AWS landing zones, Terraform and CloudFormation, with the firewall
in the hub.
Four ready-to-deploy AWS reference architectures, from a single gateway to a
GWLB fleet, each running the Enforza firewall and secure NAT as a network
virtual appliance in your own account. Same egress, ingress and east-west
control as the cloud-native firewall, at a flat per-firewall price with no
per-GB data-processing tax.
Every pattern ships in Terraform and CloudFormation, and in two flavours that build identical networking. Only the firewall image and its bootstrap differ.
marketplace-ami
Boots the Enforza AWS Marketplace AMI and self-registers via the EC2
Instance Identity Document. You then claim it in the console by AWS
account id plus instance id. No key to manage.
deployment-key
Boots a stock base image (Amazon Linux 2023, or Debian 12 for the GWLB
pattern) and installs the engine with a one-time registration key from
the console, under Onboard Firewall, Deployment Keys. No Marketplace
subscription.
Prerequisites
An AWS account and a region with at least two Availability Zones (three for the GWLB fleet).
Credentials able to create VPC and EC2, plus IAM, Lambda, SNS and CloudWatch for the failover pattern, and Transit Gateway for centralised egress.
Terraform 1.5 or newer, or the AWS CLI for CloudFormation.
Either a Marketplace subscription plus AMI id, or a deployment key per firewall from the console.
The one thing every pattern shares
The firewall's network interface has its source and destination check
disabled, because a forwarding appliance handles packets addressed to
other hosts. Without that, the gateway would drop all transit traffic.
The templates set this for you.
Grab the Terraform and CloudFormation from the public repository, or
deploy from the Marketplace.
Packet path: a workload sends to the internet, its private route table
sends 0.0.0.0/0 at the firewall's network interface, the Enforza NVA
applies Layer 7 egress policy and source-NATs behind its Elastic IP, then the
public route table sends 0.0.0.0/0 to the internet
gateway. Return traffic follows the reverse path. The firewall's network interface has
its source and destination check disabled, because a forwarding appliance handles
packets addressed to other hosts.
Medium: dual-AZ failover, basic resilience without a Transit Gateway
Who it is for: an SMB with one production VPC that wants basic resilience without standing up a Transit Gateway.
What it deploys
One VPC, two public subnets across two AZs, each with a firewall and Elastic IP.
Two private subnets and one shared private route table.
A failover loop: a CloudWatch status-check alarm, an SNS topic, and a Lambda that repoints the default route to the standby and flips back on recovery.
Limits, stated plainly
This is basic, non-production resilience, not production HA.
Failover keys off EC2 status checks (about two minutes), which catch a dead or hung instance, not an in-appliance degradation.
In-flight connections reset on the flip; automatic flip-back can cause a second brief disruption.
For production-grade HA, use the GWLB fleet.
Internet
0.0.0.0/0 → IGW
Internet gateway
VPC 10.0.0.0/16
AZ 0Firewall APRIMARYElastic IP
Private A · 10.0.1.0/24
Workloads
AZ 1Firewall BSTANDBYElastic IP
Private B · 10.0.11.0/24
Workloads
Shared private route table
0.0.0.0/0 → firewall A normally, flips to firewall B on failover
ec2:ReplaceRoute
Failover control loop (not a data path)
CloudWatch alarmstatus check ×2
SNS topic
Lambdaroute flipper
Basic resilience, not production HA
Failover keys off EC2 status checks (about two minutes to detect), does not sync
session state, so in-flight connections reset on the flip, and automatic flip-back can
cause a second brief disruption. It catches a dead or hung instance, not an in-appliance
degradation. For production-grade high availability, use the GWLB fleet pattern, which
uses the load balancer's own health checks and horizontal scale.
Who it is for: mid-market, multi-VPC or multi-account, wanting one inspected, cost-controlled egress edge.
What it deploys
A Transit Gateway hub and an inspection VPC with two AZ firewalls in appliance mode.
Three workload VPCs, each defaulting 0.0.0.0/0 to the Transit Gateway.
AZ-symmetric routing so return traffic comes back through the same firewall that handled the outbound flow.
How to use it, and limits
Adding a workload VPC is one attachment, one association, one return route and one security-group entry.
Appliance mode plus AZ-specific routing is what keeps a stateful appliance correct behind a Transit Gateway: it must see both directions of a flow on the same instance.
Two firewalls give per-AZ split; scale throughput by instance size.
You pay AWS for the Transit Gateway attachment and data, which Enforza does not remove.
Internet
0.0.0.0/0 → IGW
Internet gateway
Inspection VPC 10.0.0.0/16 · two AZ firewalls (appliance mode)
Appliance mode plus Availability-Zone-specific routing is what keeps a stateful appliance
correct behind a Transit Gateway: the appliance must see both directions of a flow on the
same instance, so the two AZ lanes never cross. Adding a workload VPC is one attachment,
one association, one return route and one security-group entry. You still pay AWS for the
Transit Gateway attachment and data, which Enforza does not remove.
Extra-large: transparent inspection with a GWLB fleet
Who it is for: scale-out and enterprise teams, transparent inspection, per-AZ isolation, and MSP or MSSP fleets pricing the NGFW GWLB short-list (Palo Alto, Fortinet, Check Point).
What it deploys
An appliance VPC with one Enforza engine per AZ (three) behind an AWS Gateway Load Balancer.
A spoke VPC whose workloads route to an AZ-local GWLB endpoint.
Cross-zone off, so each AZ's traffic is inspected by that AZ's engine, for AZ affinity and an isolated blast radius.
How to use it, and the flavour note
After deploy, claim each engine, then enable the AWS GWLB connector on each claimed firewall in the console (it starts disabled by design).
GWLB health checks then go healthy and traffic flows.
The deployment-key flavour needs a Debian 12 base image; the marketplace-ami flavour has no such constraint.
This is the pattern for genuine horizontal scale and high availability.
Internet
appliance VPC IGW · secure NAT egress
Internet gateway
Appliance VPC 10.101.0.0/16 · cross-zone off (AZ isolation)
Gateway Load BalancerGENEVE target group
AZ aEngine a
AZ bEngine b
AZ cEngine c
transparent GENEVE inspection
Spoke VPC 10.100.0.0/16 · AZ-local GWLB endpoints
AZ aGWLB endpoint
0.0.0.0/0 → GWLBe
Workload a
AZ bGWLB endpoint
0.0.0.0/0 → GWLBe
Workload b
AZ cGWLB endpoint
0.0.0.0/0 → GWLBe
Workload c
Transparent inspection: workloads keep egressing to a logical endpoint, with no
per-instance route to a firewall interface. The Gateway Load Balancer load-balances flows
across the engine fleet and removes an unhealthy engine automatically, so this is the
pattern for genuine horizontal scale and high availability. The full datapath is on the
GWLB inspection page.
This is a short teaser. The full GWLB datapath, GENEVE encapsulation and the
NGFW short-list comparison live on the dedicated page.
Every pattern above rides the same flat per-firewall licence. That is where the wedge comes from, and it does not move with the things the cloud-native firewalls meter.
Not CPU or instance-size limited
Run Enforza on any EC2 size and the price does not change. The metered services bill by endpoint-hour, vCPU or instance size; Enforza does not.
Not IP or object limited
No cap on protected IPs or network objects on the licensed plan, and no per-IP charge.
Not protected-device limited
We do not licence by how many hosts you protect. Why would your firewall charge by how many things it protects?
Not complicated cloud pricing
One flat per-firewall line you can forecast, not a per-hour plus per-GB plus per-AZ plus per-add-on maze. USD $239 for 1–5 firewalls, $199 from your sixth. GBP £179 / £149.
For MSPs and CSPs
Put a flat-priced firewall in every hub you build
These are deploy-ready accelerators, not just lead magnets. If you operate a fleet
of firewalls for clients, a downloadable, sized, flat-priced landing zone drops the
same inspected egress edge into every account you manage, at a price your clients
can forecast.
The EC2 instance the appliance runs on, the internet gateway, Transit Gateway attachment and data, GWLB endpoint hours and processing, inter-AZ transfer and data-transfer-out. Enforza does not remove these; they are on your AWS bill whichever firewall you pick.
Reserved and committed-use discounts
Both the cloud firewall and the Enforza EC2 can be discounted with commitments. We price on-demand US list on both sides to keep it like-for-like.
Per-Availability-Zone multipliers
We price the AZ count each pattern actually deploys. Network Firewall adds a per-endpoint-hour fee per AZ; Enforza's resilience is your choice of how many VMs to run.
GWLB's own AWS charges
The Gateway Load Balancer's hourly and per-GB charges apply to any appliance behind it, so they are your infra cost, excluded from the appliance-licence wedge.
FAQ
AWS landing zones, common questions
Which AWS landing zone should I pick?
Match the pattern to your estate. Single gateway (S) is one VPC, secure egress for a dev or small production estate. Dual-gateway AZ failover (M) adds basic, non-production resilience to one production VPC. TGW centralised egress (L) is one inspected egress edge for a multi-VPC or multi-account estate. GWLB fleet (XL) is transparent inspection with per-AZ isolation and horizontal scale, for scale-out teams and MSP or MSSP fleets. Each is a section on this page with its own diagram, deploy notes and cost snapshot.
Terraform or CloudFormation?
Both. Every pattern ships in Terraform and CloudFormation, and they build the identical topology, CIDRs and outputs, so pick whichever your team already runs. Terraform needs version 1.5 or newer; CloudFormation needs the AWS CLI.
What is the difference between the marketplace-ami and deployment-key flavours?
The networking is identical, only the firewall image and its bootstrap differ. The marketplace-ami flavour boots the Enforza AWS Marketplace AMI and self-registers via the EC2 Instance Identity Document, then you claim it in the console by AWS account id plus instance id. The deployment-key flavour boots a stock base image and installs the engine with a one-time registration key from the console, so it needs no Marketplace subscription.
How much cheaper is Enforza than AWS Network Firewall or NAT Gateway?
Up to 60–80% on the firewall and NAT metering, because Enforza is a flat per-firewall licence at $0/GB (real billable USD $239, $199 from your sixth firewall; GBP £179/£149) rather than a per-endpoint-hour, per-AZ, per-GB meter. It is a claim on the firewall and NAT charges, not on your whole AWS bill: you still pay AWS for the EC2 instance the appliance runs on, and for cloud plumbing such as the internet gateway, Transit Gateway attachment and data, GWLB endpoint hours and processing, inter-AZ transfer and data-transfer-out, which Enforza does not remove. Every figure on this page is a public US list price, dated and directional.
Is the dual-gateway AZ failover pattern production HA?
No, and its own README says so. It is basic, non-production resilience: failover keys off EC2 status checks (about two minutes to detect), does not sync session state (in-flight connections reset on the flip), and automatic flip-back can cause a second brief disruption. It catches a dead or hung instance, not an in-appliance degradation. For production-grade high availability, use the GWLB fleet pattern, which uses the load balancer's own health checks and horizontal scale.
Can I download the Terraform and CloudFormation now?
Yes. The templates are validated and public, in the repository at github.com/enforza/landing-zones: each pattern in Terraform and CloudFormation, in both marketplace-ami and deployment-key flavours. Clone it, pick a pattern directory and deploy in your own account, or launch from the AWS Marketplace listing plus the console instead. Talk to us for a deploy review and we will walk you through the exact templates for your estate.
Do these templates work in any AWS region?
Yes, with the usual constraint: each pattern needs a region with at least two Availability Zones, and the GWLB fleet needs three (one engine and one GWLB node per AZ). The GWLB fleet's deployment-key flavour uses a Debian 12 base image, because that datapath installer needs Debian or Ubuntu rather than Amazon Linux; the marketplace-ami flavour has no such constraint.
AWS architecture icons are property of Amazon Web Services, used per their published
icon terms for architecture diagrams. Enforza is an independent product and is not
affiliated with, sponsored by, or endorsed by AWS.
Same control, flat pricing, in your own account.
Drop the per-GB tax out of your AWS egress.
Deploy the pattern that fits your estate, from a single gateway to a GWLB fleet, with the Enforza firewall and secure NAT in the hub. Flat per-firewall pricing, no data-processing charges. Start free, no card.
VPC 10.0.0.0/16 
Elastic IP 
Private subnet A · AZ 0 · 10.0.1.0/24 
