security
38 articles on security — what drives the cost, how it is priced, and where the savings actually are.
Secrets management cost compared: Secrets Manager vs Key Vault vs Secret Manager
AWS Secrets Manager charges per secret per month plus API calls; Azure Key Vault and GCP Secret Manager charge mostly per operation with tiny per-secret fees. The cheapest depends on secret count vs access frequency. This compares them.
AWS Macie cost: per GB of S3 data evaluated for sensitive data
Macie bills a per-bucket inventory charge plus per GB of S3 objects analyzed for sensitive data. Scanning entire large buckets on every run drives the bill. Sampling and scoping to sensitive data are the levers. Here is the model.
AWS Shield Advanced cost: a flat subscription for DDoS protection
Shield Advanced costs a flat subscription (about $3,000/month, with a one-year commitment) covering an organization, plus data transfer for protected resources. It suits high-value, attack-prone applications. Here is when the subscription pays off.
Microsoft Sentinel cost: per GB of security data ingested
Sentinel bills per GB of data ingested and analyzed (on top of Log Analytics storage), with commitment tiers that discount at volume. High-volume log sources drive the bill. Filtering and tiering ingestion are the levers. Here is the model.
Microsoft Defender for Cloud cost: per resource, per plan
Defender for Cloud bills per protected resource per month, per plan (servers, containers, databases, storage, and more), each priced separately. Enabling every plan on every resource over-pays. Here is how the plan-based model works.
GCP Security Command Center cost: tiers from free to enterprise
Security Command Center has a free Standard tier and paid Premium and Enterprise tiers priced by subscription or by resource consumption. Enabling premium across an entire organization drives the bill. Here is how the tiers price.
AWS Security Hub cost: per security check and per finding
Security Hub bills per security check evaluated against your resources and per finding ingested from integrated services, both tiered. Large accounts with many resources and chatty integrations drive the bill. Here is the model.
AWS Inspector cost: per instance and per image scanned
Amazon Inspector bills per EC2 instance scanned per month and per container image scanned (with re-scans on updates), plus Lambda function scanning. Large fleets and frequent image pushes drive the bill. Here is the model.
AWS GuardDuty cost: priced by the volume it analyzes
GuardDuty bills by the data it inspects: CloudTrail events, VPC Flow Logs, DNS logs, and optional S3, EKS, and malware protection. High-volume accounts pay the most. Here is what drives the bill and how to control it.
GCP Cloud Armor cost: policies, rules, and requests
Cloud Armor bills per security policy (about $5/month), per rule (about $1/month), and per million requests processed (about $0.75), with Managed Protection Plus adding a subscription. Here is how the standard model prices and what drives the bill.
Azure Key Vault cost: operations are cheap, HSM keys are not
Standard Key Vault bills about $0.03 per 10,000 operations, so software-protected secrets are nearly free. HSM-protected keys (Premium) and Managed HSM add fixed or per-key costs. Here is where the money actually is.
AWS KMS cost explained: $1 per key, then it is all API requests
KMS charges $1 per month per customer-managed key and $0.03 per 10,000 API requests. AWS-managed keys are free to hold but you still pay for requests. On a busy service, request volume, not key count, is the bill. Here is how to control it.
Secrets Manager vs Parameter Store cost: stop paying $0.40 for static secrets
Secrets Manager is $0.40/secret/month + API calls; Parameter Store standard tier is free. Here's what the fee actually buys (rotation, cross-account) and the split that cuts a large secrets bill 90%.
AWS WAF cost explained: the three meters that drive your bill
AWS WAF charges $5/month per Web ACL + $1/month per rule + $0.60 per million requests, plus paid add-ons like Bot Control. Here's how the meters stack and how to keep them down.