AWS Network Firewall pricing — and how to cut it.

AWS Network Firewall bills two ways: $0.395 per firewall-endpoint-hour, per Availability Zone — roughly $288/month per AZ before a single byte — plus a data-processing charge of $0.065 per GB on all traffic it inspects (us-east-1, dated 2026-07-04, directional). A workload pushing 5 TB/month through one endpoint lands near $613/month for the firewall alone, and most teams run an endpoint per AZ for resilience, which multiplies the hourly line.

It is the $0.065-per-GB fee AWS applies to every gigabyte the firewall endpoint inspects, separate from the per-hour endpoint fee. It is easy to miss when budgeting because the endpoint fee is the visible line — but the per-GB charge scales directly with how much traffic you inspect, and on a busy estate it can rival or exceed the hourly cost. TLS/advanced inspection and active threat defence are billed on top again.

No. AWS Network Firewall inspects and filters traffic; it does not provide outbound connectivity. To reach the internet your private subnets still route through a NAT Gateway, which bills its own $0.045 per gateway-hour plus its own $0.045 per GB data-processing charge. So securing egress on AWS means stacking two products — two per-hour fees and two separate per-GB meters on the same traffic. At 5 TB/month in one AZ that stack is roughly $871/month, before you add a second AZ.

Two reasons usually. First, the per-endpoint-hour fee is charged per Availability Zone, so a two- or three-AZ deployment multiplies the fixed cost before any traffic. Second, the $0.065-per-GB data-processing charge is levied on every inspected byte and never stops scaling — as egress grows, the per-GB line grows with it. Add the NAT Gateway you still need underneath (its own per-hour and per-GB charges) and the same gigabytes are metered twice.

Replace the metered stack with a flat-priced firewall NVA. Enforza is a single Linux VM in your own AWS network that does the same egress, ingress and east-west control — identity-aware L7 (SNI/FQDN) filtering, secure source-NAT and threat hardening — under a flat per-firewall licence at $0/GB. You pay only the EC2 instance plus the flat Enforza licence, with no per-endpoint-hour fee and no per-GB data-processing charge, so the bill stops scaling with your traffic. Migration is a route-table change.

Yes. Enforza covers the roughly 98% of firewalling most organisations actually use — egress, ingress and east-west control, identity-aware L7/FQDN filtering without breaking TLS, secure NAT and compliance — as one flat-priced appliance, with no per-GB tax and no per-AZ endpoint fee. It is not a six-figure enterprise platform and does not try to be; it is the drop-in replacement for the cloud-native firewall at up to 60–80% less. See the full side-by-side on the Enforza vs AWS Network Firewall comparison.

Enforza is a flat per-firewall licence — £179/month per firewall, dropping to £149 from your sixth — at $0/GB, plus the EC2 instance you run it on. Against AWS Network Firewall stacked with a NAT Gateway (two per-hour fees plus two per-GB data-processing charges, duplicated per Availability Zone), the flat line typically lands 60–80% cheaper at modest egress, and the gap widens as traffic grows because the Enforza line stays flat while the metered stack climbs. Rates are directional and dated — run your own numbers in the savings calculator.

No. Enforza removes the per-GB data-processing tax and the per-endpoint-hour and NAT-gateway fees, and replaces them with one flat per-firewall licence. You still pay AWS for the EC2 instance the firewall runs on (typically $100–$200/month at modest egress) and for normal data-transfer-out where it applies. The saving is on the firewall and NAT metering, not on AWS's underlying infrastructure.