37 articles on security — what drives the cost, how it is priced, and where the savings actually are.
Security logs have the longest retention requirements and the lowest query rate of any telemetry you keep. That combination makes them the single best candidate for tiering, and the most commonly mishandled.
Private Service Connect gives you a private IP inside your VPC for a Google or third-party service. It charges per endpoint hour and per gigabyte, and it usually beats routing the same traffic through Cloud NAT.
Secrets pricing looks trivial at 0.40 dollars per secret per month, then you multiply by 40 services, 5 environments, and rotation versions. Add API call charges from pods that fetch on every start and the bill stops being trivial. Here is how it scales.
AWS KMS charges $1 per month per customer-managed key and $0.03 per 10,000 requests, so a few keys is trivial but a high-throughput app making millions of encrypt and decrypt calls can flip the bill to requests. Here is how to tell which side dominates.
CloudTrail management events are largely free, but data events cost $0.10 per 100,000 events, and high-volume S3 or Lambda logging can generate billions of them. Here is how data event pricing works and how to keep it in check.
SSM Parameter Store standard parameters are free, while advanced parameters cost $0.05 each per month and higher-throughput API calls carry a fee. Knowing when you actually need advanced tier saves money over Secrets Manager. Here is the pricing.
Estimating infrastructure cost without cloud credentials means pricing the Terraform plan against a catalog instead of querying the provider. Here is why credential-free estimation is faster, safer, and works in more places.
AWS WAF bills per web ACL, per rule, and per million requests inspected, so cost scales with how many rules you run and how much traffic you protect. Here is how WAF pricing works and how to keep protection affordable.
AWS security groups are free, there is no charge for creating or using them. But the network resources they protect, and adjacent features like WAF and Network Firewall, do cost money. Here is what is free and what is not.
AWS IAM itself is completely free: users, roles, groups, and policies cost nothing. The confusion comes from adjacent paid services like IAM Identity Center add-ons, Secrets Manager, and certain identity features. Here is what is free and what is not.
Secret Manager bills about $0.06 per active secret version per location per month and about $0.03 per 10,000 access operations. It is cheap unless you store many versions or access secrets on every request. Here is the model and the caching lever.
PrivateLink (and Private Endpoints) provide private connectivity to services without traversing the internet, billing per endpoint-hour plus data processed. It improves security and can reduce egress, but endpoints add up. Here is the model.
Verified Access bills per application connected per hour plus data processed, giving zero-trust access to internal apps without a VPN. Many connected apps and high traffic drive the bill. Here is the model.
Firewall Manager centrally manages Azure Firewall policies and security across many networks; the meaningful cost is the Azure Firewalls themselves plus per-policy charges beyond the first. Here is the model.
Azure DDoS Protection (Network or IP Protection) bills a flat monthly fee covering a set of protected resources, with per-resource charges beyond the included count. It protects against volumetric attacks. Here is the model.
GuardDuty bills by the volume of logs and events it analyzes, CloudTrail events, VPC flow logs, DNS logs, and per feature (S3, EKS, malware, RDS protection). High-traffic accounts and enabled features drive the bill. Here is the model.
AWS WAF charges per web ACL, per rule, and per million requests; Azure WAF and GCP Cloud Armor bundle differently (policy plus per-rule plus requests). The cheapest depends on rule count and traffic. This compares the models.
AWS Shield Standard is free with Advanced a flat monthly commitment; Azure DDoS Protection is a flat plan or per-IP; GCP relies on always-on network protection plus Cloud Armor. The models differ sharply. This compares them.
Security tools, threat detection, posture management, WAF, secrets, DDoS, add up across a cloud estate. Most are usage- or resource-based, so the stack cost scales with your footprint. Here is how to budget for it sensibly.
SIEM cost is dominated by data ingestion: Microsoft Sentinel bills per GB ingested (with commitment tiers), AWS Security Lake centralizes data in S3 with usage-based analytics, and Google Chronicle prices differently. Ingestion volume drives all. This compares them.
CloudTrail Lake bills per GB of events ingested into an event data store (by pricing tier and retention) plus per GB scanned by queries. High-volume event ingestion and broad queries drive the bill. Here is the model.
Network Firewall bills a per-endpoint hourly fee (per Availability Zone) plus per GB of traffic inspected. The always-on per-AZ endpoint fee is the surprise. Centralizing inspection is the lever. Here is the model.
CloudHSM bills per HSM instance-hour (around $1.45, so about $1,000+/month each), and you need at least two for high availability. It is expensive dedicated hardware for strict compliance needs. For most, KMS is far cheaper. Here is when CloudHSM is required.
Google-managed public TLS certificates are free; the cost is Certificate Authority Service for private CAs, billed per CA per month plus per certificate issued. For public TLS, there is nothing to pay. Here is the model.