Managed AIRS for AWS is available as a pay-as-you-go (PAYG) subscription in the AWS Marketplace. With this model, you pay only for what you use each month, with all charges consolidated on the invoice you receive from AWS. You can also enjoy AWS Marketplace benefits such as consolidated billing Amazon Web Services Enterprise Discount Program (EDP).

You pay an hourly rate for each Managed AIRS resource. You also pay for the amount of traffic, billed by the gigabyte, processed by the NGFW resource. Additionally, you pay an hourly rate and for the amount of traffic processed by your Managed AIRS resource when you configure security services add-ons (such as Threat Prevention, Advanced URL Filtering, DNS Security, or WildFire) or the centralized management add-on. The rate charged for the traffic also depends on the aggregate traffic processed by all NGFWs in the tenant during the month (referred to as tiered traffic pricing).

You can procure and associate Software NGFW Credits to your tenant by paying an upfront cost for a long-term contract of one, two, or three years. You purchase these credits while taking advantage of AWS Marketplace benefits such as consolidated billing, AWS EDP, and automated or configurable renewals. Software NGFW credits allow you to consume Managed AIRS resources in your tenant at a lower cost up to a specific capacity until your contract expires. You can add contract credits to your tenant through the Software NGFW Credits process.

The Managed AIRS for AWS platform manages all credit enforcement as follows:

• The platform ensures a tenant has an active Cloud Marketplace subscription and meters consumption hourly as PAYG units.
• When a customer allocates credits to a tenant, the platform begins to meter that tenant's usage both as hourly PAYG units and equivalent Credit units.
• It continuously validates if the tenant's consumption exceeds the allocated credits.
• If a customer goes over their limit, the platform calculates the overage and sends PAYG metering records to the Cloud Provider’s marketplace metering service.
  Thus, the platform seamlessly switches between Software NGFW credits and an active Marketplace subscription to ensure uninterrupted service. For example, when credits expire, the tenant automatically reverts to PAYG.

Managed AIRS for AWS consumption translates to pay-as-you-go hourly pricing or as Software NGFW credits as described in the tables below.

You pay an hourly rate for each Managed AIRS resource. You also pay for the amount of traffic, billed by the gigabyte, processed by the NGFW resource.

SKU Type	Standard SKU	Premium SKU
Base Charge	$0.00 / hour (Base rate applies)	$1.50 Base + $1.50 Premium / hour (Total: $3.00 / hr) (250.0 Credits)
Traffic Tier 1 (up to 15 TB)	Included in Base (Base rate applies)	$0.065 / GB (5.4 Credits)
Traffic Tier 2 (15 TB to 30 TB)	Included in Base (Base rate applies)	$0.045 / GB (3.87 Credits)
Traffic Tier 3 (Above 30 TB)	Included in Base (Base rate applies)	$0.030 / GB (2.5 Credits)
Each Additional AZ	$0.00 / hour (Base rate applies)	$0.50 Base + $0.50 Premium / hour (Total: $1.00 / hr) (83.4 Credits)

Your security services add-on consumption is metered on each NGFW resource for each hour you have enabled the add-on and for the amount of traffic processed by that NGFW, when you configured it. The charged rate for the traffic also depends on the aggregate traffic processed by all NGFWs in the tenant during the month (referred to as tiered traffic pricing).

Threat Prevention add-on		Price (per hour)	Price (per GB)	Equivalent Cloud NGFW Credits	Equivalent Software NGFW Credit with Premium Support	Equivalent Software NGFW Credit without Premium Support
Usage Hour* (Standard)	Up to 3 AZs	$ 0.300		25.0	11.40	9.66
	Each additional AZ	$ 0.100		8.3	3.80	3.22
Usage Hour (Premium)	Up to 3 AZs	$ 0.600		50.0	22.90	19.41
	Each additional AZ	$ 0.200		16.7	7.60	6.44
Traffic Secured	First 15 TB/month		$ 0.013	1.1	0.5	0.42
	Next 15 TB/month		$ 0.009	0.7	0.3	0.25
	Above 30 TB/month		$ 0.006	0.5	0.2	0.17

Advanced Threat Prevention add-on		Price (per hour)	Price (per GB)	Equivalent Cloud NGFW Credits	Equivalent Software NGFW Credit with Premium Support	Equivalent Software NGFW Credit without Premium Support
Usage Hour* (Standard)	Up to 3 AZs	$ 0.450		37.5	17.10	14.49
	Each additional AZ	$ 0.150		0.3	5.70	4.83
Usage Hour* (Premium)	Up to 3 AZs	$ 0.900		75	34.30	29.07
	Each additional AZ	$ 0.300		25.00	11.40	9.66
Traffic Secured	First 15 TB/month		$ 0.020	1.7	0.8	0.68
	Next 15 TB/month		$ 0.014	1.2	0.5	0.42
	Above 30 TB/month		$ 0.009	0.8	0.3	0.25

Advanced DNS Security add-on		Price (per hour)	Price (per GB)	Equivalent Cloud NGFW Credits	Equivalent Software NGFW Credit with Premium Support	Equivalent Software NGFW Credit without Premium Support
Usage Hour* (Standard)	Up to 3 AZs	$ 0.450		37.5	17.10	14.49
	Each additional AZ	$ 0.1485		12.37	5.70	4.83
Usage Hour* (Premium)	Up to 3 AZs	$ 0.900		75	34.30	29.07
	Each additional AZ	$ 0.300		24.75	11.40	9.66
Traffic Secured	First 15 TB/month		$ 0.019	1.626	0.8	0.68
	Next 15 TB/month		$ 0.0135	1.125	0.5	0.42
	Above 30 TB/month		$ 0.009	0.75	0.3	0.25

Advanced WildFire add-on		Price (per hour)	Price (per GB)	Equivalent Cloud NGFW Credits	Equivalent Software NGFW Credit with Premium Support	Equivalent Software NGFW Credit without Premium Support
Usage Hour* (Standard)	Up to 3 AZs	$ 0.450		37.5	17.10	14.49
	Each additional AZ	$ 0.1485		12.375	5.70	4.83
Usage Hour* (Premium)	Up to 3 AZs	$ 0.900		75	34.30	29.07
	Each additional AZ	$ 0.300		24.75	11.40	9.66
Traffic Secured	First 15 TB/month		$ 0.0195	1.626	0.8	0.68
	Next 15 TB/month		$ 0.0135	1.125	0.5	0.42
	Above 30 TB/month		$ 0.009	0.75	0.3	0.25

Advanced URL Filtering add-on		Price (per hour)	Price (per GB)	Equivalent Cloud NGFW Credits	Equivalent Software NGFW Credit with Premium Support	Equivalent Software NGFW Credit without Premium Support
Usage Hour* (Standard)	Up to 3 AZs	$ 0.450		37.5	17.10	14.49
	Each additional AZ	$ 0.100		8.3	5.70	4.83
Usage Hour* (Premium)	Up to 3 AZs	$ 0.900		75	34.30	29.07
	Each additional AZ	$ 0.300		25.00	11.40	9.66
Traffic Secured	First 15 TB/month		$ 0.020	1.7	0.8	0.68
	Next 15 TB/month		$ 0.014	1.2	0.5	0.42
	Above 30 TB/month		$ 0.009	0.8	0.3	0.25

DLP add-on		Price (per hour)	Price (per GB)	Equivalent Cloud NGFW Credits	Equivalent Software NGFW Credit with Premium Support	Equivalent Software NGFW Credit without Premium Support
Usage Hour* (Standard)	Up to 3 AZs	$ 0.600		50.0	22.90	19.41
	Each additional AZ	$ 0.200		16.7	7.60	6.44
Usage Hour* (Premium)	Up to 3 AZs	$ 1.200		100	45.70	38.73
	Each additional AZ	$ 0.400		33.3	15.20	12.88
Traffic Secured	First 15 TB/month		$ 0.026	2.2	1	0.85
	Next 15 TB/month		$ 0.018	1.5	0.7	0.59
	Above 30 TB/month		$ 0.012	1.0	0.5	0.42

You can use a Strata Cloud Manager to manage policy rules in your Managed AIRS resources. In that case, your centralized management add-on consumption is metered on each NGFW resource for each hour you have associated with a Strata Cloud Manager and for the amount of traffic processed by that NGFW resource, when you configured it. The rate you’re charged for the traffic also depends on the aggregate traffic processed by all NGFWs in the tenant during the month (referred to as tiered traffic pricing).

Palo Alto Networks Centralized Management add-on (Strata Cloud Manager)		Price (per hour)	Price (per GB)	Equivalent Cloud NGFW Credits	Equivalent Software NGFW Credit with Premium Support	Equivalent Software NGFW Credit without Premium Support
Usage Hour (Standard)	Up to 3 AZs	$ 0.450		37.0	17.10	14.49
	Each additional AZ	$ 0.150		12.5	5.70	4.83
Usage Hour (Premium)	Up to 3 AZs	$ 0.900		75.0	34.30	29.07
	Each additional AZ	$ 0.300		25.0	11.40	9.66
Traffic Secured	First 15 TB/month		$ 0.020	1.1	0.80	0.68
	Next 15 TB/month		$ 0.014	1.2	0.50	0.42
	Above 30 TB/month		$ 0.009	0.8	0.34	0.29

You can configure public IP addresses for the Managed AIRS resource using one of two methods. You can configure the Managed AIRS resource to use Palo Alto Networks managed AWS Elastic IP Address (EIP) addresses to perform source NAT for your VPC traffic. In this case, you will pay Palo Alto Networks for the hourly EIP management costs. Alternatively, you can transfer your BYOIPs to the Managed AIRS from your AWS account to avoid the hourly EIP management costs. For more information, see BYOIPs with AWS IPAM.

Managed AIRS uses the AWS SaaS subscription pricing model by translating the tenant’s consumption into Units across multiple Custom dimensions and reporting it to AWS Marketplace, as shown in the table below. This mechanism provides the flexibility to aggregate your entire tenant’s consumption based on a few dimensions. These dimensions include the deployment hours of all NGFWs, the amount of traffic they secure, and the number of security features they use per hour. The Managed AIRS translates Software NGFW credits and reports them as add-on units to the AWS Metering service.