Notes from the team building C3X. Cost estimation for Terraform, the economics of cloud infrastructure, and how to ship FinOps tooling without a SaaS gate.
Amplify Hosting bills build minutes, stored artifacts, data served, and server-side rendering compute. For a static site it is cheap; SSR and heavy traffic are where cost grows. Here is the breakdown and where to cut.
Elastic Container Registry charges $0.10 per GB-month of image storage, trivial for most teams. The real cost is data transfer: cross-region and internet pulls add up, while pulls to ECS or EKS in the same region are free. Here is the full breakdown.
Route 53 bills $0.50 per hosted zone per month plus $0.40 per million standard queries, and alias queries to AWS resources are free. Latency and geo routing cost more per query, and health checks add up. Here is where the money goes.
KMS charges $1 per month per customer-managed key and $0.03 per 10,000 API requests. AWS-managed keys are free to hold but you still pay for requests. On a busy service, request volume, not key count, is the bill. Here is how to control it.
Gateway endpoints for S3 and DynamoDB are free and remove that traffic from your NAT gateway entirely. Interface endpoints cost per hour per AZ plus per GB, which can still beat NAT on high-volume paths. Here is how to choose.
CloudFront has no fixed fee, you pay for data transfer out to viewers (tiered by region and volume) and per-request charges. Transfer from AWS origins to CloudFront is free, which is why a CDN often lowers your total bill. Here is the breakdown.
Average latency hides the tail that users feel and SLOs measure. Optimizing cost against p95, not the mean, is what keeps a cheaper configuration from quietly breaking. Here is how to reason about the p95-versus-cost frontier.
Every cache hit is a database query, a Lambda invocation, or an origin fetch you did not pay for. Caching is one of the few levers that cuts cost and improves latency at once. Here is where to add it and how the math works.
Requests, not usage, decide how many nodes you pay for, the scheduler packs pods by requests. Set them too high and you buy idle nodes; too low and you risk throttling and OOM kills. Here is how to size them for cost and stability.
Rightsizing on cost alone can push tail latency past your SLO. Simulating cost and p95 response time together finds the configuration that's cheap enough and fast enough, before anything is provisioned. Here's how to reason about the tradeoff.
Naive rightsizing trims CPU and memory until latency spikes and you roll it back. The safe method holds a performance budget (p95, error rate, headroom) while cutting cost. Here's the method and the traps.
Autoscaling trades spend for headroom. Target utilization, min/max, and cooldowns decide whether you overpay for idle capacity or miss your latency target under load. Here's how each knob moves cost and p95.
Add a stage after terraform plan that prices the plan JSON and reports the monthly cost, with a budget gate that fails the build. Here's the Jenkinsfile, the plan-JSON input, and how it fits declarative pipelines.
Add a step after terraform plan that prices the plan and comments the monthly cost on the pull request, with a budget gate that fails the pipeline. Here's the bitbucket-pipelines.yml and how it fits.
CDK synthesizes to CloudFormation, so you estimate cost from the synth output, run cdk synth, then price the templates in cdk.out. Here's how to get a cost per stack before cdk deploy, locally and in CI.
Add a job that runs after terraform plan, prices the plan JSON, and comments the monthly total and diff on the PR, with a budget gate that fails the check. Here's the workflow, the input that keeps it accurate, and how to keep it fast.
OpenTofu emits the same plan JSON as Terraform, so cost estimation works unchanged, run tofu show -json and price it. Here's how to estimate OpenTofu cost locally and in CI, and what stays identical after the fork.
HCP Terraform fires run tasks at post-plan, the moment the plan JSON exists. A run task that prices that plan puts cost and a budget gate directly in the Terraform Cloud UI. Here's how the integration works.
Add a pipeline step after terraform plan that prices the plan and posts it as a PR comment, with a budget gate that fails the build. Here's the YAML, the plan-JSON input, and how it fits branch policies.
AWS Config bills ~$0.003 per configuration item (recorded on every resource change) plus rule evaluations. The bill is churn × recording scope. Here's how to scope recording so Config stays cheap.
Estimating from terraform show -json prices the resolved resources, variables, conditionals, data sources all computed, unlike parsing raw HCL. Here's how to generate it, why it's accurate, and how it fits CI.
Atlantis already plans on every PR, add a post-plan workflow step that estimates cost and comments it, with a budget gate that blocks apply. Reuses the existing plan, works self-hosted and air-gapped.
Commit when utilization clears the break-even (~60-70% for a 1-year term). Here's how to calculate it, when to ladder 1- vs 3-year, how to avoid stranding, and where Spot fits.
The monthly bill is a lagging indicator. Estimating cost in the pull request puts the number where the change is still cheap to fix. Here's why shift-left cost works and what it can and can't predict.