>
    Strata Copilot
    Obtain the Amazon Machine Image (AMI)
    Focus
    Download PDF
    Focus
    1. Home
    2. VM-Series
    3. VM-Series Firewall on AWS
    4. Deploy the VM-Series Firewall on AWS
    5. Obtain the Amazon Machine Image (AMI)
    Download PDF
    VM-Series

    Obtain the Amazon Machine Image (AMI)

    Table of Contents

    Obtain the Amazon Machine Image (AMI)

    Learn how to obtain the Amazon Machine Image (AMIs) from the AWS Marketplace.
    Where Can I Use This?What Do I Need?
    • AWS
    • AWS account
    • Amazon Machine Image (AMI) ID
    • VM-Series License (PAYG or BYOL)
    • VM-Series plugin
    • Panorama
    • Panorama plugin for AWS
    Get the Amazon Machine Image for the public AWS cloud and the AWS GovCloud from the respective Marketplace.

    AWS Public Cloud AMI

    The AMI for the VM-Series firewall is available in the AWS Marketplace for both the Bring Your Own License (BYOL) and the usage-based pricing options.
    For purchasing licenses with the BYOL option, contact your Palo Alto Networks sales engineer or reseller.

    AWS GovCloud AMI

    The Bring Your Own License (BYOL) model and the usage-based model of the VM-Series firewall are available on the AWS GovCloud Marketplace. With a GovCloud account, you can search for Palo Alto Networks and find the AMIs for the VM-Series firewall on the Marketplace. Make sure to review the supported EC2 instance types before you launch the firewall. For details, see Launch the VM-Series Firewall on AWS.

    Review System Requirements and Limitations for VM-Series on AWS

    Requirement
    Details
    EC2 instance types
    The EC2 instance type you select must meet the VM-Series System Requirements for the VM-Series firewall model. If you deploy the VM-Series firewall on an EC2 instance type that does not meet these requirements, the firewall will boot into maintenance mode
    To support VM Monitoring and high availability on AWS, the VM-Series firewall must be able to directly reach the AWS API service endpoints without any proxy servers between the firewall management interface and the AWS API endpoints (such as ec2.us-west-2.amazonaws.com).
    Amazon Elastic Block Storage (EBS)
    The VM-Series firewall must use the Amazon Elastic Block Storage (EBS) volume for storage. EBS optimization provides an optimized configuration stack and additional, dedicated capacity for Amazon EBS I/O.
    Networking
    Because the AWS only supports Layer 3 networking capabilities, the VM-Series firewall can only be deployed with Layer 3 interfaces. Layer 2 interfaces, virtual wire, VLANs, and subinterfaces are not supported on the VM-Series firewall deployed in the AWS VPC.
    Interfaces
    Support for a total of eight interfaces is available—one management interface and a maximum of seven Elastic Network Interfaces (ENIs) for data traffic. The VM-Series firewall does not support hot attachment of ENIs; to detect the addition or removal of an Elastic Network Interface you must reboot the firewall.
    Your EC2 instance type selection determines the total number of ENIs you can enable. For example, the c3.8xlarge supports eight (8) ENIs.
    Support entitlement and Licenses
    For the Bring Your Own License model, a support account and a valid VM-Series license are required to obtain the Amazon Machine Image (AMI) file, which is required to install the VM-Series firewall in the AWS VPC. The licenses required for the VM-Series firewall—capacity license, support license, and subscriptions for Threat Prevention, URL Filtering, WildFire, etc—must be purchased from Palo Alto Networks. To purchase the licenses for your deployment, contact your sales representative. See VM-Series Firewall Licenses for Public Clouds.
    For the usage-based licensing model, hourly and annual pricing bundles can be purchased and billed directly to AWS. You must however, register your support entitlement with Palo Alto Networks. For details see, Register the Usage-Based Model of the VM-Series Firewall for Public Clouds (no auth code).

    © 2026 Palo Alto Networks, Inc. All rights reserved.