Notes from the team building C3X. Cost estimation for Terraform, the economics of cloud infrastructure, and how to ship FinOps tooling without a SaaS gate.
Firestore bills per document operation (reads about $0.06 per 100k, writes about $0.18, deletes about $0.02) plus storage and egress, with a daily free tier. Query patterns, not data size, drive the bill. Here is how to keep operations down.
Memorystore for Redis bills per GB of provisioned capacity by the hour, by tier (Basic or Standard with a replica). Capacity, not usage, sets the bill, so right-sizing the instance and choosing the tier are the levers. Here is how it prices.
Cloud NAT charges an hourly fee plus about $0.045 per GB processed, similar to AWS and Azure NAT. Traffic to Google APIs can skip it with Private Google Access, cutting the data line. Here is how it prices and how to reduce it.
Cloud Armor bills per security policy (about $5/month), per rule (about $1/month), and per million requests processed (about $0.75), with Managed Protection Plus adding a subscription. Here is how the standard model prices and what drives the bill.
Artifact Registry charges about $0.10 per GB-month of storage (first 0.5 GB free) plus network egress for downloads. In-region pulls to Google compute are cheap; cross-region and internet pulls add transfer. Here is the breakdown and how to trim it.
Cloud CDN bills cache egress to users (tiered by region), cache fill from the origin, and a small per-request lookup fee. A high cache-hit ratio lowers both origin load and cost. Here is the breakdown and how to raise hit ratio.
Azure Firewall charges a fixed hourly deployment fee (around $1.25/hour, roughly $900/month) plus about $0.016 per GB processed. The always-on hourly fee, not data processing, is what shocks teams. Here is the breakdown and cheaper alternatives.
Azure Bastion bills a fixed hourly fee by tier (Basic around $0.19/hour, roughly $140/month) plus outbound data transfer. It runs around the clock whether or not anyone connects, so it is worth it for shared access, not one rarely-used VM.
Azure NAT Gateway charges about $0.045 per hour plus about $0.045 per GB processed, the same shape as the AWS NAT gateway. It is often cheaper and simpler than Azure Firewall for outbound-only needs. Here is how it prices and where it fits.
Application Insights bills by data ingested (around $2.30 per GB after a free allowance) plus retention beyond 90 days. Sampling and trimming noisy telemetry are the main levers. Here is how the ingestion-based model works.
API Management ranges from Consumption (per-call, scales to zero) to Premium (per-unit hourly, thousands a month). Picking a tier heavier than you need is the classic overspend. Here is how the tiers price and how to choose.
Service Bus Basic and Standard bill per operation (plus a base fee on Standard), while Premium bills per messaging unit by the hour for predictable performance. Here is how the tiers price and when Premium is worth its fixed cost.
Event Hubs Standard bills throughput units by the hour plus per-million ingress events; Premium and Dedicated allocate reserved capacity. Under-provision throughput units and you throttle; over-provision and you overpay. Here is how to size it.
ACR charges a fixed daily fee by tier (Basic around $5/month, Standard around $20, Premium around $50) that includes storage and throughput, plus overages and data transfer. The tier, not usage, sets most of the bill. Here is how to choose.
Standard Key Vault bills about $0.03 per 10,000 operations, so software-protected secrets are nearly free. HSM-protected keys (Premium) and Managed HSM add fixed or per-key costs. Here is where the money actually is.
Azure AI Search (formerly Cognitive Search) bills by tier and search units, provisioned by the hour regardless of query volume. Replicas and partitions multiply the cost. Here is how units price and how to size them for cost and performance.
DocumentDB bills like Aurora: instance hours per node, $0.10 per GB-month of storage, and $0.20 per million I/O requests. On a busy cluster the I/O line often rivals compute. Here is the full breakdown and where to cut.
Neptune charges per instance hour (or per NCU on Serverless), $0.10 per GB-month of storage, and $0.20 per million I/O. Serverless scales to your load; provisioned is cheaper when load is steady. Here is how to choose and control the bill.
Glue bills about $0.44 per DPU-hour for jobs and crawlers, with a minimum billing per run, plus Data Catalog storage and request fees. Fewer, right-sized DPUs and less frequent crawling are the main levers. Here is the breakdown.
Athena charges $5 per TB of data scanned, so cost is decided by how much data each query reads, not how often you query. Partitioning, columnar formats, and compression cut scans by an order of magnitude. Here is how.
Firehose charges about $0.029 per GB ingested (first 500 TB/month), with extra for format conversion and VPC delivery. Cost tracks data volume, so batching and compression before ingest are the main levers. Here is the breakdown.
Elastic Beanstalk adds no charge of its own. You pay for the EC2, load balancer, RDS, and storage it provisions. That means every EC2 cost lever applies, and the environment type quietly decides the bill. Here is what to watch.
App Runner bills active compute (vCPU and memory) while serving requests and a lower provisioned charge for memory when idle. That idle floor matters for low-traffic services. Here is how the two rates work and when App Runner is worth it.
Lightsail sells fixed monthly bundles that include an instance, storage, and transfer allowance, which is predictable and often cheaper for small workloads. EC2 is pay-as-you-go and scales further. Here is when each wins.