 0.450 | | 37.0 | 17.10 | 14.49 |
| Each additional AZ | $ 0.150 | | 12.5 | 5.70 | 4.83 |
| Usage Hour (Premium) | Up to 3 AZs | $ 0.900 | | 75.0 | 34.30 | 29.07 |
| Each additional AZ | $ 0.300 | | 25.0 | 11.40 | 9.66 |
| Traffic Secured | First 15 TB/month | | $ 0.020 | 1.1 | 0.80 | 0.68 |
| Next 15 TB/month | | $ 0.014 | 1.2 | 0.50 | 0.42 |
| Above 30 TB/month | | $ 0.009 | 0.8 | 0.34 | 0.29 |
Usage hour is metered on each NGFW resource
associated with a Panorama or Strata Cloud Manager.
Networking add-on Consumption
When you enable
Cloud NGFW Egress NAT, you no longer incur AWS
NAT gateway costs, but would pay Palo Alto Networks for the egress traffic data
transfer. You can configure public IP addresses for the Cloud NGFW resource using one of
two methods. You can configure the Cloud NGFW resource to use Palo Alto Networks managed
AWS Elastic IP Address (EIP) addresses to perform source NAT for your VPC traffic. In
this case, you will pay Palo Alto Networks for the hourly EIP management costs.
Alternatively, you can transfer your BYOIPs to the Cloud NGFW from your AWS account to
avoid the hourly EIP management costs. For more information, see
BYOIPs with AWS IPAM.
| Palo Alto Networks Egress NAT Add-On | Price (per Hour) | Price (per GB) | Equivalent Cloud NGFW Credits | Equivalent Software NGFW Credit with Premium Support | Equivalent Software NGFW Credit without Premium Support |
|---|
| Egress NAT IP | Palo Alto Networks managed AWS EIP | $0.01 | | 0.8 | 0.3809 | 0.32 |
| Bring Your Own IP | $0.00 | | 0.0 | 0.0 | 0.00 |
| Egress Data Transfer | US East (N.Virginia), US East (Ohio), US West (N.California), US West
(Oregon), Canada (Central), Europe (Ireland), Europe (London), Europe
(Stockholm), Europe (Frankfurt), Europe (Paris), Europe (Milan) | | $0.090 | 7.5 | 3.4 | 2.90 |
| Other AWS regions | | $0.120 | 10 | 4.5704 | 3.87 |
AWS Marketplace Metering Mechanism
Cloud NGFW uses the AWS SaaS subscription pricing model by translating the tenant’s
consumption into Units across multiple Custom dimensions and reporting it
to AWS Marketplace, as shown in the table below. This mechanism provides the flexibility
to aggregate your entire tenant’s consumption based on a few dimensions. These dimensions
include the deployment hours of all NGFWs, the amount of traffic they secure, and the
number of security features they use per hour. The Cloud NGFW translates Software NGFW
credits and reports them as add-on units to the AWS Metering service.
| AWS Marketplace | Cloud NGFW SaaS Subscription Price |
| Base NGFW Usage Hours | $ 1.5/unit |
| (1 unit = 1 usage hour) up to 3
AZs | |
| (0.333 units = 1 usage hour) for
additional AZs | |
| Traffic Secured > First 15
TB/month | $ 0.065/unit |
| (1 unit = 1 GB secured) | | |
| Traffic Secured > Next 15
TB/month | $ 0.045/unit |
| (1 unit = 1 GB secured) | | |
| Traffic Secured > Above 30
TB/month | $ 0.030/unit |
| (1 unit = 1 GB secured) | | |
| Add-ons | $ 0.012/unit |
| (1 unit = 1 Cloud NGFW credit) | |
| Refer to the add-on tables
above. | |
End-of-Sale (EOS) Announcement: DNS and WildFire Subscriptions
Effective September 1, 2026, standard DNS and WildFire subscriptions will no longer
be available for purchase on new Cloud NGFW for AWS firewall deployments.
- Ongoing Support: For now, existing customers can continue to receive full
support for legacy subscriptions if they do not enable advanced features.
- We recommend migrating to Advanced WildFire, which leverages
Precision AI® to block zero-day malware, and Advanced DNS Security, which stops
evasive shadow domains.
- These advanced capabilities are billed as integrated add-ons at a rate of 30%
of the base firewall credits.
