37 articles on security — what drives the cost, how it is priced, and where the savings actually are.
AWS Secrets Manager charges per secret per month plus API calls; Azure Key Vault and GCP Secret Manager charge mostly per operation with tiny per-secret fees. The cheapest depends on secret count vs access frequency. This compares them.
Macie bills a per-bucket inventory charge plus per GB of S3 objects analyzed for sensitive data. Scanning entire large buckets on every run drives the bill. Sampling and scoping to sensitive data are the levers. Here is the model.
Shield Advanced costs a flat subscription (about $3,000/month, with a one-year commitment) covering an organization, plus data transfer for protected resources. It suits high-value, attack-prone applications. Here is when the subscription pays off.
Sentinel bills per GB of data ingested and analyzed (on top of Log Analytics storage), with commitment tiers that discount at volume. High-volume log sources drive the bill. Filtering and tiering ingestion are the levers. Here is the model.
Defender for Cloud bills per protected resource per month, per plan (servers, containers, databases, storage, and more), each priced separately. Enabling every plan on every resource over-pays. Here is how the plan-based model works.
Security Command Center has a free Standard tier and paid Premium and Enterprise tiers priced by subscription or by resource consumption. Enabling premium across an entire organization drives the bill. Here is how the tiers price.
Security Hub bills per security check evaluated against your resources and per finding ingested from integrated services, both tiered. Large accounts with many resources and chatty integrations drive the bill. Here is the model.
Amazon Inspector bills per EC2 instance scanned per month and per container image scanned (with re-scans on updates), plus Lambda function scanning. Large fleets and frequent image pushes drive the bill. Here is the model.
Cloud Armor bills per security policy (about $5/month), per rule (about $1/month), and per million requests processed (about $0.75), with Managed Protection Plus adding a subscription. Here is how the standard model prices and what drives the bill.
Standard Key Vault bills about $0.03 per 10,000 operations, so software-protected secrets are nearly free. HSM-protected keys (Premium) and Managed HSM add fixed or per-key costs. Here is where the money actually is.
KMS charges $1 per month per customer-managed key and $0.03 per 10,000 API requests. AWS-managed keys are free to hold but you still pay for requests. On a busy service, request volume, not key count, is the bill. Here is how to control it.
Secrets Manager is $0.40/secret/month + API calls; Parameter Store standard tier is free. Here's what the fee actually buys (rotation, cross-account) and the split that cuts a large secrets bill 90%.
AWS WAF charges $5/month per Web ACL + $1/month per rule + $0.60 per million requests, plus paid add-ons like Bot Control. Here's how the meters stack and how to keep them down.