AWS Firewall Manager handles three types of protection policies - AWS WAF, AWS Shield and Amazon VPC security groups. AWS Firewall Manager protection policies are priced with a monthly fee per Region.

For AWS WAF protection policies, AWS Firewall Manager has these main pricing components:

• AWS Firewall Manager protection policy - Monthly fee per Region.

• AWS WAF WebACLs or Rules - Those created by Firewall Manager will be charged based on current pricing. For more details, see AWS WAF pricing.

• AWS Config Rules - Those rules created by Firewall Manager to monitor changes in resource configurations are charged based on current pricing. For more details, see AWS Config pricing.

If you are an AWS Shield Advanced customer:

For AWS Shield Advanced customers, AWS Firewall Manager protection policy is included at no additional charge. Shield Advanced customers will be charged for the AWS Config rules created to monitor any changes in resource configurations. For more details, check the AWS Shield pricing and AWS Config pricing.

AWS Shield protection policies can be created using AWS Firewall Manager only for Shield Advanced users. The price is included in the AWS Shield Advanced subscription at no additional cost. In addition, the pricing components are as follows:

• AWS Shield Advanced Data Transfer Out Usage Fees: For more details, see AWS Shield pricing

• AWS Config Rules - Those rules created by Firewall Manager to monitor changes in resource configurations are charged based on current pricing. For more details, see AWS Config pricing

For Amazon VPC security group protection policies, AWS Firewall Manager has these main pricing components:

• AWS Firewall Manager protection policy - Monthly fee per Region.

• AWS Config Rules - Those rules created by Firewall Manager to monitor changes in resource configurations are charged based on current pricing. For more details, see AWS Config pricing.

You only pay for what you use, as you use it; there are no minimum fees and no upfront commitments.

AWS Firewall Manager pricing for customers

AWS WAF protection policy


All public regions
Global (Amazon CloudFront locations)

AWS Shield Advanced


All public regions
Included. No charge per policy per Region
Global (Amazon CloudFront locations)
Included. No charge per policy per Region

AWS Shield Advanced protection policy


All public regions

Included for Shield Advanced customers. No charge per policy per Region

Global (Amazon CloudFront locations)

Included for Shield Advanced customers. No charge per policy per Region

  • AWS WAF WebACLs or Rules created by Firewall Manager - Included. No additional charge.
  • AWS Config rules created by Firewall Manager - See AWS Config pricing
  • AWS Shield Advanced - See AWS Shield pricing

Amazon VPC security group protection policy


All public regions

$100 per policy per Region

Global (Amazon CloudFront locations)

$100 per policy per Region

AWS Shield Advanced


All public regions

$100 per policy per Region

Global (Amazon CloudFront locations)

$100 per policy per Region

AWS WAF

Pricing example 1: AWS Firewall Manager policy with 1 account

Let’s assume you created a new protection policy for an Organization not subscribed to Shield Advanced with 1 AWS Account.

  • AWS Firewall Manager charges $100 per month for the policy.
  • In addition, AWS Firewall Manager creates two AWS Config rules per policy, per account. Let's assume that there are 100 configuration item (CI) changes across all resources per month, for a total of $0.30 (100 x $0.003) per month. In addition, let's assume there are 100 rule evaluations, resulting in $0.10 (100 x $0.001, where the first 100,000 evaluations are $0.001 each). The total AWS Config charges will be $0.40 per month ($0.30 + $0.10).
  • AWS Firewall Manager also creates a single AWS WAF WebACL and Rule, at a cost of $5 per WebACL per month and $1 per Rule per month.
  • At the end of the month your total charges will be $106.40 ($100 for AWS Firewall Manager, $0.40 for AWS Config and $6 for AWS WAF).
Item Qty Accounts $/month Monthly total
Protection Policy 1 1 $100.00 $100.00
AWS Config Configuration Item 100 1 $0.0030 $0.30
AWS Config rule evaluations 100 1 $0.001 $0.10
WAF WebACL 1 1 $5.00 $5.00
WAF Rule 1 1 $1.00 $1.00
Total       $106.40 per month

Pricing example 2: AWS Firewall Manager policy with 7 accounts

Let's assume you created a new protection policy for an Organization not subscribed to Shield Advanced with 7 AWS Accounts.

  • AWS Firewall Manager charges are $100 per month for (1) policy.
  • In addition, AWS Firewall Manager creates (2) AWS Config rules per policy, per account. Let's assume there are a total of 10,000 Config item changes across all accounts, accounting for $30 (10,000 x $0.003). In addition, let's assume there are 10,000 rule evaluations, resulting in $10 (10,000 x $0.001, where the first 10,000 evaluations are $0.001 each).
  • The total AWS Config charges are $40 per month ($30 + $10).
  • AWS Firewall Manager creates one AWS WAF WebACL and one Rule per account. Each WebACL costs $5 per month and Each Rule costs $1 per month, for a total of $42 per month = ($5 WebACL + $1 Rule) X 7 Accounts.
  • At the end of the month your charges will be a total of $182 ($100 for AWS Firewall Manager + $40 for AWS Config + $42 for AWS WAF).
Item Qty Accounts $/month Monthly total
Protection Policy 1 N/A
$100.00 $100.00
AWS Config Configuration Item 10,000 7
$0.0030 $30.00
AWS Config rule evaluations 10,000 7 $0.0010 $10.00
WebACL 1 7
$5.00 $35.00
WAF Rule 1 7
$1.00 $7.00
Total       $182.00 per month

Pricing example 3: AWS Firewall Manager policy with 7 accounts, with Shield Advanced

Let's assume the same scenario as example 2, and in addition you have subscribed to Shield Advanced. For more details, see AWS Shield pricing.

  • In that case, AWS Firewall Manager charges are $0 per month.
  • Further, your charges for AWS WAF are $0 per month.
  • In addition, AWS Firewall Manger creates (2) AWS Config rules per policy, per account. Let's assume there are a total of 10,000 Config item changes across all accounts, accounting for $30 (10,000 x $0.003). In addition, let's assume there are 10,000 rule evaluations, resulting in $10 (10,000 x $0.001, where the first 100,000 evaluations are $0.001 each). Your charges for the AWS Config rules are $40 per month.
  • So, at the end of the month, your total monthly charges will be $40.
Item Qty Accounts $/month Monthly total
Protection Policy 1 N/A
$0.00 $0.00
AWS Config Configuration Item 10,000 7
$0.0030 $30.00
AWS Config rule evaluations 10,000 7 $0.0010 $10.00
WebACL 1 7
$0.00 $0.00
WAF Rule 1 7
$0.00 $0.00
Total       $40.00 per month

VPC Security Groups

Pricing example 4: AWS Firewall Manager Policy with 10 Accounts and not subscribed to Shield Advanced

Let’s assume you created a new FMS common policy that creates VPC Security Groups to secure EC2 instances across 10 AWS Accounts in your Organization. You are not subscribed to Shield Advanced.

  • AWS Firewall Manager charges $100 per month for the policy.
  • In addition, AWS Firewall Manager creates two AWS Config rules per policy, per account. Let’s assume that there are 100 configuration item (CI) changes across all resources per month, for a total of $0.30 (=100 * $0.003) per month. In addition, let’s assume there are 100 rule evaluations, resulting in $0.10 (=100 * $0.001, where the first 100,000 evaluations are $0.001 each.) The total AWS Config charges will be $0.40 per month ($0.3 + $0.1).
  • At the end of the month your total charges will be $100.40 ($100 for AWS Firewall Manager and $0.4 for AWS Config).
Item Qty Accounts $/month Monthly total
Protection Policy 1 10 $100.00 $100.00
AWS Config Configuration Item  100 10 $0.0030 $0.30
AWS Config rule evaluations 100 10 $0.001 $0.10
Total       $100.40 per month

Pricing example 5: AWS Firewall Manager Policy with 10 Accounts and subscribed to Shield Advanced

Let’s assume you created a new FMS audit policy that audits VPC Security Groups on EC2 instances across 10 AWS Accounts in your Organization. You are subscribed to Shield Advanced.

  • AWS Firewall Manager charges $100 per month for the policy.
  • In addition, AWS Firewall Manager creates two AWS Config rules per policy, per account. Let’s assume that there are 100 configuration item (CI) changes across all resources per month, for a total of $0.30 (=100 * $0.003) per month. In addition, let’s assume there are 100 rule evaluations, resulting in $0.10 (=100 * $0.001, where the first 100,000 evaluations are $0.001 each.) The total AWS Config charges will be $0.40 per month ($0.3 + $0.1).
  • At the end of the month your total charges will be $100.40 ($100 for AWS Firewall Manager and $0.4 for AWS Config).
Item Qty Accounts $/month Monthly total
Protection Policy 1 10 $100.00 $100.00
AWS Config Configuration Item  100 10 $0.0030 $0.30
AWS Config rule evaluations 100 10 $0.001 $0.10
Total       $100.40 per month

Additional pricing resources

TCO Calculator

Calculate your total cost of ownership (TCO)

Simple Monthly Calculator

Easily calculate your monthly costs with AWS

Economics Resource Center

Additional resources for switching to AWS

Read the Firewall Manager documentation
Learn more about Firewall Manager

Learn more about AWS Firewall Manager by reading the documentation.

Read documentation 
Sign up for an AWS account
Sign up for a free account

Instantly get access to the AWS Free Tier. 

Sign up 
Start building with Firewall Manager in the console
Start building in the console

Get started building with AWS Firewall Manager in the console.

Sign in