コンテンツにスキップ

Cost Considerations and Reference

Prerequisites

This section assumes familiarity with Core concepts, Ingress Patterns, and Egress Patterns. Review those pages first for architectural context.

AWS network security costs range from zero (security groups, network ACLs, VPC gateway endpoints, AWS Shield Standard) through fractions of a cent per million queries (Amazon Route 53 Resolver DNS Firewall) to per-endpoint-hour plus per-GB charges (AWS Network Firewall). A layered approach that starts with no-cost controls and adds paid services only where they provide clear value for the risk level produces the most cost-effective architecture.

Layered defense summary

A well-architected AWS environment uses multiple services together. Each layer catches what the others miss:

Layer Service What it catches
Traffic elimination VPC endpoints + endpoint policies Removes AWS API traffic from egress path; prevents exfiltration to unauthorized buckets
DNS DNS Firewall (+ Advanced) Known-bad domains, DNS tunneling, DGAs
Network (instance) security groups Unauthorized ports/protocols/sources per resource
Network (subnet) network ACLs Broad deny patterns, emergency IP blocking
Network (VPC) AWS Network Firewall IPS/IDS, domain validation via SNI, hardcoded-IP connections, protocol violations
Application (L7) AWS WAF SQL injection, XSS, bots, L7 DDoS, rate limiting
DDoS AWS Shield Standard/Advanced Volumetric and protocol-level DDoS
Management AWS Firewall Manager Consistent policy enforcement across all accounts
Application auth Amazon VPC Lattice Identity-based service-to-service access control

Cost comparison

Each service has a different pricing model. Costs vary by Region; refer to the pricing pages for current numbers.

Service Pricing model Pricing page
security groups No additional cost N/A
network ACLs No additional cost N/A
VPC endpoints (gateway) No additional cost N/A
VPC endpoints (interface) Per hour per AZ + per GB processed PrivateLink Pricing
DNS Firewall Per million DNS queries processed Route 53 Pricing
AWS WAF Per web ACL + per rule + per million requests AWS WAF Pricing
AWS Network Firewall Per endpoint-hour + per GB processed Network Firewall Pricing
AWS Shield Standard No additional cost N/A
AWS Shield Advanced Monthly subscription + data transfer Shield Pricing
AWS Firewall Manager Per policy per Region Firewall Manager Pricing

Cost optimization approach

Start with no-cost controls (security groups, network ACLs, VPC gateway endpoints, Shield Standard). Add DNS Firewall as the lowest-cost paid egress control. Add AWS WAF for web applications. Add Network Firewall where deep inspection provides clear value for the risk level. The layered approach means you are not paying for Network Firewall to inspect traffic that cheaper controls could have already blocked or eliminated.

Network Firewall + NAT gateway pricing discount

When Network Firewall and a NAT gateway are deployed together in the same Availability Zone (with traffic flowing through Network Firewall before NAT), NAT gateway data processing charges are waived (1:1 discount). This applies to zonal NAT gateways only. The discount does NOT apply to regional NAT gateways. Factor this into your deployment model decision.

Centralized policy management

Best practice

Deploy AWS Firewall Manager to enforce your network security policy consistently across your AWS organization. Firewall Manager automatically deploys AWS WAF, Network Firewall, DNS Firewall, and Shield Advanced policies to every account that meets your scope conditions, remediates non-compliant resources, and alerts on new out-of-scope deployments. Firewall Manager's strength is distributed deployments: the more your firewalls are spread across many accounts and VPCs, the more value it adds. For centralized deployments with a single shared firewall, infrastructure as code often suffices for policy management.

Next steps

Dive deeper into individual service best practices:

For security-specific networking guidance:

For the full networking context: