AWS Network Firewall pricing — and how to cut it.

AWS Network Firewall bills two ways: $0.395 per firewall-endpoint-hour, per Availability Zone — roughly $288/month per AZ before a single byte — plus a data-processing charge of $0.065 per GB on all traffic it inspects (us-east-1, dated 2026-07-10, directional). A workload pushing 5 TB/month through one endpoint lands near $613/month for the firewall alone, and most teams run an endpoint per AZ for resilience, which multiplies the hourly line.

It is the $0.065-per-GB fee AWS applies to every gigabyte the firewall endpoint inspects, separate from the per-hour endpoint fee. It is easy to miss when budgeting because the endpoint fee is the visible line — but the per-GB charge scales directly with how much traffic you inspect, and on a busy estate it can rival or exceed the hourly cost. TLS/advanced inspection and active threat defence are billed on top again.

No. AWS Network Firewall inspects and filters traffic; it does not provide outbound connectivity, so your private subnets still route through a NAT Gateway. AWS waives the NAT Gateway's own $0.045-per-hour and $0.045-per-GB fee once it is service-chained behind a Network Firewall endpoint (since 2026-02-06), so you are not billed twice for the same bytes — but Network Firewall's own $0.065/GB data-processing charge, which is 44% higher than the NAT fee it replaces, still applies in full. At 5 TB/month through one endpoint that's roughly $613/month for the firewall, before you add a second AZ (each additional AZ's endpoint is billed at the lower $0.158/hr secondary rate, not the full $0.395/hr primary rate).

Two reasons usually. First, the per-endpoint-hour fee is charged per Availability Zone — the primary AZ at $0.395/hr, each additional AZ at $0.158/hr — so a multi-AZ deployment multiplies the fixed cost before any traffic. Second, the $0.065-per-GB data-processing charge is levied on every inspected byte and never stops scaling — as egress grows, the per-GB line grows with it, and it is itself pricier than the NAT Gateway fee it replaces on a chained deployment.

Replace the metered stack with a flat-priced firewall NVA. Enforza is a single Linux VM in your own AWS network that does the same egress, ingress and east-west control — identity-aware L7 (SNI/FQDN) filtering, secure source-NAT and threat hardening — under a flat per-firewall licence at $0/GB. You pay only the EC2 instance plus the flat Enforza licence, with no per-endpoint-hour fee and no per-GB data-processing charge, so the bill stops scaling with your traffic. Migration is a route-table change.

Yes. Enforza covers the roughly 98% of firewalling most organisations actually use — egress, ingress and east-west control, identity-aware L7/FQDN filtering without breaking TLS, secure NAT and compliance — as one flat-priced appliance, with no per-GB tax and no per-AZ endpoint fee. It is not a six-figure enterprise platform and does not try to be; it is the drop-in replacement for the cloud-native firewall at up to 60–80% less. See the full side-by-side on the Enforza vs AWS Network Firewall comparison.

Enforza is a flat per-firewall licence — £179/month per firewall, dropping to £149 from your sixth — at $0/GB, plus the EC2 instance you run it on. Against AWS Network Firewall securing egress (its per-endpoint-hour fee, duplicated per Availability Zone at a lower secondary rate, plus its $0.065/GB data-processing charge on top — the NAT Gateway fee behind it is waived), the flat line typically lands 60–80% cheaper from roughly 15TB/month of egress upward, and the gap widens as traffic grows because the Enforza line stays flat while the metered stack climbs. Rates are directional and dated — run your own numbers in the savings calculator.

No. Enforza removes the per-GB data-processing tax and the per-endpoint-hour and NAT-gateway fees, and replaces them with one flat per-firewall licence. You still pay AWS for the EC2 instance the firewall runs on (typically $100–$200/month at modest egress) and for normal data-transfer-out where it applies. The saving is on the firewall and NAT metering, not on AWS's underlying infrastructure.