Notes from the team building C3X. Cost estimation for Terraform, the economics of cloud infrastructure, and how to ship FinOps tooling without a SaaS gate.
Cognito bills by monthly active users (MAU) with a free tier, and separately for advanced security features. Cost scales with your user base, not requests. Here is how the MAU model works and how to keep it predictable.
CloudWatch alarms cost about $0.10 each per month (standard), $0.30 for high-resolution or anomaly-detection, and $0.50 for composite. A few are trivial; thousands generated per-resource across a fleet add up. Here is how to keep it sane.
GuardDuty bills by the data it inspects: CloudTrail events, VPC Flow Logs, DNS logs, and optional S3, EKS, and malware protection. High-volume accounts pay the most. Here is what drives the bill and how to control it.
ElastiCache Serverless bills per GB-hour of data stored and per ElastiCache Processing Unit (ECPU) consumed, scaling to your workload with no nodes to size. It suits spiky caches; steady ones can be cheaper on nodes. Here is how it prices.
Route 53 bills per hosted zone and per query, so cost scales with traffic. Cloudflare offers DNS on flat plans (including a free tier) with unlimited queries. Here is how the two models compare and when each wins.
Pub/Sub bills about $40 per TiB of throughput (publish plus subscribe), with the first 10 GB free, plus storage for retained messages and egress. Throughput volume drives the bill, so batching and trimming payloads are the levers. Here is the breakdown.
Dataflow bills per vCPU-hour and GB-hour of worker time, plus a data-processed charge for Shuffle (batch) or Streaming Engine. Right-sizing workers and using the managed shuffle are the main levers. Here is how the model works.
Dataproc adds about $0.01 per vCPU-hour on top of the Compute Engine instances it runs, so the cluster costs more than the VMs alone. Ephemeral clusters, preemptible workers, and Dataproc Serverless are the main levers. Here is how to cut it.
Spanner bills compute as nodes (about $0.90/node/hour) or processing units (100 PU = a tenth of a node), plus $0.30 per GB-month of storage, backup, and egress. Processing units let you start small. Here is how to size and control the bill.
Firestore bills per document operation (reads about $0.06 per 100k, writes about $0.18, deletes about $0.02) plus storage and egress, with a daily free tier. Query patterns, not data size, drive the bill. Here is how to keep operations down.
Memorystore for Redis bills per GB of provisioned capacity by the hour, by tier (Basic or Standard with a replica). Capacity, not usage, sets the bill, so right-sizing the instance and choosing the tier are the levers. Here is how it prices.
Cloud NAT charges an hourly fee plus about $0.045 per GB processed, similar to AWS and Azure NAT. Traffic to Google APIs can skip it with Private Google Access, cutting the data line. Here is how it prices and how to reduce it.
Cloud Armor bills per security policy (about $5/month), per rule (about $1/month), and per million requests processed (about $0.75), with Managed Protection Plus adding a subscription. Here is how the standard model prices and what drives the bill.
Artifact Registry charges about $0.10 per GB-month of storage (first 0.5 GB free) plus network egress for downloads. In-region pulls to Google compute are cheap; cross-region and internet pulls add transfer. Here is the breakdown and how to trim it.
Cloud CDN bills cache egress to users (tiered by region), cache fill from the origin, and a small per-request lookup fee. A high cache-hit ratio lowers both origin load and cost. Here is the breakdown and how to raise hit ratio.
Azure Firewall charges a fixed hourly deployment fee (around $1.25/hour, roughly $900/month) plus about $0.016 per GB processed. The always-on hourly fee, not data processing, is what shocks teams. Here is the breakdown and cheaper alternatives.
Azure Bastion bills a fixed hourly fee by tier (Basic around $0.19/hour, roughly $140/month) plus outbound data transfer. It runs around the clock whether or not anyone connects, so it is worth it for shared access, not one rarely-used VM.
Azure NAT Gateway charges about $0.045 per hour plus about $0.045 per GB processed, the same shape as the AWS NAT gateway. It is often cheaper and simpler than Azure Firewall for outbound-only needs. Here is how it prices and where it fits.
Application Insights bills by data ingested (around $2.30 per GB after a free allowance) plus retention beyond 90 days. Sampling and trimming noisy telemetry are the main levers. Here is how the ingestion-based model works.
API Management ranges from Consumption (per-call, scales to zero) to Premium (per-unit hourly, thousands a month). Picking a tier heavier than you need is the classic overspend. Here is how the tiers price and how to choose.
Service Bus Basic and Standard bill per operation (plus a base fee on Standard), while Premium bills per messaging unit by the hour for predictable performance. Here is how the tiers price and when Premium is worth its fixed cost.
Event Hubs Standard bills throughput units by the hour plus per-million ingress events; Premium and Dedicated allocate reserved capacity. Under-provision throughput units and you throttle; over-provision and you overpay. Here is how to size it.
ACR charges a fixed daily fee by tier (Basic around $5/month, Standard around $20, Premium around $50) that includes storage and throughput, plus overages and data transfer. The tier, not usage, sets most of the bill. Here is how to choose.
Standard Key Vault bills about $0.03 per 10,000 operations, so software-protected secrets are nearly free. HSM-protected keys (Premium) and Managed HSM add fixed or per-key costs. Here is where the money actually is.