When I create a VPC can I attach a Network Firewall to it upon creation?

You're correct - you cannot create/attach a Network Firewall to a VPC at VPC creation time. But that's no different to the VPC creation process where the subnets, route tables, NACLs and security groups are all created as separate actions.

You can automate the creation of Network Firewall (as well as all the other VPC components) using CloudFormation or other Infrastructure-as-Code tools.

Correct, you can associate a VPC when you create the AWS Network Firewall, as described here.

Hi ,

I assume, you will be having AWS network firewall for centralized egress. If you have mutliple VPCs which are connected via Transit Gateway, Please refer this https://docs.aws.amazon.com/solutions/latest/firewall-automation-for-network-traffic-on-aws/overview.html.

In simple terms, We cannot associate Network Firewall to VPC for inspection, you can create routes on the VPC route table to route the traffic to Network Firewall for inspection. Ofcourse, we need VPCs when we create Network Firewall but for inspection we can use VPC route table to send/receive traffic.