Introducing TR7 ZeroLeak: Visual Isolation — only pixels reach the user, never your data
Under Attack? Support Partner Portal
Free Live Demo
DE DeutschEN EnglishES EspañolFR FrançaisJA 日本語PT PortuguêsTR Türkçe

TR7 Cloud: the same platform, deployed from the marketplaces of the major public clouds.

CLOUD · AMAZON WEB SERVICES

TR7 on AWS Marketplace

One self-managed appliance for L4–L7 load balancing, anomaly-scoring WAF, global DNS/GSLB and secure access, launched from AWS Marketplace into your own VPC.

TR7 Enterprise is available on AWS Marketplace as an Amazon Machine Image. It launches into your VPC in minutes, provisions itself from instance metadata on first boot, and runs the same engine, policy model and management console as TR7 on hardware, VMware and Azure.

Insert it inline behind a Gateway Load Balancer for transparent traffic inspection, or run it standalone in front of your applications. Billing is hourly on your AWS bill, and every subscription starts with a 30-day free trial.

Fewer moving parts. One console. Your VPC.

Load balancing, WAF, GSLB and access management in one AMI, instead of four managed services with four consoles and four exception lists.

Open in AWS Marketplace Talk to the Cloud Team
WHY TR7 ON AWS

Keep Your Data Plane and Your Policies When You Move to AWS

Managed cloud services trade depth for convenience. TR7 keeps the full appliance in your VPC, under your control, with the same rules you already trust.

Anomaly-Scoring WAF, Not Single-Signature Blocking

TR7's WAF weighs multiple signals per request in an accumulative, OWASP CRS-style scoring model. Fewer false positives than single-rule blocking, and rules that cannot be expressed as declarative cloud WAF statements still work.

  • Signature and adaptive-learning protection with bot management and virtual patching
  • API discovery and schema enforcement, GraphQL inspection
  • L4 and L7 DDoS protection inside the same appliance

Inline or Standalone, Your Choice

Insert TR7 transparently behind an AWS Gateway Load Balancer for traffic from any VPC, or run it standalone with Elastic IPs in front of your applications.

  • Gateway Load Balancer (GENEVE) inline insertion for transparent inspection
  • Standalone mode with public ENI and Elastic IP for internet-facing services
  • Multi-ENI layouts for external, internal and management roles

One Console Across Hybrid

TR7 on AWS is managed exactly like TR7 on hardware, VMware or Azure, same web console, same CLI, same backup format. Central Management ties every instance together.

  • Import existing configurations, certificates and WAF policies
  • GTM steers users between AWS regions and on-prem by health or geography
  • One evidence set for audits across data center and cloud
WHAT IS INCLUDED

The Full TR7 Enterprise Bundle in One AMI

The AWS Marketplace listing ships TR7 Enterprise, every core product unlocked on a single instance.

ADC
Application Delivery Controller
L4–L7 load balancing, SSL/TLS offload, health checks, connection multiplexing
WAAP
Web Application and API Protection
Accumulative anomaly-scoring WAF, bot management, virtual patching, L4/L7 DDoS
AAM
Application Access Management
Secure access gateway with SSO, MFA, SAML/OIDC and conditional access
GTM
Global Traffic Manager
DNS-based global server load balancing, multi-region failover, geo routing
LISTING AND SIZING

One Listing, Sized by Instance Type

TR7 Enterprise on AWS is priced per hour by the EC2 instance type you launch it on. Start on a t3.medium for evaluation and pilots; move to compute-optimized c7a or c8a instances for production throughput.

Instance familyTypical useNotes
t3.mediumEvaluation, pilots, low-traffic productionRecommended starting point on the listing
t3.micro / t3.largeLab and small workloads / mid-size workloadsBurstable CPU; size for sustained load
c7a.medium / c8a.mediumProduction, sustained throughputCompute-optimized, AMD-based, ENA-enabled

Deployment options

Every option launches the same AMI; the difference is how traffic reaches the appliance.

Standalone · Elastic IP
Inline · Gateway Load Balancer
Multi-AZ · GTM steering

Larger instance types and additional deployment options can be enabled on request. For committed volumes or custom terms, ask the cloud team about an AWS Marketplace Private Offer.

LICENSING ON AWS

Hourly, on Your AWS Bill

No separate contract to sign. TR7 Enterprise is metered hourly through AWS Marketplace and appears on your regular AWS invoice.

  • Hourly usage-based subscription with no end date: cancel any time
  • 30-day free trial on first subscription, full feature set
  • Price varies by EC2 instance type; EC2 infrastructure charges are billed by AWS separately
  • Software support via support@tr7.com is included; AWS Premium Support is available separately from AWS
  • Existing TR7 customers keep the same management model and upgrade path

Need enterprise terms?

For committed volumes, annual pricing or multi-account agreements, TR7 issues an AWS Marketplace Private Offer to your AWS account, same AMI, negotiated terms, still on your AWS bill.

ARCHITECTURE

Where TR7 Sits in Your VPC

TR7 launches as an EC2 instance in your VPC. Standalone, it terminates client traffic on a public ENI and forwards clean traffic to backends over a private ENI. Inline, a Gateway Load Balancer hands it every packet from the VPCs you attach, transparently, without changing application addresses.

Reference topology: standalone insertion with three ENI roles

Clients / InternetElastic IP → service IPAWS VPCManagement subnetOperator / Central ManagementHTTPS 443 · SSHPublic subnet (external ENI)TR7 Enterprise (EC2)ADC · WAAP · AAM · GTMTR7 peer (multi-AZ)VRRP · VIP failoverGWLB endpoint (inline mode)Private subnet (internal ENI)Backend targetsEC2 · EKS · ECS · Auto Scaling groupsOn-prem via Direct Connect / VPN
External
Public-subnet ENI facing clients. Carries the Elastic IP and the service addresses.
Internal
Private-subnet ENI facing backend targets. Health checks and backend TLS run here.
Management
The primary ENI created at launch. Web console on HTTPS 443 and CLI over SSH.
GWLB (inline)
Gateway Load Balancer target. Receives GENEVE-encapsulated traffic for transparent inspection.
  • Provisions itself from instance metadata on first boot, network up in about two minutes, no reboot
  • IMDSv2 and Elastic Network Adapter (ENA) supported on every listed instance type
  • Additional ENIs attached in AWS appear in TR7 automatically; add addresses on the ENI and on the TR7 interface
  • Inline insertion via Gateway Load Balancer keeps application IPs unchanged across VPCs
  • Multi-AZ designs use TR7 GTM or your DNS to steer traffic between instances
  • Hybrid: GTM steers users between AWS and on-prem by health, geography or latency
DEPLOYMENT GUIDES

Quick Start Today, Full Guides on the Way

The quick-start below gets you to the console in minutes. Detailed guides for multi-ENI layouts, Gateway Load Balancer insertion and high availability are being finalized and will be published on this page.

  1. 1
    AWS console

    Subscribe on AWS Marketplace

    Open the TR7 Enterprise listing, click Continue to Subscribe, accept the terms and continue to configuration. The 30-day free trial starts with your first subscription.

  2. 2
    AWS console

    Choose the launch method

    Launch through EC2 directly, or use the CloudFormation template for a guided deployment that creates the instance and its network attachments for you.

  3. 3
    AWS console

    Select region, VPC, subnet and instance type

    Pick the region and VPC where your applications live. Start on t3.medium; choose c7a.medium or c8a.medium for sustained production throughput.

  4. 4
    AWS console

    Select a key pair and security group

    Choose an EC2 key pair at launch. Open HTTPS 443 (web console) and SSH 22 (CLI) from your management network only.

  5. 5
    AWS console

    Launch and wait for provisioning

    The instance provisions itself from instance metadata on first boot. Network and services come up in about two minutes, without a reboot.

  6. 6
    TR7 console

    Log in

    Open https://<instance-address> for the web console. For the CLI, SSH as ec2-user. On first login the password is the instance ID (i-…); change it immediately.

  7. 7
    TR7 console

    Import or build your configuration

    Restore a backup from another TR7 instance, or define vServices, backend pools, certificates and WAF policy from the console.

  • The instance-ID password applies only until you change it. Rotate it as part of your launch runbook.
  • Software support: support@tr7.com · Documentation: docs.tr7.com

Coming next on this page

Multi-ENI interface layout
External, internal and management ENIs; secondary private IPs; route tables.
Gateway Load Balancer insertion
GWLB, endpoint service and GENEVE target-group setup for transparent inline inspection.
High availability and failover
Multi-AZ pairs, Elastic IP movement and GTM-steered failover.

Want an early copy of a guide, or help with a design that is not covered yet? The cloud team will work through it with you. Message the Cloud Team →

DOCUMENTATION

Want to Go Deeper? The Full Documentation Is Here.

Every TR7 feature used in these guides, from interfaces and route tables to HA clustering, vServices, WAF policy and GTM, is documented in detail in the TR7 technical documentation. Use it alongside the guides above when you configure your deployment.

docs.tr7.com · deployment methods, settings, WAF, GTM, FAQs

Open the Documentation
FAQ

Questions Teams Ask Before Launching on AWS

Yes. The AMI runs the same TR7 release as our hardware, VMware and Azure images. Backups, WAF policies, certificates and access policies import without changes, and the same web console and CLI are used.

RESOURCES

Read More

Analysis: The cloud migration security gap
Shared responsibility and the application layer
TR7 WAAP
Anomaly scoring, bot management and API protection in depth
TR7 GTM
DNS-based global traffic management for multi-region designs
Technical documentation
Full product documentation at docs.tr7.com
CONTACT THE CLOUD TEAM

Planning an AWS Deployment? Talk to the Engineers Who Built It.

The TR7 cloud team reviews your VPC design, recommends standalone or GWLB insertion, sizes the instance, and stays with you through launch and cut-over. Send us your questions, technical or commercial.

  • Architecture review for standalone, Gateway Load Balancer and multi-AZ designs
  • Instance sizing and Private Offer preparation
  • Early access to the multi-ENI, GWLB and HA guides
  • Migration planning from on-prem TR7 or third-party ADC/WAF

Messages are sent through your verified TR7 account and reach the cloud engineering team directly. Typical response time is one business day.