>
    Strata Copilot
    Cloud NGFW for AWS Limits and Quotas
    Focus
    Download PDF
    Focus
    1. Home
    2. Cloud NGFW for AWS
    3. Cloud NGFW for AWS Limits and Quotas
    Download PDF
    Cloud NGFW for AWS

    Cloud NGFW for AWS Limits and Quotas

    Table of Contents

    Cloud NGFW for AWS Limits and Quotas

    Learn the limits and quotas of the Cloud NGFW for AWS.
    Where Can I Use This?What Do I Need?
    • Cloud NGFW for AWS
    • Cloud NGFW subscription
    • Palo Alto Networks Customer Support Account (CSP)
    • AWS Marketplace account
    • User role (either tenant or administrator)
    The following tables list the limits for your Cloud NGFW. Unless indicated otherwise, you can request an increase for these limits.
    Use the Cloud NGFW for AWS pricing estimator to help you determine AWS limits and quotas for your Cloud NGFW subscription.

    Cloud NGFW Management

    Name
    Default Limits per Cloud NGFW Tenant
    Adjustable
    Number of Cloud (AWS) accounts in a tenant
    500
    No
    Cloud NGFW endpoints for each NGFW resource
    300
    No
    Outstanding global rulestacks not associated with NGFW resources
    10
    Yes
    Outstanding local rulestacks not associated with NGFW resources
    10
    Yes
    To change any of the adjustable limits listed above, contact Palo Alto Networks Customer Support.

    Native Policy Management (Rulestack)

    Attribute
    Maximum Limit per Cloud NGFW Resource
    Adjustable
    Security rules
    1,000
    No
    Addresses objects (FQDN list and IP prefix lists)
    1,000
    No
    Number of IP prefix list
    1,000
    No
    FQDN objects across all FQDN lists
    2,000
    No
    Prefix objects for each IP prefix list
    2,500
    No
    Custom URL categories
    500
    No
    URLs across all URL categories
    25,000
    No
    Intelligent feeds (including the five predefined feeds)
    30
    No
    IP addresses across all feeds
    50,000
    No
    Certificate objects
    100
    No

    Panorama and Strata Cloud Manager Policy Management

    Attribute
    Maximum Limit per Cloud NGFW Resource*
    Policy
    Security rules
    6,000
    Decryption rules
    1,000
    Objects
    Address objects
    10,000
    Address groups
    1,000
    Members per address group
    2,500
    FQDN address groups
    2,000
    Service objects
    2,000
    Service groups
    500
    Members per service group
    500
    EDL
    Max number of DNS per domain system
    500,000
    Max number of IPs per system
    50,000
    Max number of URLs per system
    100,000
    Max number of custom lists
    30
    URL Filtering
    Total entities for allow list, block list and custom categories
    25,000
    Max custom categories
    500
    * The limits on policy and objects specified are unidimensional maximum. Palo Alto Networks recommends additional testing within your environment to ensure you meet your policy authoring objectives.

    © 2026 Palo Alto Networks, Inc. All rights reserved.