Notes from the team building C3X. Cost estimation for Terraform, the economics of cloud infrastructure, and how to ship FinOps tooling without a SaaS gate.
Security tools, threat detection, posture management, WAF, secrets, DDoS, add up across a cloud estate. Most are usage- or resource-based, so the stack cost scales with your footprint. Here is how to budget for it sensibly.
SIEM cost is dominated by data ingestion: Microsoft Sentinel bills per GB ingested (with commitment tiers), AWS Security Lake centralizes data in S3 with usage-based analytics, and Google Chronicle prices differently. Ingestion volume drives all. This compares them.
Egress, data leaving a cloud to the internet or across regions, is billed per GB and is one of the most underestimated cloud costs. Architecture, caching, and keeping traffic in-region cut it. Here is how.
Running across regions buys resilience and lower latency for distributed users, but roughly multiplies infrastructure cost and adds cross-region data transfer. The tradeoff is availability and latency versus cost. Here is how to weigh it.
FIS bills per action-minute of chaos experiments (about $0.10), so cost scales with how long and how many fault-injection actions run. It is cheap relative to the resilience it validates. Here is the model and how it fits.
CloudTrail Lake bills per GB of events ingested into an event data store (by pricing tier and retention) plus per GB scanned by queries. High-volume event ingestion and broad queries drive the bill. Here is the model.
Amazon Location Service bills per request across maps (tiles), places (geocoding, search), routes, and trackers/geofences, each priced separately with a free tier. High-volume mapping and per-position tracking drive the bill. Here is the model.
Azure Data Explorer (Kusto) bills the compute of its cluster VMs (with a markup) plus storage, running continuously unless stopped, or serverless-style with autoscale. Idle clusters and over-provisioning drive the bill. Here is the model.
Azure Web PubSub bills per provisioned unit per day (each supporting concurrent connections and messages), with a Free tier and autoscaling Premium. Over-provisioning units for rare peaks drives the bill. Here is the model.
Datastream bills per GB of change-data-capture (CDC) data processed from source databases, plus backfill of existing data. High-change-rate sources and large backfills drive the bill. Here is the CDC replication model.
Google Cloud Workflows bills per step executed, with internal steps very cheap (and a free tier) and external HTTP calls slightly more, so orchestration itself is nearly free. The real cost is what the steps call. Here is the model.
AWS ECR and GCP Artifact Registry price per GB stored plus egress; Azure ACR uses a flat daily tier fee bundling storage. The cheapest depends on registry size and pull topology. This compares the models and the shared levers.
CloudWatch, Azure Monitor, and Google Cloud Monitoring all bill on metrics, logs ingested, and API calls, with generous free tiers for platform metrics. Logs and custom metrics drive the bill. This compares them and the shared levers.
Polling for updates repeatedly hits your backend whether or not anything changed; WebSockets push updates over a persistent connection only when they occur. For frequent updates to many clients, the cost tradeoff is nuanced. Here it is.
Processing work synchronously means provisioning compute for peak request rate; processing it asynchronously via a queue lets workers drain at their own pace, so you provision for average, not peak. This decouples cost from spikes. Here is the tradeoff.
Cost governance encodes rules, required tags, banned expensive SKUs, budget limits, allowed regions, that are enforced automatically rather than left to discipline. Enforced in CI and at provisioning, they prevent waste at the source. Here is how.
Network Firewall bills a per-endpoint hourly fee (per Availability Zone) plus per GB of traffic inspected. The always-on per-AZ endpoint fee is the surprise. Centralizing inspection is the lever. Here is the model.
Outposts brings AWS infrastructure on-premises, priced as a capacity commitment (upfront and/or monthly over a 3-year term) for the rack or servers. It suits low-latency or data-residency needs, at a substantial fixed cost. Here is the model.
Lake Formation's governance and permissions add no direct charge; you pay for the underlying S3, Glue, and Athena, plus a storage-optimization (compaction) charge for governed tables. The underlying services are the real cost. Here is the model.
CloudHSM bills per HSM instance-hour (around $1.45, so about $1,000+/month each), and you need at least two for high availability. It is expensive dedicated hardware for strict compliance needs. For most, KMS is far cheaper. Here is when CloudHSM is required.
App Configuration has a free tier for basic use and a Standard tier billed a small daily fee plus per-10,000-request overage beyond a generous included allowance. It is inexpensive; the main lever is caching config to reduce requests. Here is the model.
SignalR Service bills per provisioned unit per day (Standard) or by usage (Serverless-friendly), with each unit supporting a number of concurrent connections and messages. Over-provisioning units for peak that rarely comes drives the bill. Here is the model.
Google-managed public TLS certificates are free; the cost is Certificate Authority Service for private CAs, billed per CA per month plus per certificate issued. For public TLS, there is nothing to pay. Here is the model.
Cloud Scheduler bills per job per month (the first three free, then about $0.10 each), making it one of the cheapest ways to run cron in the cloud. The real cost is the work each job triggers, not the scheduler. Here is the model.