AWS Network Security Manager: Regions and Cost Checks

The Nov 11 GA announcement is not a current total

On 2026-11-11, AWS announced general availability (GA) of AWS Network Security Manager in AWS European Sovereign Cloud Region and 31 additional AWS Regions. The announcement specifically names support for AWS WAF and AWS Shield in European Sovereign Cloud. AWS describes centralized policy management, configuration-drift detection, and remediation across targeted accounts and resources as product capabilities. Those are vendor claims; this article did not access an AWS account, deploy the service, or verify remediation.

The 31 Regions are the additions named in that announcement, not the service's complete current regional footprint.

Check current availability by Region ID

The AWS Regional Services JSON snapshot saved at 17:39 UTC on 2026-11-12 returned 33 exact-name rows for AWS Network Security Manager, including eusc-de-east-1. The snapshot's 33 rows and the announcement's 31 additional Regions use different counts; do not rewrite the matrix as 33 newly added Regions.

Asia Pacific Region IDs in the matrix: ap-east-1, ap-east-2, ap-northeast-1, ap-northeast-2, ap-northeast-3, ap-south-1, ap-south-2, ap-southeast-1, ap-southeast-2, ap-southeast-3, ap-southeast-4, ap-southeast-5, ap-southeast-6, ap-southeast-7.

European standard Regions and European Sovereign Cloud Region IDs in the matrix: eu-central-1, eu-central-2, eu-north-1, eu-south-1, eu-south-2, eu-west-1, eu-west-2, eu-west-3, eusc-de-east-1.

Americas Region IDs in the matrix: ca-central-1, ca-west-1, mx-central-1, sa-east-1, us-east-1, us-east-2, us-west-1, us-west-2.

Africa Region IDs in the matrix: af-south-1.

Israel Region IDs in the matrix: il-central-1.

For a specific environment, search the latest regional-services table for the target AWS Region ID and record when you checked it.

A service row says that the regional table lists the service as available. It does not show that a particular account has enabled it, that a resource is protected, or that every Region has identical feature coverage. The team responsible for the environment must confirm its actual account and resource state separately.

Separate the billing unit for each environment

The standard AWS pricing page charges hourly for Network Security Manager use per account and Region where policies are created. The European Sovereign Cloud page instead says per payer account and Region. The pages do not establish that account and payer account are equivalent or document how every organization's billing is consolidated.

Both pages describe protected-asset charges by asset, Region, and protecting firewall per hour, and list Application Load Balancers, API Gateways, and CloudFront distributions as asset types. Pricing example 3 has two ALBs protected by both WAF and Shield Advanced; its table has two asset-charge rows, each with a quantity of two. Count asset-to-protection associations rather than only unique ALBs. Charges for the underlying AWS WAF or Shield Advanced service are separate.

The pages state that there are no minimum fees or upfront commitments, but deploying a firewall protection creates charges. That does not mean the service is free. List Network Security Manager usage, protected-asset charges, and the underlying security-service charges separately in a budget.

Build a budget from accounts, Regions, hours, and protections

First group the workload by standard Region and European Sovereign Cloud Region. For each Region, record the relevant billing-unit count: accounts for standard Regions and payer accounts for European Sovereign Cloud. Do not merge them into one undifferentiated account count.

Next estimate the hours that policies and protections will be active, then list the assets protected by each firewall in each Region. AWS's full-month examples use 30 days, or 720 hours; use your own expected duration and the rates that apply to the target Region.

The standard-region page gives an example with one account, one Region, and one WAF WebACL protecting four ALBs: Network Security Manager usage is $0.35 per hour, and four asset associations are $0.004 per hour each. For 720 hours, the example totals $263.52 ($252.00 usage plus $11.52 for assets). This is a specific published example, not a quote for every Region, account, or design, and it excludes underlying WAF/Shield charges.

The European Sovereign Cloud page's example contains a discrepancy that should be preserved: its prose gives the hourly usage charge as €0.300, while its table lists €0.3004. In example 1, the prose states €216 in usage, while the table lists €216.25; both show €9.88 in asset charges and a €226.13 total. Do not silently reconcile these figures or apply one total to every customer. For a budget or committed quote, check the current European Sovereign Cloud pricing page against the actual payer account and Region, and ask AWS to clarify any ambiguity.

Keep availability separate from account, compliance, and protection status

This guide is for teams evaluating centralized WAF/Shield management across accounts, including European Sovereign Cloud. It is not an installation guide, account-permission setup, deployment instruction, cost quote, or compliance certification. No live AWS account was tested; no resource was deployed and no remediation or security outcome was verified.

An AWS Region describes service coverage. It does not establish a customer's citizenship, an operator's location, or a proxy exit location. Using a proxy does not change AWS service eligibility, regional enablement, the billing unit, or a compliance decision.