The pay-as-you-go edition of Cloud Firewall uses a post-paid billing method. You can pair it with a prepaid Pay-as-you-go Savings Plan to reduce costs.
Starting October 15, 2025, the billable items for Cloud Firewall will be updated to Billing 2.0. New users use Billing 2.0 by default. Existing users can continue to use Billing 1.0 and can choose to upgrade to Billing 2.0. For more information about the pricing changes in Billing 1.0 and how to upgrade to Billing 2.0, see Billing 1.0 and upgrade instructions.
You can enable the pay-as-you-go edition of Cloud Firewall on demand without a large upfront commitment. Charges are based on the number of firewall instances and the traffic they process. This billing method is suitable for the following scenarios:
Your business has flexible needs, with usage that changes frequently or is temporary or bursty.
You are a small or medium-sized enterprise with low traffic, which makes this a more cost-effective option.
The pay-as-you-go edition of Cloud Firewall provides the following capabilities:
Automatic discovery of cloud assets and one-click protection.
The Internet Firewall can automatically discover public assets on the cloud and protect them within seconds. These assets include ECS public IP addresses, Classic Load Balancer (CLB) public IP addresses, Application Load Balancer (ALB), Network Load Balancer (NLB), Elastic IP Address (EIP) (including L2 EIPs), elastic network interface (ENI), and HaVip. Both IPv4 and IPv6 assets are supported.
The NAT Firewall supports automatic protection for private assets that access the internet through a public NAT Gateway.
The VPC Firewall supports automatic protection for private assets across Virtual Private Cloud (VPC) networks.
Real-time defense against inbound and outbound network attacks. These attacks include web attacks, brute-force attacks, database attacks, cryptojacking trojans, viruses and worms, command execution, reverse shells, and malicious outbound connections. The service also supports virtual patching, threat intelligence, and breach detection.
Granular Layer 4 to Layer 7 access control for business domain isolation. It supports access control for public and private traffic across internet, NAT, and VPC boundaries. This includes network isolation ACL policies based on IP addresses, domain names, applications, protocols, ports, and geographic locations.
Network traffic analysis and visualization. You can identify active outbound connections, public exposure risks, private outbound connections, and trends and anomalies in traffic between VPCs.
Log auditing and 180-day log analysis. This allows you to quickly trace attack traffic, perform unified analysis, and meet compliance requirements.
To learn more, see the Use cases, Feature comparison by edition, and Supported regions for the pay-as-you-go edition of Cloud Firewall.
Billing
The fees for the pay-as-you-go edition of Cloud Firewall consist of an instance fee, a Firewall traffic processing fee, and a feature fee. The system calculates and deducts the fees for the previous day from your account on the following day.
The pay-as-you-go edition of Cloud Firewall is billed hourly, and any usage for less than a full hour is counted as a full hour. For example, usage from 15:55 to 16:05 spans two separate hours and is billed as two hours.
If your account balance is insufficient and your payment is overdue for more than 15 consecutive days, Cloud Firewall automatically releases your pay-as-you-go instance. If you do not protect any assets for more than 30 days, Cloud Firewall automatically disables the corresponding firewall modules.
Billing item | Unit price | Description |
Instance fee | $0.36/instance/hour | This fee applies to each Cloud Firewall instance created and includes all boundary firewall types. The number of instances is calculated as follows:
|
Firewall traffic processing fee | $0.06/GB | This fee is based on the total traffic from all three boundary firewalls. The maximum supported peak bandwidth is 10 Gbps. To request a higher limit, contact your sales manager or architect. |
Access control | Free (up to 10,000 policies) | Firewall access control. For a higher quota, upgrade to a subscription edition or contact your sales manager. |
Sensitive data leak prevention |
|
|
Synchronization node | Free | You can configure up to 5 ACK and 5 DNS synchronization nodes. |
Threat intelligence (IPS) | $0.36/hour | You can enable the threat intelligence capability on demand as needed. |
Log Analysis | $0.3/TB/hour | Charged based on the selected Log Analysis storage capacity. The minimum capacity is 1 TB. |
If a Cloud Firewall instance has no protected assets and incurs no fees for 30 consecutive days, the instance is automatically released, clearing all historical alert data and configurations.
The pay-as-you-go edition of Cloud Firewall automatically synchronizes asset information and detects asset protection status in real time. The system sends you a notification if it detects that your Cloud Firewall is not protecting any assets for 1 to 30 consecutive days.
If no assets are protected for more than 30 days, Cloud Firewall automatically disables the corresponding Internet Firewall, NAT Firewall, or VPC Firewall modules. Other related modules revert to their initial state. You can re-enable these modules when you need them.
Billing examples
Scenario | Hourly cost |
You enable the pay-as-you-go edition of Cloud Firewall but do not enable any other features or protect any assets. | Free |
You enable the pay-as-you-go edition of Cloud Firewall and have one firewall instance protecting a group of IP assets in the same region with the Internet Firewall. The total inbound and outbound traffic processed by the firewall is about 1 GB per hour. | 1 * $0.36 + 1 GB * $0.06/GB = $0.42 |
Enable pay-as-you-go edition
Go to the Cloud Firewall purchase page, and set Product Type to Pay-As-You-Go 2.0. Configure the following parameters.
Automatic Protection for Assets: Choose whether to enable automatic protection for your assets.
If you enable Automatic Protection for Assets, Cloud Firewall automatically protects your public assets after you enable the pay-as-you-go edition of Cloud Firewall. This includes turning on the firewall switch and attack protection to reduce the security risks to your public assets.
NoteAfter you enable this feature, if you no longer need automatic asset protection, you can go to the Cloud Firewall console and turn off the Automatic Protection for New Assets switch. For detailed instructions, see Internet Firewall.
Log Analysis: Choose whether to enable the Log Analysis feature. By default, Cloud Firewall stores audit logs for the last 7 days. Enable this feature if you need to store logs for a longer period, meet compliance requirements, or export logs. Log Analysis allows you to customize the storage period from 7 to 730 days.
Read and agree to the Cloud Firewall (pay-as-you-go) Service Agreement, then click Buy Now and complete the payment.
After you enable the pay-as-you-go edition of Cloud Firewall, Alibaba Cloud settles your bill for the previous day's usage on the following day.
After you enable the pay-as-you-go edition of the firewall, you can enable the NAT Firewall and VPC Firewall based on your business needs.
Enable NAT Firewall
Log on to the Cloud Firewall console. In the left-side navigation pane, click Firewall.
On the NAT Firewall tab, click Enable Now.
If you enable the NAT Firewall but do not create a NAT firewall within 30 days, Cloud Firewall automatically disables the module. You can re-enable it when needed. We recommend that you protect your assets immediately after enabling the firewall. The initial asset synchronization takes 1 to 5 minutes.
Enable VPC Firewall
Log on to the Cloud Firewall console. In the left-side navigation pane, click Firewall.
On the VPC Firewall tab, click Enable Now.
If you enable the VPC Firewall but do not create a VPC firewall within 30 days, Cloud Firewall automatically disables the module. You can re-enable it when needed. We recommend that you protect your assets immediately after enabling the firewall. The initial asset synchronization takes 1 to 5 minutes.
View traffic usage details
The pay-as-you-go edition of Cloud Firewall is billed hourly. The system calculates and settles the fees for the previous day on the next day. You can view your billing details to understand your pay-as-you-go charges.
Log on to the Cloud Firewall console.
In the left-side navigation pane, choose .
On the Bill Management page, view the pay-as-you-go traffic usage details, including the Instance Fee, Traffic Processing Fee, and Feature Fee.
Click View Details to see an itemized bill. For more information, see View billing details.
Use a Pay-as-you-go Savings Plan
When you purchase the pay-as-you-go edition of Cloud Firewall, you can use it with a Pay-as-you-go Savings Plan to reduce your costs. The Cloud Firewall Pay-as-you-go Savings Plan is a prepaid plan that works like a stored-value card. You can add funds based on your pay-as-you-go consumption, starting from $10. After purchase, the system automatically uses the savings plan to offset all pay-as-you-go billing items at a discount. For example, if you purchase a $20 plan, in addition to any promotional or business discounts at the time of purchase, all pay-as-you-go billing items also receive a 5% discount (95% of the list price). You can purchase multiple plans as needed. For more information, see Pay-as-you-go Savings Plan.
Log on to the Cloud Firewall console.
In the left-side navigation pane, click .
In the right-side area of the Overview page, click PAYG Savings Plan.
In the PAYG Savings Plan panel, purchase a plan based on your needs. For detailed instructions, see Pay-as-you-go Savings Plan.
A Cloud Firewall Pay-as-you-go Savings Plan is a discount program. By committing to a specific spending amount over time, you receive a lower pay-as-you-go rate. The larger your commitment, the greater the discount and the more you save.
Convert to subscription
You can switch Cloud Firewall from pay-as-you-go to subscription based on your business needs.
Release the pay-as-you-go edition
If you no longer need the pay-as-you-go edition of Cloud Firewall, you can turn off the firewall switches on the Internet Firewall, NAT Firewall, and VPC Firewall tabs. Then, in the upper-right corner of the Overview page, click .
FAQ
Why do I still receive bills for a pay-as-you-go instance when Cloud Firewall is not in use?
Features such as log analysis, threat intelligence (Intrusion Prevention System (IPS)), and Sensitive Data Leak Detection are billed separately from the border firewall.
To stop all billing, Log on to the Cloud Firewall console. on the Overview page, go to the upper-right corner and select . After you release the instance, the system generates a final bill on the next day (T+1). This bill includes all charges up to the point of release. No new bills are generated afterward.
Why do I still receive a bill after releasing a pay-as-you-go instance?
You may receive a bill after releasing a pay-as-you-go instance for the following reasons:
Delayed billing: Pay-as-you-go instances are billed daily. After you release an instance, the system generates a bill on the next day (T+1). This bill includes charges incurred before the release. No new bills are generated after this.
Late instance release: If you do not manually release an instance after its free trial or savings plan expires, you will continue to be billed for the service at the standard rate.
Incorrect service termination: Disabling border firewall protection does not stop billing. To stop billing completely, Log on to the Cloud Firewall console. on the Overview page, in the upper-right corner, select .
Which is more expensive for traffic fees: pay-as-you-go or subscription Cloud Firewall?
The cost of each billing method depends on your service traffic and usage period. Consider the following scenarios:
Subscription: This method is best for services with high, stable traffic over a long period. You pay upfront to reserve resources. This results in a lower cost to process each unit of traffic and a lower overall cost.
Pay-as-you-go: This method is best for services with low or fluctuating traffic, or for services in a testing phase. You are billed only for the traffic you use, which prevents paying for idle resources. You can also combine this method with pay-as-you-go savings plans. These plans offer a discount in exchange for a spending commitment over a specific period, providing both flexibility and cost optimization.
Recommendation: For stable, long-term production environments, choose the subscription method to save costs. For short-term testing or for scenarios with unpredictable traffic, choose the pay-as-you-go method. Combine this method with a pay-as-you-go savings plan to further reduce costs.
Can I use a whitelist to exempt traffic from specific client IP addresses from billing?
No, you cannot.