756 articles on cost optimization — what drives the cost, how it is priced, and where the savings actually are.
AWS Clean Rooms bills for the compute (CRPU) that runs privacy-preserving queries across partners' data without sharing raw data. Query volume and complexity drive the bill. Here is the model.
Firewall Manager centrally manages Azure Firewall policies and security across many networks; the meaningful cost is the Azure Firewalls themselves plus per-policy charges beyond the first. Here is the model.
Azure DDoS Protection (Network or IP Protection) bills a flat monthly fee covering a set of protected resources, with per-resource charges beyond the included count. It protects against volumetric attacks. Here is the model.
GuardDuty bills by the volume of logs and events it analyzes, CloudTrail events, VPC flow logs, DNS logs, and per feature (S3, EKS, malware, RDS protection). High-traffic accounts and enabled features drive the bill. Here is the model.
AWS Secrets Manager charges per secret per month plus API calls; Azure Key Vault and GCP Secret Manager charge mostly per operation with cheap or free storage; self-hosted Vault trades license or ops cost. This compares the models.
Security tools, threat detection, posture management, WAF, secrets, DDoS, add up across a cloud estate. Most are usage- or resource-based, so the stack cost scales with your footprint. Here is how to budget for it sensibly.
Egress, data leaving a cloud to the internet or across regions, is billed per GB and is one of the most underestimated cloud costs. Architecture, caching, and keeping traffic in-region cut it. Here is how.
Running across regions buys resilience and lower latency for distributed users, but roughly multiplies infrastructure cost and adds cross-region data transfer. The tradeoff is availability and latency versus cost. Here is how to weigh it.
FIS bills per action-minute of chaos experiments (about $0.10), so cost scales with how long and how many fault-injection actions run. It is cheap relative to the resilience it validates. Here is the model and how it fits.
CloudTrail Lake bills per GB of events ingested into an event data store (by pricing tier and retention) plus per GB scanned by queries. High-volume event ingestion and broad queries drive the bill. Here is the model.
Amazon Location Service bills per request across maps (tiles), places (geocoding, search), routes, and trackers/geofences, each priced separately with a free tier. High-volume mapping and per-position tracking drive the bill. Here is the model.
Azure Data Explorer (Kusto) bills the compute of its cluster VMs (with a markup) plus storage, running continuously unless stopped, or serverless-style with autoscale. Idle clusters and over-provisioning drive the bill. Here is the model.
Azure Web PubSub bills per provisioned unit per day (each supporting concurrent connections and messages), with a Free tier and autoscaling Premium. Over-provisioning units for rare peaks drives the bill. Here is the model.
Datastream bills per GB of change-data-capture (CDC) data processed from source databases, plus backfill of existing data. High-change-rate sources and large backfills drive the bill. Here is the CDC replication model.
Google Cloud Workflows bills per step executed, with internal steps very cheap (and a free tier) and external HTTP calls slightly more, so orchestration itself is nearly free. The real cost is what the steps call. Here is the model.
AWS ECR and GCP Artifact Registry price per GB stored plus egress; Azure ACR uses a flat daily tier fee bundling storage. The cheapest depends on registry size and pull topology. This compares the models and the shared levers.
CloudWatch, Azure Monitor, and Google Cloud Monitoring all bill on metrics, logs ingested, and API calls, with generous free tiers for platform metrics. Logs and custom metrics drive the bill. This compares them and the shared levers.
Polling for updates repeatedly hits your backend whether or not anything changed; WebSockets push updates over a persistent connection only when they occur. For frequent updates to many clients, the cost tradeoff is nuanced. Here it is.
Processing work synchronously means provisioning compute for peak request rate; processing it asynchronously via a queue lets workers drain at their own pace, so you provision for average, not peak. This decouples cost from spikes. Here is the tradeoff.
Cost governance encodes rules, required tags, banned expensive SKUs, budget limits, allowed regions, that are enforced automatically rather than left to discipline. Enforced in CI and at provisioning, they prevent waste at the source. Here is how.
Network Firewall bills a per-endpoint hourly fee (per Availability Zone) plus per GB of traffic inspected. The always-on per-AZ endpoint fee is the surprise. Centralizing inspection is the lever. Here is the model.
Outposts brings AWS infrastructure on-premises, priced as a capacity commitment (upfront and/or monthly over a 3-year term) for the rack or servers. It suits low-latency or data-residency needs, at a substantial fixed cost. Here is the model.
Lake Formation's governance and permissions add no direct charge; you pay for the underlying S3, Glue, and Athena, plus a storage-optimization (compaction) charge for governed tables. The underlying services are the real cost. Here is the model.
CloudHSM bills per HSM instance-hour (around $1.45, so about $1,000+/month each), and you need at least two for high availability. It is expensive dedicated hardware for strict compliance needs. For most, KMS is far cheaper. Here is when CloudHSM is required.