AWS Firewall Manager Pricing Calculator - Policy and Downstream Costs
Estimate AWS Firewall Manager policy fees by Region and policy family, including Shield Advanced inclusion and optional AWS Config, WAF, Network Firewall, and DNS Firewall charges.
Frequently Asked Questions
How is AWS Firewall Manager priced?
Firewall Manager charges a monthly fee for each protection policy. The rate depends on the AWS Region and policy family. Account count does not multiply the policy fee, but it can increase the resources and usage billed by AWS Config and the managed firewall service.
Is Firewall Manager included with Shield Advanced?
Yes, for Shield Advanced and AWS WAF policies. The calculator shows that inclusion as a verified state. Other policy families still use their published Firewall Manager rate when you have a Shield Advanced subscription. The Shield Advanced subscription fee and data transfer charges are excluded.
What dependent charges can the calculator include?
The optional estimate supports AWS Config configuration-item changes and rule evaluations, WAF web ACLs, rules and requests, Network Firewall endpoints and traffic, and Route 53 Resolver DNS Firewall resources and queries. Account count multiplies per-account resource inputs, while DNS Firewall domain names remain an organization-wide total.
Which AWS Config recording mode should I choose?
Choose continuous when AWS Config records each resource change. Choose periodic when it records the latest state on a schedule. AWS publishes separate configuration-item rates for these modes, so the selection can change the Config subtotal.
Are third-party firewall Marketplace charges included?
No. The calculator can price the published Firewall Manager policy fee for supported Fortinet and Palo Alto policy types, but it excludes Marketplace software and infrastructure charges.
What costs are excluded from this Firewall Manager estimate?
The estimate excludes third-party Marketplace software and infrastructure, WAF managed rule groups and advanced protections, Network Firewall NAT and cross-AZ transfer, unrelated Route 53 features, support, taxes, credits, private pricing, and negotiated discounts.
Related tools
CloudBurn
Catch AWS cost mistakes before they ship.
scan against Terraform and CloudFormation before deploy, then run discover against live AWS to find the waste that is already burning.Read the docs to learn how it works.