>
    Strata Copilot
    Cloud NGFW Billing Association with SCM
    Focus
    Download PDF
    Focus
    1. Home
    2. Cloud NGFW for AWS
    3. Getting Started from Strata Cloud Manager
    4. Cloud NGFW Billing Association with SCM
    Download PDF
    Cloud NGFW for AWS

    Cloud NGFW Billing Association with SCM

    Table of Contents

    Cloud NGFW Billing Association with SCM

    If you would like to subscribe using a different account for billing purposes, you can repeat the above process and generate a billing code for another AWS account and then use it when you subscribe from the corresponding AWS account in the AWS Marketplace.
    Where Can I Use This?What Do I Need?
    • Cloud NGFW for AWS
    • Cloud NGFW subscription
    • Palo Alto Networks Customer Support Account (CSP)
    • AWS Marketplace account
    • User role (either tenant or administrator)

    Cloud NGFW Tenant

    When you create the first Cloud NGFW resource in the Strata Cloud Manager, the platform automatically creates a Cloud NGFW tenant and links it with Strata Cloud Manager. This Cloud NGFW tenant remains dedicated to the Strata Cloud Manager.

    AWS Marketplace Billing Association

    You can generate a billing code in the SCM console for an AWS account and then use it when you subscribe from the same account in AWS Marketplace. This action establishes the PAYG billing link, enabling metering records to be sent from Cloud NGFW to the AWS Marketplace Metering Service. Your Cloud NGFW resources remain intact during this transition.

    Generate Billing Code and Subscribe using AWS Marketplace

    1. Add a Pay-As-You-Go (PAYG) Subscription
      1. In the SCM UI, go to the Subscriptions page.
      2. Click Add New Subscription.
      3. Enter the AWS Account ID that will be used for billing.
      4. Click Generate Billing Subscription Code. The platform will generate a billing association code, and an email will be sent to the admin user who created the SCM tenant.
      5. Click Complete the Subscription on AWS Marketplace.
      6. Go to the Palo Alto Networks Cloud NGFW page on the AWS Marketplace and click View purchase options or Subscribe. This will open the AWS Marketplace in a new browser tab.
    2. Complete Subscription on AWS Marketplace.
      If you are subscribing to Cloud NGFW with this AWS account for the first time, you will be redirected to Palo Alto Networks Cloud NGFW page in AWS Marketplace. Perform the following steps:
      1. Click Subscribe.
      2. Review the offer details and click Subscribe again on the confirmation page if prompted.
      3. After subscribing, click Set up your account. You will be redirected to the AWS Quick Launch page to link your SCM tenant.
        If you have previously subscribed to Cloud NGFW from this account, the subscribe button will be greyed out. Click Set up your Account to go to the Quick Launch page as described in Step 2 in Generate Billing Code and Subscribe using AWS Marketplace. For more information, see AWS Marketplace Billing Aggregation.
    3. Click Enable Integration and ensure that you have all required AWS permissions.
    4. Click Login or create an account.
    5. Link your CNGFW Account by applying Billing Code generated in Step 1.
      1. Select the option I have a SCM Billing Subscription Code and enter the code you generated in SCM to link the SCM.
      2. Enter your Email.
      3. Click Save.
        Upon successful subscription, you will be redirected back to the SCM UI.
      4. Click Continue with Strata Cloud Manager. You are now redirected to the SCM portal. In the Subscription tab, you can see the Pay-as-you-go subscription or free-trial subscription details.
        If you want to add a second SCM tenant using the same AWS account, click Add New Subscription. You will be redirected to generate new SCM Billing Subscription Code. Complete the steps described in Step 2. This will change the billing account to a different AWS Account.

    Replace AWS Marketplace Billing Association

    If you would like to subscribe using a different account for billing purposes, you can repeat the above process and generate a billing code for another AWS account and then use it when you subscribe from the corresponding AWS account in the AWS Marketplace. When you subscribe from a second AWS account to the same SCM, the platform replaces the currently established billing link with this newly subscribed account. It dynamically selects the new subscribed account for sending metering and overage records. You can then go ahead and unsubscribe from the original AWS account. Your Cloud NGFW resources remain intact during this transition.
    If you unsubscribe from the currently subscribed PAYG account used for billing and have not added Cloud NGFW credits to your Cloud NGFW tenant, the platform will delete all your Cloud NGFW resources.

    AWS Marketplace Billing Aggregation

    You may use multiple Strata Cloud Managers in your environment to meet your governance model or regional presence. When this is the case, it becomes necessary to create Cloud NGFW resources independently for each Strata Cloud Manager.
    This distributed approach necessitates a repetition of certain critical steps for each Strata Cloud Manager. Specifically, you will need to:
    1. Generate a Billing Code within each SCM Console: This involves navigating to the administrative interface of each Strata Cloud Manager and following the procedure to generate a unique billing subscription code. This code is essential for linking the SCM to AWS Marketplace for billing purposes.
    2. Establish a Billing Link to AWS Marketplace: After generating the billing code, you establish a billing link for each SCM using your AWS Marketplace account:
      1. Click Set up your Account to go to the Quick Launch page.
      2. You are redirected to Quick launch page of your relevant product listing in AWS Marketplace.
      3. Click Link a different account.
      4. Select the option I have an SCM Billing Subscription Code.
      5. Accurately enter the unique billing code previously generated in the respective SCM and click Continue.
    Following these steps initiates the linking process using the previously established AWS Marketplace subscription. Upon successful completion of the billing link, the workflow will automatically redirect you back to the Strata Cloud Manager console, confirming the integration. This process ensures that billing for Cloud NGFW resources deployed through each specific Strata Cloud Manager is correctly associated with the appropriate AWS Marketplace account.
    In this case, if you unsubscribe from the currently subscribed account used for establishing billing links with multiple Strata Cloud Managers and have not added Cloud NGFW credits to your Cloud NGFW tenant, the platform will delete all your Cloud NGFW resources in all the associated Strata Cloud Managers.

    Credit Management

    Optionally, you can purchase and activate Cloud NGFW Credits, then associate them with each Cloud SCM/Cloud NGFW tenant. From then on, the platform continuously validates usage against your credit allocation on each SCM. If consumption exceeds your allocated credits, the platform calculates overages and sends PAYG metering records to AWS Marketplace. If your credits expire, the Cloud NGFW platform automatically and seamlessly switches to your active AWS Marketplace subscription for Pay-As-You-Go billing. Your Cloud NGFW resources remain intact during these transitions.

    © 2025 Palo Alto Networks, Inc. All rights reserved.