Getting Started from the AWS Marketplace

Getting started from AWS members accounts
—you can subscribe to the Palo Alto Networks Cloud NGFW for AWS Marketplace SaaS listing from your member AWS account. Each subscription results in the creation of a unique Cloud NGFW tenant.
You can then add multiple other AWS accounts to the Cloud NGFW tenant. You can create Cloud NGFW resources (also called NGFWs) and associate them with VPCs in their AWS accounts. You can also author security policies on these NGFW. Cloud NGFW monitors the usage of the Cloud NGFW tenant and sends metering records to AWS Marketplace Metering Service. AWS uses this information to invoice the customer.
Within your AWS account, you then add a NGFW endpoint (also referred to as a VPC endpoint) for this resource. You then add VPC route rules to route all traffic to the NGFW endpoint for inspection. AWS automatically redirects the traffic sent to the NGFW endpoint to the NGFW resource for inspection. Traffic sent to an NGFW endpoint is always returned to the same NGFW endpoint—the NGFW behaves as a “bump in the wire.”
Once started with this method, you cannot use AWS Firewall Manager with this Cloud NGFW tenant.
Getting started from a AWS Firewall Manager administrator account
—If you currently use AWS Firewall Manager to manage security groups, or other network security features across your AWS organization, You can use the same AWS Firewall Manager to deploy NGFWs into multiple accounts and VPCs throughout an AWS organization
You initiate the AWS Marketplace subscription for the Cloud NGFW listing from the AWS organization's designated AWS Firewall Manager administrative account.
You then use the AWS Firewall Manager policy workflow to author a global rulestack and quickly deploy NGFWs across multiple AWS accounts in an AWS Organization. Under the hood, the Firewall Manager orchestrates all of the components. This includes invoking the Cloud NGFW APIs to create the NGFWs and invoking the AWS APIs to create the NGFW endpoints in the customer VPCs.
Please refer to the AWS Firewall Manager integration blog and video for more details on how AWS Firewall Manager integrates with Cloud NGFW for AWS.
Once started with this method, you should always use an AWS Firewall Manager to add AWS accounts to the Cloud NGFW tenant.