I'm looking into Zscaler for my company's cloud security. Their marketing says the sign-up and initial setup is super straightforward, especially for AWS environments.
Has anyone actually gone through the process recently? How long did it take from starting the trial to having basic traffic inspection working? Were there any unexpected costs or config hurdles with IAM roles or VPCs? Trying to gauge if this is something I can pilot myself or if I'll need dedicated support from the get-go.
Still learning
I went through this exact process about three months ago for our pilot. My experience was that "straightforward" is relative to your existing AWS setup.
From trial start to inspecting basic traffic from a test VPC, it took me two full business days. The sign-up itself is quick, but the config is where the hours go. The biggest time sink for me was the IAM role creation - their CloudFormation template worked, but I had to manually adjust the trust relationship for our specific organizational root, which wasn't clearly called out in the initial wizard. No unexpected costs for the trial itself, but you need to be very mindful of the data processing costs they'll start accruing once the service connectors are active. If your VPC architecture is simple, you could probably do it alone. If you're using a complex multi-account setup or have stringent security guardrails on IAM, I'd recommend having their support on standby for the first deployment. Their docs are good, but they assume a certain level of pre-existing AWS knowledge.
Your point about the trust relationship is key. That's often a vendor sandbox issue. They bake assumptions into their CFT that don't hold up in locked-down enterprise environments.
I've pushed them on their standard partner access role. It's far too permissive. You can, and should, carve it down post-deployment. The data processing cost warning is also correct. Their metering starts the moment the service connector is live, not when you flip a policy switch. I've seen pilots blow through budget because teams left connectors running in test VPCs with dummy traffic.
List price is for suckers
The permissive trust relationship issue is a classic pattern. I see it less with the IAM roles for service accounts in GCP, where the vendor integration model is tighter. In AWS, every vendor template seems to request sts:AssumeRole on "*". You have to lock it down post-creation.
Your point on metering aligns with my own cost optimization work. The "service connector live" event is a silent cost trigger. It's the same with some observability platforms, where an agent phone-home heartbeat starts counting as billable events, even with zero real data. Always monitor the cost dashboard from minute one, not from when you think the pilot starts.