Notes from the team building C3X. Cost estimation for Terraform, the economics of cloud infrastructure, and how to ship FinOps tooling without a SaaS gate.
Serverless cold starts add latency; mitigating them with provisioned concurrency or minimum instances means paying for warm capacity around the clock. Whether that trade is worth it depends on traffic and latency needs. Here is the cost math.
FinOps maturity moves from reactive (chasing bills after the fact) to proactive (visibility and allocation) to continuous (cost as a first-class engineering metric). Knowing where you are guides what to build next. Here is the progression.
Reducing cloud waste cuts both cost and carbon, since unused resources burn power for nothing. Many cost optimizations are also sustainability wins. Here is where the two align, where they diverge, and how to think about both.
Buying all your reservations or Savings Plans at once means they all expire together, forcing a big renewal decision and risking over-commitment. Laddering staggers commitment terms so a portion renews regularly, keeping flexibility. Here is how.
Macie bills a per-bucket inventory charge plus per GB of S3 objects analyzed for sensitive data. Scanning entire large buckets on every run drives the bill. Sampling and scoping to sensitive data are the levers. Here is the model.
Shield Advanced costs a flat subscription (about $3,000/month, with a one-year commitment) covering an organization, plus data transfer for protected resources. It suits high-value, attack-prone applications. Here is when the subscription pays off.
Cloud Map bills per registered service-discovery resource per month and per API discovery call, plus any health checks. It is inexpensive, but high-frequency discovery lookups from many clients can add up. Here is the model.
App Mesh adds no charge of its own; you pay for the Envoy proxy sidecars that run alongside your services, consuming CPU and memory on every task or pod. At scale, the sidecar overhead is the real cost. Here is what to watch.
Sentinel bills per GB of data ingested and analyzed (on top of Log Analytics storage), with commitment tiers that discount at volume. High-volume log sources drive the bill. Filtering and tiering ingestion are the levers. Here is the model.
Defender for Cloud bills per protected resource per month, per plan (servers, containers, databases, storage, and more), each priced separately. Enabling every plan on every resource over-pays. Here is how the plan-based model works.
Logic Apps has two models: Consumption bills per action execution and connector call (scales to zero), while Standard runs on a hosting plan billed for allocated compute. Match the model to workflow volume. Here is the comparison.
Security Command Center has a free Standard tier and paid Premium and Enterprise tiers priced by subscription or by resource consumption. Enabling premium across an entire organization drives the bill. Here is how the tiers price.
Cloud Workstations bills a management fee plus the underlying Compute Engine VM and storage while a workstation runs, with auto-shutdown when idle. Idle workstations left running are the classic waste. Here is the model and how to control it.
When a single database cannot handle the write load, sharding splits data across nodes to scale horizontally. It adds infrastructure and significant operational complexity, so it is a last resort after cheaper scaling. Here is the cost tradeoff.
A materialized view precomputes an expensive query and stores the result, so reads are fast and cheap, at the cost of storage and refresh compute. For frequently-run expensive queries, the trade pays off. Here is the cost math.
Repatriation, moving workloads from cloud back to on-premises or colocation, can cut cost for large, steady, predictable workloads, but the migration, hardware, and operational costs are substantial. Here is an honest look at when it pays.
Rekognition bills per image processed for image analysis and per minute for video, with rates by feature (labels, faces, moderation, text). High-volume or per-frame analysis drives the bill. Here is the model and how to control it.
Textract bills per page processed, with higher rates for forms, tables, and query features than plain text detection. Running advanced analysis on documents that only need text extraction over-pays. Here is the per-page model.
Transcribe bills per second of audio (rounded up per request), with higher rates for features like speaker identification, medical, and custom models. Long audio and premium features drive the bill. Here is the per-second model.
Comprehend bills per unit of text (100 characters, with a per-request minimum) for NLP tasks like sentiment, entities, and key phrases, with higher rates for custom models. Analyzing more text or in more ways than needed drives the bill.
Security Hub bills per security check evaluated against your resources and per finding ingested from integrated services, both tiered. Large accounts with many resources and chatty integrations drive the bill. Here is the model.
Amazon Inspector bills per EC2 instance scanned per month and per container image scanned (with re-scans on updates), plus Lambda function scanning. Large fleets and frequent image pushes drive the bill. Here is the model.
Azure AI Services (formerly Cognitive Services) bill per transaction for APIs like Vision, Language, and Speech, with free and standard tiers and volume discounts. Chatty clients and premium features drive the bill. Here is the model.
Document AI bills per page processed, with rates by processor, cheap general OCR, more for form and specialized parsers, and higher for custom and generative processors. Running specialized processors on simple documents over-pays. Here is the model.