security
38 articles on security — what drives the cost, how it is priced, and where the savings actually are.
Security log retention cost: paying for a year of data nobody queries
Security logs have the longest retention requirements and the lowest query rate of any telemetry you keep. That combination makes them the single best candidate for tiering, and the most commonly mishandled.
GCP Private Service Connect cost: what private access is worth
Private Service Connect gives you a private IP inside your VPC for a Google or third-party service. It charges per endpoint hour and per gigabyte, and it usually beats routing the same traffic through Cloud NAT.
Secrets management cost at scale: per secret fees meet per environment sprawl
Secrets pricing looks trivial at 0.40 dollars per secret per month, then you multiply by 40 services, 5 environments, and rotation versions. Add API call charges from pods that fetch on every start and the bill stops being trivial. Here is how it scales.
KMS key cost vs request cost: which one dominates your bill
AWS KMS charges $1 per month per customer-managed key and $0.03 per 10,000 requests, so a few keys is trivial but a high-throughput app making millions of encrypt and decrypt calls can flip the bill to requests. Here is how to tell which side dominates.
CloudTrail data events cost: why S3 and Lambda logging gets expensive
CloudTrail management events are largely free, but data events cost $0.10 per 100,000 events, and high-volume S3 or Lambda logging can generate billions of them. Here is how data event pricing works and how to keep it in check.
SSM Parameter Store cost explained: free standard vs paid advanced
SSM Parameter Store standard parameters are free, while advanced parameters cost $0.05 each per month and higher-throughput API calls carry a fee. Knowing when you actually need advanced tier saves money over Secrets Manager. Here is the pricing.
Cost estimation without cloud credentials: why static pricing wins
Estimating infrastructure cost without cloud credentials means pricing the Terraform plan against a catalog instead of querying the provider. Here is why credential-free estimation is faster, safer, and works in more places.
WAF cost explained: what web application firewall protection costs
AWS WAF bills per web ACL, per rule, and per million requests inspected, so cost scales with how many rules you run and how much traffic you protect. Here is how WAF pricing works and how to keep protection affordable.
Are AWS security groups free? Yes, and what actually costs money
AWS security groups are free, there is no charge for creating or using them. But the network resources they protect, and adjacent features like WAF and Network Firewall, do cost money. Here is what is free and what is not.
Does IAM cost money? The free service and its paid neighbors
AWS IAM itself is completely free: users, roles, groups, and policies cost nothing. The confusion comes from adjacent paid services like IAM Identity Center add-ons, Secrets Manager, and certain identity features. Here is what is free and what is not.
GCP Secret Manager cost: per secret version and per access
Secret Manager bills about $0.06 per active secret version per location per month and about $0.03 per 10,000 access operations. It is cheap unless you store many versions or access secrets on every request. Here is the model and the caching lever.
PrivateLink cost: private connectivity to services
PrivateLink (and Private Endpoints) provide private connectivity to services without traversing the internet, billing per endpoint-hour plus data processed. It improves security and can reduce egress, but endpoints add up. Here is the model.
AWS Verified Access cost: per app connection per hour plus data
Verified Access bills per application connected per hour plus data processed, giving zero-trust access to internal apps without a VPN. Many connected apps and high traffic drive the bill. Here is the model.
Azure Firewall Manager cost: policy management plus the firewalls
Firewall Manager centrally manages Azure Firewall policies and security across many networks; the meaningful cost is the Azure Firewalls themselves plus per-policy charges beyond the first. Here is the model.
Azure DDoS Protection cost: a flat monthly plan plus overage
Azure DDoS Protection (Network or IP Protection) bills a flat monthly fee covering a set of protected resources, with per-resource charges beyond the included count. It protects against volumetric attacks. Here is the model.
AWS GuardDuty cost explained: per GB and per event analyzed
GuardDuty bills by the volume of logs and events it analyzes, CloudTrail events, VPC flow logs, DNS logs, and per feature (S3, EKS, malware, RDS protection). High-traffic accounts and enabled features drive the bill. Here is the model.
WAF cost compared: AWS WAF vs Azure vs Cloud Armor
AWS WAF charges per web ACL, per rule, and per million requests; Azure WAF and GCP Cloud Armor bundle differently (policy plus per-rule plus requests). The cheapest depends on rule count and traffic. This compares the models.
DDoS protection cost compared: AWS Shield vs Azure vs Cloud Armor
AWS Shield Standard is free with Advanced a flat monthly commitment; Azure DDoS Protection is a flat plan or per-IP; GCP relies on always-on network protection plus Cloud Armor. The models differ sharply. This compares them.
Cloud security tooling cost: budgeting for the security stack
Security tools, threat detection, posture management, WAF, secrets, DDoS, add up across a cloud estate. Most are usage- or resource-based, so the stack cost scales with your footprint. Here is how to budget for it sensibly.
SIEM cost compared: Sentinel vs Security Lake vs Chronicle
SIEM cost is dominated by data ingestion: Microsoft Sentinel bills per GB ingested (with commitment tiers), AWS Security Lake centralizes data in S3 with usage-based analytics, and Google Chronicle prices differently. Ingestion volume drives all. This compares them.
AWS CloudTrail Lake cost: per GB ingested and scanned
CloudTrail Lake bills per GB of events ingested into an event data store (by pricing tier and retention) plus per GB scanned by queries. High-volume event ingestion and broad queries drive the bill. Here is the model.
AWS Network Firewall cost: endpoint hours plus data processed
Network Firewall bills a per-endpoint hourly fee (per Availability Zone) plus per GB of traffic inspected. The always-on per-AZ endpoint fee is the surprise. Centralizing inspection is the lever. Here is the model.
AWS CloudHSM cost: dedicated hardware security modules by the hour
CloudHSM bills per HSM instance-hour (around $1.45, so about $1,000+/month each), and you need at least two for high availability. It is expensive dedicated hardware for strict compliance needs. For most, KMS is far cheaper. Here is when CloudHSM is required.
GCP Certificate Manager cost: public certs free, private CA priced
Google-managed public TLS certificates are free; the cost is Certificate Authority Service for private CAs, billed per CA per month plus per certificate issued. For public TLS, there is nothing to pay. Here is the model.