Cloud NGFW is available as a pay-as-you-go (PAYG) subscription in the AWS Marketplace. With this model, you pay only for what you use each month, with all charges consolidated on the invoice you receive from AWS. You can also enjoy the AWS Marketplace benefits such as consolidated billing Amazon Web Services Enterprise Discount Program (EDP).

You pay an hourly rate for each Cloud NGFW resource. You also pay for the amount of traffic, billed by the gigabyte, processed by the NGFW resource. Additionally, you pay an hourly rate and for the amount of traffic processed by your Cloud NGFW resource when you configure security services add-ons (such as Threat Prevention, Advanced URL Filtering, DNS Security, or WildFire) or the centralized management add-on (Panorama management). The rate charged for the traffic also depends on the aggregate traffic processed by all NGFWs in the tenant during the month (referred to as tiered traffic pricing).

You can procure and associate Cloud NGFW for AWS Credits to your tenant by paying an upfront cost for a long-term contract of one, two, or three years. You purchase these credits while taking advantage of AWS Marketplace benefits such as consolidated billing, AWS EDP, and automated or configurable renewals. Cloud NGFW credits allow you to consume Cloud NGFW resources in your tenant at a lower cost up to a specific capacity until your contract expires. See Subscribe to Cloud NGFW for AWS to learn how to add contract credits.

Cloud NGFW consumption translates to pay-as-you-go hourly pricing or as Cloud NGFW credits as described in the tables below.

You pay an hourly rate for each Cloud NGFW resource. You also pay for the amount of traffic, billed by the gigabyte, processed by the NGFW resource.

Base NGFW Resource		Price (per hour)	Price (per GB)	Equivalent Cloud NGFW Credits
Usage Hour	Up to 3 AZs	$ 1.50		125.0
	Each additional AZ	$ 0.50		41.7
Traffic Secured	First 15 TB/month		$ 0.065	5.4
	Next 15 TB/month		$ 0.045	3.7
	Above 30 TB/month		$ 0.030	2.5

Your security services add-on consumption is metered on each NGFW resource for each hour you have enabled the add-on and for the amount of traffic processed by that NGFW, when you configured it. The charged rate for the traffic also depends on the aggregate traffic processed by all NGFWs in the tenant during the month (referred to as tiered traffic pricing).

Threat Prevention add-on		Price (per hour)	Price (per GB)	Equivalent Cloud NGFW Credits
Usage Hour*	Up to 3 AZs	$ 0.300		25.0
	Each additional AZ	$ 0.100		8.3
Traffic Secured	First 15 TB/month		$ 0.013	1.1
	Next 15 TB/month		$ 0.009	0.7
	Above 30 TB/month		$ 0.006	0.5

Advanced Threat Prevention add-on		Price (per hour)	Price (per GB)	Equivalent Cloud NGFW Credits
Usage Hour*	Up to 3 AZs	$ 0.450		0.8
	Each additional AZ	$ 0.150		0.3
Traffic Secured	First 15 TB/month		$ 0.020	1.7
	Next 15 TB/month		$ 0.014	1.2
	Above 30 TB/month		$ 0.009	0.7

DNS Security add-on		Price (per hour)	Price (per GB)	Equivalent Cloud NGFW Credits
Usage Hour*	Up to 3 AZs	$ 0.300		25.0
	Each additional AZ	$ 0.100		8.3
Traffic Secured	First 15 TB/month		$ 0.013	1.1
	Next 15 TB/month		$ 0.009	0.7
	Above 30 TB/month		$ 0.006	0.5

WildFire add-on		Price (per hour)	Price (per GB)	Equivalent Cloud NGFW Credits
Usage Hour*	Up to 3 AZs	$ 0.300		25.0
	Each additional AZ	$ 0.100		8.3
Traffic Secured	First 15 TB/month		$ 0.013	1.1
	Next 15 TB/month		$ 0.009	0.7
	Above 30 TB/month		$ 0.006	0.5

Advanced URL Filtering add-on		Price (per hour)	Price (per GB)	Equivalent Cloud NGFW Credits
Usage Hour*	Up to 3 AZs	$ 0.450		37.5
	Each additional AZ	$ 0.150		12.5
Traffic Secured	First 15 TB/month		$ 0.020	1.7
	Next 15 TB/month		$ 0.014	1.2
	Above 30 TB/month		$ 0.009	0.7

DLP add-on		Price (per hour)	Price (per GB)	Equivalent Cloud NGFW Credits
Usage Hour*	Up to 3 AZs	$ 0.600		50.0
	Each additional AZ	$ 0.200		16.7
Traffic Secured	First 15 TB/month		$ 0.026	2.2
	Next 15 TB/month		$ 0.018	1.5
	Above 30 TB/month		$ 0.012	1.0

You can use a Panorama virtual appliance to manage policy rules in your Cloud NGFW tenant. In that case, your centralized management add-on consumption is metered on each NGFW resource for each hour you have associated with a Panorama appliance and for the amount of traffic processed by that NGFW, when you configured it. The rate you’re charged for the traffic also depends on the aggregate traffic processed by all NGFWs in the tenant during the month (referred to as tiered traffic pricing).

Palo Alto Networks Centralized Management add-on		Price (per hour)	Price (per GB)	Equivalent Cloud NGFW Credits
Usage Hour	Up to 3 AZs	$ 0.300		25.0
	Each additional AZ	$ 0.100		8.3
Traffic Secured	First 15 TB/month		$ 0.013	1.1
	Next 15 TB/month		$ 0.009	0.7
	Above 30 TB/month		$ 0.006	0.5

Cloud NGFW uses the AWS SaaS subscription pricing model by translating the tenant’s consumption as Units for multiple Custom dimensions and reports it to AWS Marketplace as shown in the table below. This mechanism provides the flexibility to aggregate your entire tenant’s consumption based on a few dimensions. These dimensions include the deployment hours of all NGFWs, how much traffic they are securing, and how many security features they use every hour. Cloud NGFW translates the security services and centralized management consumption to Cloud NGFW credits and reports it as add-on units to the AWS Metering service.