Notes from the team building C3X. Cost estimation for Terraform, the economics of cloud infrastructure, and how to ship FinOps tooling without a SaaS gate.
More accounts means smaller blast radius and cleaner attribution. It also means more baselines, more egress paths, more cross-account traffic, and more discount fragmentation. The right number is the one where isolation value exceeds the separation tax. Here is how to calculate it.
A remote state backend is one of the cheapest things a platform team runs, right up until it is not. Locking tables, versioning, request volume, and hundreds of workspaces turn a rounding error into a real line. Here is what each backend option costs at scale.
Managed CI minutes are simple and priced per minute. A self-hosted fleet is cheaper per minute and comes with idle capacity, autoscaling, caching, and maintenance. The crossover depends on utilization more than volume. Here is how to run the numbers for your fleet.
A remote build cache turns compute minutes into storage and transfer charges. That trade is usually excellent and occasionally terrible, depending on hit rate, object size, and where the cache lives relative to the runners. Here is the arithmetic.
Registries are append only by default, so every build ever produced is still there. At a few hundred megabytes per image and dozens of builds a day, storage compounds quietly for years. Here is how retention policies change the number.
Secrets pricing looks trivial at 0.40 dollars per secret per month, then you multiply by 40 services, 5 environments, and rotation versions. Add API call charges from pods that fetch on every start and the bill stops being trivial. Here is how it scales.
Disaster recovery cost is a direct function of how fast you need to recover. Cold standby is nearly free and slow, hot standby is instant and doubles the bill. Most teams buy hot when warm meets their actual recovery objective. Here is the comparison.
Blue-green doubles capacity for the length of a deploy. Canary adds a small slice plus the routing and analysis machinery to run it. Which is cheaper depends on fleet size, deploy frequency, and how long the old version lingers. Here are the numbers.
Testing Terraform means creating real resources, and real resources bill by the minute. A module test suite that provisions databases and load balancers can cost more than the infrastructure it validates. Here is how to test thoroughly without paying for it twice.
Sandbox accounts exist so engineers can experiment without asking permission. They also produce the most spectacular surprise bills, because nothing stops a forgotten GPU instance. Here is how to enforce a budget rather than merely alerting on one.
A 30 percent AWS reduction is achievable on most untouched accounts, and the order of the levers matters more than the list. Delete first, resize second, commit last. Here is the sequenced playbook with expected savings per step.
Azure reductions come from a different shape of waste than AWS: premium disks, orphaned NICs and public IPs, oversized VMs, and Log Analytics ingestion. Here is the ordered playbook with real meter prices and expected savings.
GCP has its own waste profile: idle persistent disks, unattached external IPs, snapshot sprawl, oversized machine types, and BigQuery scans. Here is the sequenced playbook with real rates and expected savings per lever.
A cost program that starts with a tool selection stalls. One that starts with a baseline, a hit list, and a weekly number delivers in the first month. Here is a day by day plan for the first 30 days with expected outcomes.
Non-production is typically 30 to 40 percent of a cloud bill and used for 30 percent of the hours. The savings are large and safe, but only if the changes do not add friction. Here is the playbook that cuts spend without cutting velocity.
A week has 168 hours and most non-production workloads need about 45. Turning things off for the rest is the highest ratio saving in cloud. Here is the arithmetic, the implementation, and the resources that keep billing anyway.
Zombie resources are alive on the invoice and dead in production: disks with no instance, clusters with no pods, gateways with no traffic. Here is the hunt playbook, the detection query for each type, and how to delete safely.
Storage rarely spikes, it creeps, which is why it is the least audited line on most bills. Here is a five step cleanup covering tier policy, incomplete uploads, versioning, replication, and block storage, with real per GB rates.
Backups are the one cost line with no natural ceiling: a daily schedule with no expiry runs forever. Here is how to audit snapshot spend, set retention that satisfies compliance, and cut 50 to 80 percent without losing recoverability.
Right-sizing stalls when it becomes a permanent backlog. Running it as a time boxed sprint with a ranked list, a batch cadence, and a rollback rule ships 30 to 60 resources in two weeks. Here is the sprint plan.
ARM based instances price 10 to 20 percent below their x86 equivalents and often deliver better price performance than the headline rate suggests. Here is the staged migration playbook, the workloads that port cleanly, and the ones that do not.
A commitment is the only cost lever you cannot undo. Buy it at the wrong time or the wrong size and you have converted fixable waste into a three year obligation. Here is the sizing method, the timing rule, and the coverage targets.
Data transfer is billed per GB with no resource to point at, which is why it is the hardest line to attribute and the easiest to ignore. Here is how to find the flows, rank them, and cut them, with the per GB rates that matter.
Observability spend grows with traffic, with services, and with every new dashboard, and it is often the second largest line after compute. Here is how to cut it 40 to 70 percent while keeping the signal you actually use.