# AWS Network Firewall

> AWS Network Firewall bills an endpoint-hour fee for every firewall endpoint in every availability zone, plus a per-GB charge on traffic processed. ZopNight discovers firewalls on its 6-hour sweep, attributes endpoint and processing cost from Cost Explorer or CUR 2.0, and surfaces endpoints inspecting little or no traffic.

Source: https://zop.dev/integrations/aws/network-firewall
Updated: 2026-08-19

---

AWS Network Firewall provides managed network traffic inspection at VPC boundaries, billed per firewall endpoint-hour plus per GB processed. Endpoint-hour charges accrue continuously in every AZ where a firewall endpoint exists.

## Per-endpoint, per-AZ, per-hour

The dominant meter is the firewall endpoint: each one bills hourly, and a firewall deployed across three availability zones runs three of them around the clock. Traffic processing adds a per-GB charge on top. The multiplication is what surprises teams. The AZ spread that makes the firewall resilient also triples its fixed floor, and that floor accrues identically whether the endpoints inspect production traffic or sit in a VPC nothing routes through anymore.

## ZopNight's view of a firewall deployment

Firewalls enter inventory on the 6-hour discovery cycle, with cost attributed per firewall from Cost Explorer or CUR 2.0. Endpoint utilization recommendations compare what the endpoints cost against what they process: a firewall whose processed bytes sit near zero is either mis-routed or protecting a dead environment, and its endpoint-hours are recoverable in full. Firewalls have no stop or suspend action, so ZopNight treats this as visibility and recommendation territory, not scheduling.

## Inspection spend that outlives its purpose

The recurring waste shapes: a firewall stood up for a compliance initiative in a VPC that was later drained, still billing per endpoint per AZ; multi-AZ endpoint spread in development VPCs, where a single-AZ deployment would carry the same test traffic; and route tables changed during an incident or redesign so traffic bypasses the firewall entirely, leaving the endpoints billing while inspecting nothing, which is both a cost and a security finding.

## Where firewalls live in the console

The VPC console hosts Network Firewall under its own section; the Firewalls view lists each firewall with its VPC, and the firewall's details show endpoint IDs per availability zone. Pair that with route tables to verify traffic actually traverses the endpoints, and with CloudWatch's processed-bytes metrics to judge whether the inspection is real.