Notes from the team building C3X. Cost estimation for Terraform, the economics of cloud infrastructure, and how to ship FinOps tooling without a SaaS gate.
Scale Sets add no charge of their own; you pay for the underlying VMs, disks, and load balancer. Autoscaling rules, instance size, and Spot instances decide the bill. Here is how to tune them for cost without hurting performance.
Cloud Run jobs bill per vCPU-second and memory-GiB-second while the job runs, with no idle cost since jobs run to completion and stop. It suits batch and scheduled work. Here is how the model works and how it differs from Cloud Run services.
Filestore bills per GB-month of provisioned capacity by tier (Basic HDD, Basic SSD, Zonal, Enterprise), with tier minimums. You pay for the capacity you allocate, not what you use, so tier and size choice drive the bill. Here is how to pick.
Cloud DNS bills about $0.20 per managed zone per month plus about $0.40 per million queries, similar to Route 53. For most domains it is a few dollars. Here is the breakdown and where cost hides for high-query or many-zone setups.
GPU instances cost many times a CPU instance per hour, so idle GPUs, oversized accelerators, and full-price on-demand are expensive mistakes. Spot, right-sizing, and sharing are the big levers. Here is how to keep GPU cost under control.
Cost anomaly detection flags unexpected spend increases, a misconfigured resource, a runaway job, a leak, before they become large bills. Automated detection plus fast response is the FinOps safety net. Here is how it works.
The biggest FinOps lever is engineers who see and consider the cost of what they build. Giving developers cost visibility at design and PR time, and making cost a normal engineering concern, prevents waste at the source. Here is how.
A large share of cloud spend is waste, idle resources, over-provisioned capacity, orphaned volumes, forgotten environments. Systematically finding and eliminating it is the fastest cost win. Here is a complete waste-hunting playbook.
The right cloud cost KPIs, unit cost, coverage and utilization of commitments, waste percentage, forecast accuracy, turn cost from a monthly surprise into a managed metric. Here are the KPIs that matter and how to use them.
Cost allocation tags attribute cloud spend to teams, projects, environments, and customers, making cost accountable and enabling showback, unit economics, and optimization. A consistent tagging strategy is the foundation of FinOps. Here is how to build one.
FinOps works as a collaboration between engineering, finance, and a central FinOps function, not a single cost-cutting team. Clear roles, shared ownership, and a central enabling team make cost a managed discipline. Here is how to structure it.
Not every optimization is worth the effort. Weighing the savings against the engineering time and risk, ROI, focuses effort on the high-value wins and avoids over-optimizing trivial costs. Here is how to prioritize.
A CDN's cost hinges on cache hit ratio: cache hits serve from the edge cheaply, while misses hit your origin, incurring origin egress and compute. Raising the hit ratio cuts both CDN and origin cost. Here is how.
Edge compute (Cloudflare Workers, Lambda@Edge, and others) runs code at CDN edge locations, priced by requests and compute time, often cheaply. It cuts origin load and latency but has constraints. Here is the cost model.
Managed DNS (Route 53, Azure DNS, Cloud DNS) prices by hosted zones plus queries, all inexpensive, with health checks and traffic policies adding cost. The cheapest is usually the one native to your cloud. This compares them.
NAT gateways bill an hourly fee plus per-GB data processing, so high-traffic private subnets accessing the internet or AWS services rack up processing charges. VPC endpoints, consolidation, and architecture cut it. Here is how.
Site-to-site VPN bills per connection-hour plus data; Transit Gateway bills per attachment-hour plus data processing but scales to many networks cleanly. For a few connections VPN is cheaper; for many, Transit Gateway wins. Here is the tradeoff.
PrivateLink (and Private Endpoints) provide private connectivity to services without traversing the internet, billing per endpoint-hour plus data processed. It improves security and can reduce egress, but endpoints add up. Here is the model.
A service mesh (Istio, Linkerd, and others) adds a control plane plus per-pod sidecar proxies that consume CPU and memory, so the cost is that overhead across your fleet. Lightweight meshes and sidecar-less modes cut it. Here is the model.
AWS Global Accelerator bills a fixed hourly fee plus a premium per-GB data transfer charge, routing user traffic over the AWS backbone for better performance. For latency-sensitive global apps it helps, but the premium adds up. Here is the model.
Connecting workloads across clouds means egress on both sides plus interconnect or VPN cost, so data moving between clouds is billed twice and adds latency. Minimizing cross-cloud data movement is the main lever. Here is how.
Bandwidth (data transfer) cost spans egress, cross-region, cross-AZ, and CDN transfer, and it hides across many services. Compression, caching, CDNs, in-region traffic, and committed transfer pricing cut it. Here is a complete playbook.
A VPC itself is free, but its components, NAT gateways, VPC endpoints, data transfer, and traffic mirroring, carry cost. Knowing which pieces bill, and optimizing them, keeps VPC networking cheap. Here is the breakdown.
Network topology, hub-and-spoke, mesh, flat, or segmented, determines data transfer paths and connectivity cost. A well-designed topology keeps traffic cheap and manageable; a poor one multiplies transfer and complexity. Here is how to design for cost.