Landing zone and account vending: what each new account costs

Quick answer

A landing zone baseline typically costs 60 to 250 dollars per account per month before any workload, driven by logging and audit trails, security scanning services, network egress paths, DNS, and any per account managed endpoints. At 80 accounts a 120 dollar baseline is 115,000 dollars a year. Trim it by centralizing logs and scanning rather than per account duplication, using shared egress through a transit hub, and estimating the vending module's cost in CI before its defaults propagate.

Account vending is one of the clearest wins in platform engineering. A new team asks for an account, gets one in minutes with guardrails, baseline networking, logging, identity, and tagging already applied, and nobody hand builds foundations again.

The consequence is that the vending template defines a recurring cost that every account inherits. Unlike an application, that cost exists whether the account hosts one workload or none, and it multiplies by account count rather than by traffic.

The baseline bill per account

Baseline component	Typical monthly cost
Audit trail and config recording	About 10 to 60 dollars
Threat detection service	About 10 to 80 dollars
Log storage and forwarding	About 5 to 40 dollars
Egress path (NAT or endpoints)	0 shared, about 33 to 99 dollars dedicated
DNS zones and resolver rules	About 1 to 15 dollars
Secrets and key management	About 3 to 20 dollars
Baseline per account	About 60 to 250 dollars

At 80 accounts, a 120 dollar baseline is 9,600 dollars a month, about 115,000 dollars a year, spent before any product exists. That is not an argument against landing zones, it is an argument for auditing the baseline with the same seriousness as a production workload.

Configuration recording is the usual surprise

Continuous configuration recording charges per configuration item recorded, and in an account with active infrastructure that count is much higher than people expect. Each change to each resource is an item, so a busy account with autoscaling can record tens of thousands of items a month.

The fix is scoping rather than disabling. Record the resource types that matter for compliance, exclude high churn types that provide little audit value, and avoid recording global resource types in every region of every account when one region suffices. This single change often cuts the baseline by 30 to 50 percent.

Centralize instead of duplicating

The expensive pattern is running a full copy of every shared capability inside each account. The cheap pattern is a hub: log archive in one account, security tooling aggregated centrally, egress through a shared transit path, DNS resolved by a central resolver, image registries shared read only.

A dedicated NAT gateway per account is the clearest example. Eighty accounts with their own NAT gateway is about 2,600 dollars a month in hourly charges alone, before data processing. Routing through a shared egress account, or using VPC endpoints for the services that actually get called, removes most of it. The tradeoff analysis is inVPC endpoints versus NAT gateway.

Vend tiers, not one shape

Not every account needs the production baseline. A sandbox for experimentation needs guardrails and a budget alarm, not full config recording, threat detection in every region, and a dedicated egress path. A production account needs all of it.

Define two or three account types in the vending machine, say sandbox, non-production, and production, with different baselines. A sandbox baseline of 15 dollars against a production baseline of 200 dollars is achievable, and since sandboxes usually outnumber production accounts, the weighted average drops sharply.

Estimate the vending module before it propagates

The vending module is infrastructure code, so its cost is estimable before rollout. c3x reads the Terraform plan and prices it statically with no cloud credentials, which means a pull request that adds a new baseline component shows its monthly cost per account in the review.

Put the multiplier in the pull request template. A reviewer looking at "plus 18 dollars per account, 80 accounts, plus 1,440 dollars per month" makes a different decision than one looking at a resource block. It is the same principle asmulti account cost visibility, applied at the moment of change rather than after the fact.

Close accounts, do not just abandon them

Landing zones accumulate accounts the way clusters accumulate namespaces. Teams reorganize, projects end, and the account keeps recording configuration and running detection services forever.

Review account inventory quarterly against owner tags, flag accounts with no deployment activity in 90 days, and either close them or downgrade them to the sandbox baseline. Suspended workloads in an abandoned account still pay the baseline, which is the one cost you can eliminate completely rather than optimize. A landing zone with tiered baselines, centralized shared services, scoped recording, and a quarterly account review stays the thing it was meant to be: cheap consistency, rather than an invisible tax on growth.

FAQ

How much does a landing zone account baseline cost?

Typically 60 to 250 dollars per account per month before any workload, from audit trail and configuration recording, threat detection, log storage and forwarding, an egress path, DNS, and key or secrets management. At 80 accounts a 120 dollar baseline is about 9,600 dollars a month or 115,000 dollars a year spent before any product exists.

Why is configuration recording expensive in a landing zone?

It charges per configuration item recorded, and every change to every resource is an item. An account with autoscaling and active infrastructure can record tens of thousands of items a month. Scoping the recorder to the resource types that matter for compliance, excluding high churn low value types, and not recording global types in every region often cuts the baseline by 30 to 50 percent.

Should each account have its own NAT gateway?

Usually not. Eighty accounts with dedicated NAT gateways cost roughly 2,600 dollars a month in hourly charges before any data processing. Routing egress through a shared transit path, or using VPC endpoints for the services actually being called, removes most of that. Centralizing log archive, security tooling, DNS resolution, and registries follows the same logic.

Should all vended accounts get the same baseline?

No. Define two or three account types, such as sandbox, non-production, and production, with different baselines. A sandbox needs guardrails and a budget alarm, not full configuration recording, threat detection in every region, and dedicated egress. A 15 dollar sandbox baseline against a 200 dollar production baseline pulls the weighted average down sharply, since sandboxes usually outnumber production accounts.

How do I review a change to the account vending module?

Estimate it before rollout. C3X prices the Terraform plan statically with no cloud credentials, so a pull request adding a baseline component shows its per account monthly cost in the review. Put the multiplier in the pull request template so reviewers see the organizational number, for example plus 18 dollars per account across 80 accounts equals plus 1,440 dollars per month.

What to do next

Price your account baseline before it multiplies. C3X estimates Terraform plans without cloud credentials. Start with the quickstart.