Cost Estimation Reference for Terraform Resources

A managed tabular analytics engine billed per hour by tier. An S0 is ~$591/month if left running, but it can be paused, which stops the charge entirely.

Full API gateway with developer portal, rate limiting, transformations. Consumption ($3.50/M calls), Developer ($48/month, no SLA), Basic ($147/month), Standard ($686/month), Premium ($2,795/month per unit).

A managed store for application settings and feature flags. Priced as a flat daily fee on the Standard tier, with a genuinely free tier.

A Layer 7 load balancer with WAF support. Priced by gateway hours, capacity units, and optional WAF tier.

Application performance monitoring. Bills through a linked Log Analytics workspace by GB ingested. Free tier covers 5 GB/month.

Runbook automation billed per job-run minute beyond a free monthly allowance, plus watcher hours. 10,500 job-minutes is ~$20.

A VM enrolled in Azure Backup, billed a per-instance protection fee by VM size plus backup storage. A ≤500 GB VM with 100 GB of backups is ~$12/month.

Managed, browser-based RDP/SSH access to VMs without public IPs. Priced per gateway-hour by SKU, plus outbound data transfer and scale-unit hours.

A pool of compute nodes for batch/HPC jobs, billed the underlying VM rate per node. Two Standard_D2s_v5 dedicated nodes are ~$140/month, but autoscale and Spot make it usage-driven.

A CDN endpoint that caches and serves content from an origin, billed per GB of egress by zone. 1 TB of Zone 1 egress is ~$81/month.

Global CDN + WAF + load balancer. Standard at $35/month base + $0.17/GB outbound. Premium at $165/month base + $0.225/GB outbound. WAF rules and Private Link add fees. Anycast routing across 192+ POPs.

Managed AI APIs: OpenAI, Vision, Speech, Language, Translation. Pay-per-call (varies by service). OpenAI GPT-4o: $5/M input tokens, $15/M output. Vision: $1-$5/1K transactions. Speech-to-Text: $1/audio-hour.

Serverless containers billed by active vCPU-seconds and GiB-seconds. An always-on 0.5 vCPU / 1 GiB replica is ~$39/month; scale-to-zero apps cost far less.

Serverless containers billed per vCPU-second and GB-second, only while running. 1 vCPU + 1.5 GB run 24/7 is ~$28/month; scale-to-zero workloads cost far less.

A managed Docker container registry. Three tiers (Basic, Standard, Premium) with different per-day rates and included storage.

A globally-distributed multi-model database. Priced by Request Units (RU/s) and storage, with provisioned and serverless options.

A managed Apache Cassandra cluster billed per node-hour by VM SKU. Three Standard_DS14_v2 nodes run ~$4,419/month, node count and SKU drive the whole bill.

A managed Grafana instance for dashboards and observability. Priced on a per-instance hourly node fee plus a per-active-user charge.

Managed ETL/ELT and data integration. Pipeline orchestration ($1/1K runs), data flow execution ($0.193-$0.34/vCore-hour for General Purpose), and Integration Runtime hours. Data movement billed separately ($0.25/DIU-hour Azure-hosted).

A vault for backups of disks, blobs, databases, and AKS, billed per GB of backup storage. 500 GB of vaulted LRS backup is ~$50/month, retention drives the bill.

Managed Spark and Delta Lake. Bills DBU (Databricks Units) at $0.15-$0.55/DBU-hour depending on workload type plus underlying VM costs. Photon engine adds ~30% to DBU rate for ~2-3x performance.

A network DDoS protection plan billed a flat ~$2,944/month, but it covers up to 100 public IPs across all your VNets, so the cost is meant to be shared.

A physical server dedicated to your VMs for isolation and licensing. Priced per host-hour by host SKU, independent of how many VMs you place on it.

A managed IoT digital-twin graph, billed purely by usage, operations, messages, and query units, each per 1,000. 1M operations is ~$2.50; no standing fee.

A public DNS zone hosted on Azure's name servers. Priced per zone per month plus per-million queries, both at low flat rates.

A multi-tenant event routing domain billed per million operations. The first 100K/month are free, then ~$0.60/million, 10M operations is ~$6.

A subscription that routes filtered events from a topic or Azure source to a handler. The subscription is free to define. Cost lives in Event Grid operations and in the downstream handler it invokes.

A managed event-routing topic. Priced per million operations, with a generous free tier and no always-on cost.

An individual event hub (partitioned log) inside an Event Hubs namespace. The hub itself is free. Cost lives on the parent namespace: throughput units, processing units, or dedicated capacity, plus ingress events and Capture.

A single-tenant dedicated Event Hubs cluster billed per Capacity Unit-hour. One CU is ~$6,847/month, only worth it at very high, sustained throughput.

A Kafka-compatible event streaming platform. Tier-based pricing (Basic, Standard, Premium, Dedicated) with throughput units or processing units.

A private, dedicated connection between on-premises and Azure. Priced as a monthly circuit fee by bandwidth and billing model, plus outbound data on the metered plan.

Managed network firewall. Standard SKU at $1.25/hour ($912/month) plus $0.016/GB processed. Premium SKU at $1.75/hour adds TLS inspection and IDPS. Often the most expensive single resource in a subscription.

A managed Hadoop/Hive cluster on HDInsight, billed per node-hour for head and worker VMs. A 2-head + 3-worker cluster is ~$1,894/month, and it doesn't auto-pause.

A managed Apache HBase (NoSQL wide-column) cluster on HDInsight, billed per node-hour for head and worker (region server) VMs. A 2-head + 3-worker cluster is ~$1,894/month.

A managed Hive LLAP (Interactive Query) cluster on HDInsight, billed per node-hour for head and worker VMs. A 2-head + 3-worker cluster is ~$1,894/month.

A managed Apache Kafka cluster on HDInsight, billed per node-hour for head and worker (broker) VMs. A 2-head + 3-broker cluster is ~$1,894/month, running continuously.

A managed Apache Spark cluster billed per node-hour for head and worker VMs. A 2-head + 3-worker cluster is ~$1,894/month, running continuously.

A managed FHIR (healthcare data) service billed by structured storage plus optional provisioned throughput. 100 GB of storage is ~$25/month.

A custom VM image stored as managed-disk snapshots, billed per GB-month. A 127 GB image is ~$6.35/month.

A managed IoT message broker billed per provisioned unit by tier. An S1 unit is $25/month and includes a daily message quota; you scale by adding units.

Zero-touch device provisioning for IoT Hub, billed per provisioning operation. 100K operations is ~$12, it's a low, usage-based cost.

A managed secret, key, and certificate store. Two tiers: Standard (pay-per-operation) and Premium (HSM-backed keys, higher rate).

A Key Vault access policy is free. Granting a principal permissions on a vault costs nothing. It is authorization, not a billed resource.

Storing a certificate is effectively free at rest; the charges are certificate renewals and the key operations behind it. Key Vault bills these per operation on the parent vault.

Storing a secret is effectively free; the charge is the operations against it. Key Vault bills per 10,000 operations on the parent vault, so reads and writes are the real cost.

A managed Kubernetes cluster on AKS. Control plane is free in Standard tier; you pay for the underlying node VMs and disks.

An additional node pool for an AKS cluster, billed as the underlying VMs it runs. Two Standard_D2s_v5 nodes are ~$140/month.

A managed analytics engine (Kusto) for fast queries over telemetry and logs. Priced on the underlying VM instances plus an Azure Data Explorer markup per vCPU-hour.

Layer-4 (TCP/UDP) load balancer. Standard SKU at $0.025/hour + $0.005 per processed GB. Basic SKU is free but deprecated for production (retiring 2025). Outbound rules and inbound NAT count toward the rule limit.

A load-balancing rule that maps a frontend port to a backend pool. The rule is free to define. Cost lives on the parent Standard Load Balancer: a base rule charge, per-rule overage, data processed, and the public IP.

A serverless function app. Three hosting plans with different cost models: Consumption (per-execution), Premium (always-warm), or App Service Plan (fixed).

A single Linux VM. Billed per hour for the chosen size plus a separate managed OS disk. A Standard_D2s_v5 runs ~$70/month before the disk.

A group of identical Linux VMs that scales as a unit. Priced per instance-hour by VM size times the instance count, plus per-instance managed OS disks.

A managed load-testing service billed per virtual user hour beyond a free monthly allowance. 1,050 VUH (1,000 billable) is ~$150/month.

A dedicated Log Analytics cluster requiring a daily-ingestion commitment. The minimum 100 GB/day commitment tier is ~$5,880/month, only for very high ingestion.

A management solution (such as ContainerInsights or VMInsights) enabled on a Log Analytics workspace. The solution is free to add. Cost lives in the data it causes the workspace to ingest and retain.

A workspace for ingesting, storing, and querying logs. Pay-As-You-Go by GB ingested, with optional Commitment Tiers for discounts.

A Standard-plan Logic App running on dedicated compute, billed per hour for the workflow plan. A WS1 plan is ~$143/month, regardless of how many workflows run on it.

A Consumption-plan Logic App billed per action executed, no standing fee. 1M built-in actions is ~$25; it scales to zero when idle.

An autoscaling cluster for ML training and batch jobs. Priced on the underlying VM rate per node-hour, scaling between min and max nodes with the workload.

A managed dev VM for Azure ML, billed the underlying VM rate per hour while running. A Standard_DS3_v2 is ~$214/month if left on, and idle instances are the classic waste.

A block storage disk for Azure VMs. Priced by disk type and tier (per-disk for Premium SSD, per-GB for Standard).

A high-performance Lustre file system for HPC/ML, billed per GiB of provisioned capacity by throughput tier. 4 TB at the 250 MB/s/TiB tier is ~$696/month.

Location and mapping APIs billed per transaction (tiles, routing, search). The account itself is free; usage drives cost, 100K tile transactions is ~$500 on S1.

A managed MariaDB server billed per vCore plus storage. A 2-vCore server with 50 GB is ~$182/month, but the service is retiring, so plan a migration.

A metric alert rule billed per monitored time series. A standard (static-threshold) rule is ~$0.10/month; dynamic-threshold rules are ~$0.50.

Managed SQL Server in Azure. DTU model from $4.90/month (Basic 5 DTU) or vCore model from $0.18/vCore-hour (General Purpose Serverless). Hyperscale tier scales beyond 4 TB. License-included or BYOL via Hybrid Benefit.

A shared pool of resources for many Azure SQL databases. Priced per pool vCore-hour (or DTU) plus pool storage, amortizing capacity across databases.

A fully managed SQL Server instance with near-100% engine compatibility. Priced per vCore-hour by service tier and hardware generation, plus included and overage storage.

The logical SQL server that hosts Azure SQL databases and elastic pools. The server is free. Cost lives on the databases and pools it contains: DTU or vCore compute, storage, and backup.

Managed MySQL with vCPU-based pricing. Burstable B1ms at $13.87/month, General Purpose D2ds_v4 at ~$140/month. Storage $0.115/GB-month. HA doubles compute cost; zone-redundant adds 25% on top.

The legacy MySQL Single Server, billed per vCore plus storage. A 2-vCore GP server with 50 GB is ~$70/month, but Single Server is retired, so migrate to Flexible Server.

Managed outbound SNAT for a subnet. Priced per gateway-hour plus per-GB of data processed, with the attached public IP billed separately.

A provisioned capacity pool for high-performance NFS/SMB file storage. Priced per provisioned TiB by service level, billed on allocated (not used) capacity.

A network interface is free. The NIC and its private IP cost nothing. The cost comes from the VM it attaches to, any public IP bound to it, and the traffic it carries.

A network security group is free. The group, its rules, and the traffic it filters cost nothing. The cost sits in the resources it protects and, if enabled, in flow logging.

A Flexible-orchestration VM scale set, billed per instance-hour at the VM rate. Two Standard_D2s_v5 instances are ~$140/month, scaling with the instance count.

A user (point-to-site) VPN gateway in a Virtual WAN hub, billed per scale unit-hour plus per connected user. One scale unit is ~$264/month.

A managed PostgreSQL server. Priced by compute SKU, storage size, and high-availability mode.

A logical database inside a PostgreSQL Flexible Server. The database is free. Cost lives on the parent server: compute vCores, provisioned storage, IOPS, and backup beyond the free allowance.

The legacy PostgreSQL Single Server, billed per vCore plus storage. A 2-vCore GP server with 50 GB is ~$70/month, but Single Server is retired, so migrate to Flexible Server.

Dedicated Power BI capacity for embedding analytics in apps, billed per hour by A-SKU. An A1 is ~$736/month, but it can be paused when not in use.

A private DNS A record is free to declare; the cost lives on the Private DNS zone. The zone bills a small monthly hosting fee plus a per-million-queries charge that record lookups drive.

A managed DNS resolver for hybrid name resolution between Azure and on-prem, billed per inbound/outbound endpoint-hour. Two endpoints are ~$365/month.

A private DNS zone for name resolution within VNets, billed a flat ~$0.50/zone/month plus per-million queries. 1M queries is ~$0.90.

A private IP into a PaaS service over Private Link. ~$0.01/hour per endpoint (~$7.30/month) plus $0.01/GB processed, small individually, large in aggregate.

Public IPv4 or IPv6 address. Standard SKU at $0.005/hour ($3.65/month). Basic SKU is deprecated and retiring. Per-IP charges apply whether the IP is attached or unattached.

A data-governance and catalog account billed per always-on Data Map capacity unit, plus scanning. One capacity unit is ~$300/month before scans.

The container for Azure Backup and Azure Site Recovery. The vault is free. Cost lives on what you protect: per-instance backup fees, backup storage, and Site Recovery per-instance replication.

A managed Redis cache. Priced per hour by tier (Basic, Standard, Premium, Enterprise) and cache size.

The Enterprise tier of Azure Cache for Redis, billed a flat hourly rate by SKU. An Enterprise_E10-2 runs ~$609/month, the capacity (E-number) drives the cost.

A namespace for Hybrid Connections / WCF Relay, billed per listener plus message volume. One Hybrid Connection listener is ~$9.78/month.

A resource group is free. It is a logical container for resources, not a billed service. The cost is the sum of everything you place inside it.

A role assignment is free. Granting a principal a role over a scope costs nothing. It is access control, not a billed resource.

A route is free. A single user-defined route in a route table costs nothing. The cost is whatever paid next hop the route directs traffic toward.

A route table is free. User-defined routes and their association to subnets cost nothing. The cost sits in whatever the routes point traffic at.

Managed full-text and vector search. Free tier for development. Basic at $75/month, Standard from $250/month per Search Unit. Semantic ranking and vector search included on Standard+.

Onboards a Log Analytics workspace to Microsoft Sentinel (SIEM), adding a per-GB analysis charge on top of Log Analytics ingestion. 100 GB/month is ~$430.

The compute plan that hosts Web Apps and Function Apps, billed per instance-hour by tier × worker count. A B1 plan with one worker is ~$12/month.

Enterprise messaging with queues and topics. Basic ($0.05/M operations), Standard ($0.0135/hour + $0.80/M operations), Premium ($0.99/hour per Messaging Unit). Premium for VNet isolation, predictable performance.

A Service Bus queue is free to declare; its cost is billed on the parent namespace. The namespace tier (Basic, Standard, or Premium) sets whether you pay per operation or per messaging unit.

A Service Bus subscription is free to declare; its cost is billed on the parent namespace. Each subscription receives a copy of topic messages, and those deliveries are metered operations.

A Service Bus topic is free to declare; its cost is billed on the parent namespace. Publish-subscribe fan-out means each subscription that receives a message adds a metered operation.

Managed real-time messaging over WebSockets. Priced per unit per day by tier, with included connections and messages per unit.

A VM protected by Azure Site Recovery (DR replication), billed ~$25/protected instance/month plus the storage and egress the replica consumes.

A point-in-time copy of a managed disk, billed per GB-month. A 128 GB Standard LRS snapshot is ~$6.40/month.

A managed platform for Spring Boot apps. The Standard tier carries a per-hour base fee (~$578/month) on top of per-app vCPU/memory usage.

Managed hosting for static sites with serverless API backends. Priced as a flat monthly plan fee, with a genuinely free tier for small projects.

A storage account for Blob, File, Queue, and Table services. Priced by service type, redundancy, access tier, and operations.

Declaring a blob is free; the data it holds is not. A blob drives capacity, transaction, and egress charges on the parent storage account by its size, access tier, and read volume.

A blob container is free. It is a namespace for blobs, not a billed resource. The cost is the blobs inside it and the transactions against them on the parent storage account.

A lifecycle management policy is free, and it usually lowers your bill. It tiers and expires blobs automatically on the parent storage account, cutting capacity cost.

A storage queue is free to declare. The cost is transactions and the small message capacity it holds, billed on the parent storage account by operation volume.

A managed SMB/NFS file share billed by tier and capacity. A 100 GiB standard share is ~$6/month; Premium provisions capacity at a higher rate.

A storage table is free to declare. The cost is capacity for the entities it holds and transactions against them, billed on the parent storage account by volume.

A real-time stream-processing job billed per Streaming Unit-hour. Three streaming units run ~$241/month, and the job bills while it's running whether or not events flow.

A subnet is free. Carving an address range out of a virtual network costs nothing. The cost lives in the resources you place inside the subnet and the traffic they generate.

An Apache Spark pool in Synapse billed per vCore-hour of active nodes. Three Small nodes running full-time are ~$1,253/month, but auto-pause makes the real cost usage-driven.

A dedicated, provisioned data-warehouse pool. Priced per cDWU-hour by performance level, plus separately-billed storage, and pausable to stop compute charges.

Unified data warehouse + Spark + serverless SQL + Data Factory pipelines. Dedicated SQL pool from $1.20/DWU-hour. Spark pool $0.143/vCore-hour. Serverless SQL $5/TB scanned. Workspace itself is free.

DNS-based global load balancing billed per million DNS queries plus per monitored endpoint. 10M queries with 2 endpoints is ~$6/month.

A user-assigned managed identity is free. Creating a standalone identity and attaching it to resources costs nothing. It removes credentials, not charges.

The central hub of an Azure Virtual WAN, billed per hour for the hub plus per GB of data processed. The hub base is ~$182.50/month before data and gateways.

A virtual network is free. The address space, subnets, and the network itself cost nothing. The bill comes from the paid resources you run inside it and the traffic it carries.

A VPN (or ExpressRoute) gateway billed per hour by SKU. A VpnGw1 runs ~$139/month just to exist, before any data processing.

A scalable VPN gateway in a Virtual WAN hub, billed per scale unit-hour. One scale unit is ~$264/month, plus data processed through the hub.

Managed real-time messaging over WebSockets with a pub/sub model. Priced per unit per day by tier, with included connections and messages per unit.

A single Windows VM. Bills per hour for the size, including a Windows license surcharge, plus a managed OS disk. A Standard_D2s_v5 runs ~$137/month before the disk.

A fleet of identical Windows VMs that scales as a unit, billed per instance-hour (Windows rate). Three Standard_D2s_v5 instances are ~$412/month.

PostgreSQL-compatible managed database with up to 4x faster queries than standard PG. CPU $0.06814/vCPU-hour + memory $0.00822/GB-hour. Storage $0.30/GB-month. Designed for OLTP and analytical workloads.

A PostgreSQL-compatible instance within an AlloyDB cluster. Priced per vCPU-hour and per GB of memory-hour, plus separately-billed cluster storage.

A managed gateway for serverless backends. Priced per million API calls, with a free tier and no always-on cost.

A managed registry for container images, Helm charts, language packages. $0.10/GB-month storage plus data transfer.

A serverless data warehouse dataset. Two pricing models: on-demand ($6.25/TB scanned) or capacity-based (slot-hours).

A BigQuery job is free to submit. A query job bills per TiB of data scanned under on-demand pricing; load, copy, and export jobs are free. Bytes scanned is the cost.

Dedicated BigQuery compute capacity (slots) for predictable query pricing. Priced per slot-hour by edition, billed for the reserved slot count.

A BigQuery table is free to declare. Cost comes from the data stored in it per GB-month and the bytes queries scan against it, so schema and partitioning drive the real bill.

Wide-column NoSQL for low-latency, high-throughput workloads. $0.65/node-hour (SSD) or $0.17/node-hour (HDD) plus storage. 3-node minimum production. Replication to another region doubles node cost.

TLS certificates for Google Cloud load balancers. Google-managed and self-managed certificates are free. Cost lives in the load balancer that serves them and, for private PKI, in Certificate Authority Service.

A managed intrusion detection endpoint built on Palo Alto threat engines. Priced per endpoint-hour plus per-GB of traffic inspected.

A serverless container service. Billed by request count and per-request CPU/memory time. Generous free tier.

A fully managed container service that scales to zero. Priced per vCPU-second and GiB-second while requests are being handled, plus per-request fees.

A managed cron job that triggers HTTP, Pub/Sub, or App Engine targets on a schedule. Priced per job per month, with the first three jobs free.

Managed task queue for HTTP/gRPC targets. First 1M tasks/month free, then $0.40 per million tasks. No queue infrastructure to manage. Tasks call HTTP endpoints (Cloud Run, Cloud Functions, GKE services) with retry and rate limiting.

A 1st-gen serverless function. Priced per invocation plus compute time (GHz-seconds and GB-seconds), with a generous free tier and scale to zero.

A serverless function (2nd gen, Cloud Run-based). Billed per invocation, vCPU-time, memory-time, and outbound networking.

Managed Apache Airflow. Composer 2: ~$455/month minimum (web server $73 + scheduler $73 + workers $25/CPU + Cloud SQL $73). Composer 3 introduces serverless workers. Often the priciest 'orchestration' bill.

A reserved static IP address. Per-hour charge based on attachment state and IP version (IPv4 vs IPv6).

Attaches an existing persistent disk to a Compute Engine instance. The attachment is free. Cost lives on the disk itself: provisioned capacity by disk type, plus snapshots and regional replication.

An autoscaler is free. It varies the size of a managed instance group with demand. The cost is the VMs it runs, which floats between the min and max you set.

A backend service is free configuration. It binds a load balancer to its backends and their health checks. The Cloud Load Balancing charge lands on the forwarding rule plus data processed.

A block storage disk for Compute Engine VMs. Priced per GB-month by disk type. Hyperdisk adds per-IOPS and per-throughput billing.

A VPC firewall rule is free. It allows or denies traffic to and from instances at no cost. The bill comes from the resources the rule protects and the traffic it permits.

A regional forwarding rule is where the Cloud Load Balancing charge lands. It bills an hourly rate per rule plus per-GB data processed, on top of the backends behind it.

A reserved global static external IP. Charged ~$0.01/hour (~$7.30/month) only while reserved-but-unattached, attached to a load balancer it's free.

A global forwarding rule is where the global Cloud Load Balancing charge lands. It bills an hourly rate per rule plus per-GB data processed, in front of a global HTTP(S) or proxy load balancer.

A high-availability IPsec VPN gateway with a 99.99% SLA. Priced per tunnel-hour, plus standard egress on traffic leaving Google Cloud.

A health check is free. It probes backends to decide which are eligible for traffic. The cost sits on the load balancer's forwarding rule and the backends it protects.

A Google Compute Engine VM. Priced per second by machine type, region, and license. Sustained-use discounts apply automatically.

An instance group is free. It manages a fleet of VMs from a template. The cost is the running VMs times the group's size, priced by machine type and disk.

A managed instance group that runs and autoscales a fleet of identical VMs, billed as the Compute Engine instances. 3× e2-medium is ~$73/month.

An instance template is free. It is a blueprint for VMs. The cost is every VM a managed instance group stamps out from it, priced by machine type and disk.

A VLAN attachment connecting your VPC to a Cloud Interconnect, billed per hour by capacity. A 1 Gbps attachment is ~$75/month, plus egress over the link.

A VPC network is free. The network, its routes, and internal traffic within a region cost nothing. The bill comes from the resources you run inside it and the traffic that leaves it.

A regional (multi-zone) managed instance group, billed as the Compute Engine VMs it runs across zones. 3× e2-medium is ~$73/month.

A VPC route is free. It tells traffic where to go within a network. The cost sits on the next hop it points at, such as a Cloud NAT gateway or a VM, and the egress it enables.

A Cloud Router is free. It runs BGP to exchange dynamic routes at no charge. The cost lands on what it hosts, chiefly Cloud NAT, and on the VPN or Interconnect attachments it advertises.

Managed NAT gateway for private GKE/VMs reaching the internet. $0.044/hour per gateway + $0.045/GB processed. Significantly cheaper than AWS NAT Gateway, and outbound to Google services is free via Private Google Access.

A Cloud Armor (Enterprise tier) WAF/DDoS policy billed per policy plus per rule, plus request inspection. A policy with 5 rules is ~$10/month before requests.

A subnetwork is free. It carves a regional IP range out of a VPC, and the cost comes from the resources placed in it and the traffic they generate.

A target HTTP proxy is free. It connects a forwarding rule to a URL map for HTTP load balancing. The Cloud Load Balancing charge sits on the forwarding rule and data processed.

A target HTTPS proxy is free, and so are Google-managed SSL certificates. It terminates TLS and routes via a URL map. The Cloud Load Balancing charge sits on the forwarding rule and data processed.

A URL map is free. It routes requests by host and path to backend services. The Cloud Load Balancing charge sits on the forwarding rule and data processed.

An IPsec VPN tunnel to an on-premises or peer network, billed per tunnel-hour. One tunnel is ~$37/month, and HA VPN needs two, plus egress over the tunnel.

A managed Kubernetes cluster on GKE. Two operating modes: Standard with per-cluster management fee, or Autopilot priced per pod.

Compute Engine worker nodes for a GKE cluster. Bills as the VMs it runs: node_count × machine_type. 3× e2-standard-4 is ~$294/month.

A managed Apache Beam job for streaming and batch data processing. Priced per worker-hour by machine type and tier, plus data processed.

Managed Spark, Hadoop, Flink, and Presto. Bills underlying Compute Engine VMs + $0.010/vCPU-hour Dataproc fee. Dataproc Serverless eliminates cluster management. Dataproc on GKE runs Spark on existing GKE.

A managed Hive metastore for data lakes. Priced as a flat hourly service fee by tier, billed continuously while the service runs.

A managed DNS zone. Priced per zone per month plus per-query, both at low flat rates that scale with the number of zones and query volume.

A network-level Cloud DNS policy for inbound or outbound forwarding, alternative name servers, and query logging. The policy is free. Cost lives in Cloud DNS zones and queries and in the logging it can enable.

A DNS record set is essentially free to define. Cloud DNS bills per managed zone per month and per million queries, so cost scales with zones and query volume, not with individual records.

Managed NFS file storage. Basic HDD at $0.16/GB-month (1 TB min). Basic SSD at $0.30/GB-month. Enterprise tier at $0.45/GB-month with regional replication. High Scale at $0.10/GB-month for parallel workloads.

A serverless document database billed by reads, writes, deletes, and storage, no instances. 10M reads + 2M writes + 50 GB is ~$19/month, with a free daily tier.

Customer-managed encryption keys. Software keys $0.06/key-month + $0.03/10K operations. HSM keys $1-$2.50/key-month + $0.03/10K operations. External Key Manager (EKM) keys also supported.

An individual cryptographic key version in Cloud KMS, billed per active version per month (software ~$0.06; HSM more), plus per cryptographic operation.

A KMS key ring is free. It is a regional container that groups crypto keys. The cost is on the keys inside it: active key versions and cryptographic operations.

A bucket for storing GCP logs. Ingestion is $0.50/GiB beyond the free tier; storage beyond 30 days is $0.01/GiB-month.

Routes matching log entries from a project to a destination such as BigQuery, Cloud Storage, Pub/Sub, or another log bucket. The sink is free. Cost lives in the destination and in Cloud Logging ingestion.

A managed Looker BI platform instance. Priced per instance-hour by platform edition, billed continuously while the instance runs.

A managed Memcached cluster. Priced per node by vCPU-hour and memory GB-hour, multiplied across the node count.

A managed JupyterLab notebook VM for data science. Priced at the underlying Compute Engine rate per hour, plus boot disk and any attached GPUs.

A managed private certificate authority. Priced as a flat monthly CA fee by tier, plus a per-certificate issuance charge.

Grants a role to a set of members at the project level, authoritatively for that role. IAM is always free. Cost lives in what the granted access lets members create and consume, and in the audit logs it can generate.

A project IAM binding is free. It grants a role to a member at the project level. It has no charge; it only enables access to resources that may cost money.

A Pub/Sub subscription is free to create. Cost comes from message throughput delivered, retained storage for unacked or replayable messages, and egress to the subscriber.

A pub/sub topic for messaging. Priced per TB of message ingestion and delivery, with a generous free tier.

A horizontally-scalable, sharded Redis Cluster on Memorystore. Priced per shard-node-hour by capacity, multiplied across shards and replicas.

A managed Redis instance. Priced per GB-hour by service tier (Basic or Standard) and capacity.

A managed secret with versioning and IAM access. $0.06/month per active secret version, plus per-access fees beyond the free tier.

A secret version holds one payload of a secret. Secret Manager bills per active secret version per month and per 10,000 access operations, so cost tracks versions and how often they are read.

A service account is free. It is an identity for workloads to authenticate and be granted permissions. It has no charge and no cost drivers of its own.

Globally-consistent, horizontally-scalable SQL database. $0.90/node-hour ($657/month) for regional, $3/node-hour for multi-region. Storage $0.30/GB-month regional, $0.50/GB-month multi-region. Processing Units offer 1/1000th node granularity.

A managed MySQL, PostgreSQL, or SQL Server database. Priced by tier, storage, and HA mode. Sustained-use discounts apply.

Object storage on GCS. Priced by storage class, region, operations, and egress. Lifecycle rules can auto-tier cold data.

Grants a role to members on a single Cloud Storage bucket, authoritatively for that role. IAM is free. Cost lives in the bucket's storage, operations, and egress, and a public grant can drive a large egress bill.

A bucket IAM binding is free. It grants a role to a member on a Cloud Storage bucket. The cost is the bucket itself: its stored data, operations, and egress.

Managed ML inference endpoint. Bills n1-standard-2 at $0.05/hour up to GPU-backed n1-highmem-32 at $5+/hour. Foundation model endpoints (Gemini, PaLM) bill per-token. Batch prediction available for offline workloads.

A dedicated VMware vSphere cluster running on Google Cloud. Priced per ESXi node-hour, with a multi-node minimum that makes this one of the largest standing costs.

A managed Jupyter notebook VM for Vertex AI, billed the underlying Compute Engine rate per hour. An e2-standard-4 is ~$98/month if left on, idle notebooks are the waste.

Serverless orchestration that chains services and APIs. Priced per step executed, separating cheaper internal steps from pricier external HTTP calls.

TLS certificates for AWS services. Public certificates are free with auto-renewal. Private CA-issued certificates bill $400/month per private CA. Wildcard and SAN certificates included at no extra cost.

A managed private certificate authority. Priced as a flat monthly CA fee by mode, plus a per-certificate issuance charge.

Managed hosting for web apps, billed by build minutes, served data, and storage. A small app (500 build min, 15 GB served, 5 GB stored) is ~$7/month.

A REST API endpoint. Priced per request, with no base hourly fee. Cheaper than ALB at low volume.

An HTTP verb (GET, POST, etc.) on a REST API resource. The method definition is free. The REST API it belongs to bills $3.50 per million requests plus data transfer, and optional caching adds $0.02 to $3.80 per hour.

HTTP and WebSocket APIs. HTTP API is 70% cheaper than REST API: $1.00 per million requests vs $3.50. WebSocket connections billed separately by connection-minute and messages.

A route (like GET /items or a WebSocket action) on an HTTP or WebSocket API. Routes are free. The parent API bills $1.00 per million requests for HTTP APIs, or per message plus connection minutes for WebSocket APIs.

A deployment stage (like prod or dev) for an HTTP or WebSocket API. Stages are free. They are where access logging and detailed metrics are enabled, and both of those feed billed CloudWatch Logs and metrics.

An Application Auto Scaling target is free. It registers a resource (ECS service, DynamoDB table, and others) as scalable, and the cost is the capacity that resource runs at.

A managed container service that scales to zero between requests. Priced on provisioned memory plus active vCPU, with separate build minutes.

A fleet of streaming application instances. Bills per instance-hour by type × fleet size. Two stream.standard.medium instances always-on are ~$146/month.

A managed GraphQL API with real-time subscriptions. Priced per query/mutation operation and per real-time update, plus connection minutes and optional caching.

Serverless query engine for S3 data. $5 per TB scanned (standard). Provisioned capacity option starts at $0.30/DPU-hour with 24-hour minimum. Workgroups themselves are free; the queries within bill.

An Auto Scaling Group is free to create. Its cost is entirely the EC2 instances it launches, so the bill scales with desired_capacity times the instance type times uptime.

Logical container for backups managed by AWS Backup. Vaults themselves are free; you pay for the storage of recovery points ($0.05/GB-month warm, $0.01/GB-month cold) plus restore data transfer.

A CDN distribution. Priced by data transfer to viewers and request count, with rates varying by region.

A dedicated, single-tenant hardware security module billed per HSM-hour. One HSM is ~$1,168/month, and production needs at least two for HA.

An audit log of AWS API calls. Management events are free. Data events and Insights are billed per event.

A CloudWatch dashboard for visualizing metrics, billed ~$3/dashboard/month. The first 3 dashboards (with limited metrics) are free.

An EventBridge (CloudWatch Events) rule that routes events to targets. The rule is free; custom events published cost ~$1/million. AWS-service events are free.

A log group for storing application and AWS service logs. Priced by ingestion ($0.50/GB), storage ($0.03/GB-month), and queries.

A metric filter is free. It scans log events for a pattern and emits a CloudWatch metric, and cost sits on the log group and the metric or alarm it feeds.

A log stream is free. It is a named sequence of log events inside a log group, and cost comes from the bytes ingested and stored in the group, not the stream.

A subscription filter is free to define, but it streams matching log events in real time to a destination like Lambda or Kinesis, and that destination is where cost lands.

Alarm that triggers actions when a metric breaches a threshold. $0.10/alarm-month for standard resolution. High-resolution alarms (10s) cost $0.30/month. Composite alarms are free per logical condition.

A package-registry domain billed by stored artifacts, requests, and cross-region data transfer. 100 GB + 1M requests is ~$10/month.

A managed build environment for CI/CD. Priced per build-minute by compute type, with no idle cost between builds.

A CodeCommit repository is free to create and free for the first five active users per month; beyond that it bills a flat rate per active user with generous included storage and requests.

A logical container for CodeDeploy deployment groups. Applications are free, and deployments to EC2 and Lambda are free too. Only on-premises instance deployments bill, at $0.02 per instance update.

A CodeDeploy deployment group is free, and deployments to EC2, Lambda, and ECS carry no CodeDeploy charge; the cost is the compute it deploys to.

A managed CI/CD pipeline billed ~$1/month per active pipeline (V1). The cost is trivial; the spend lives in the compute the pipeline triggers.

A managed user directory for sign-up and sign-in. Priced per monthly active user (MAU) above a free tier, with the rate set by the feature tier.

A compliance rule evaluated by AWS Config, billed per rule evaluation. 10,000 evaluations is ~$10; cost scales with resource changes and rule count.

Records resource configuration changes into AWS Config, billed per configuration item. 10,000 items is ~$30; cost is driven by recording scope and churn.

Defines where AWS Config delivers configuration snapshots and history (an S3 bucket, optionally an SNS topic). The channel is free. AWS Config bills $0.003 per configuration item recorded plus rule evaluations and S3 storage.

A customer gateway is free. It just records the on-premises side of a VPN (public IP and BGP ASN). The cost is the VPN connection it participates in.

An in-memory write-through cache for DynamoDB. Priced per node-hour by node type, multiplied across the cluster's node count.

A managed relational database instance on RDS. Priced per hour by instance class, engine, deployment option, and region, with storage and IOPS billed separately.

A container of optional features (like SQL Server native backup, Oracle OEM, or TDE) for an RDS instance. Option groups are free. The RDS instance bills per hour, and some options carry licensing or storage cost.

A DB parameter group is free. It is the engine configuration attached to an RDS instance, and the cost stays entirely on the instance it tunes.

A managed connection pool in front of RDS or Aurora. Priced per vCPU-hour of the proxied database instances, billed continuously.

A manual snapshot of an RDS instance, billed per GB-month of backup storage beyond the free allowance. A 50 GB snapshot is ~$4.75/month.

A DB subnet group is free. It tells RDS which subnets a database can live in, and the cost is entirely the RDS instance it enables.

A Direct Connect gateway is free. It is a global routing hub for Direct Connect. The cost is the Direct Connect connection port hours and the data transfer out that flows over it.

A Link Aggregation Group that bundles multiple Direct Connect connections into one logical link. The LAG object is free. Each member connection bills per port-hour, from about $0.30/hour for 1 Gbps to $22.50/hour for 100 Gbps, plus data transfer out.

A managed directory (Microsoft AD, Simple AD, or AD Connector) billed per hour. Standard Microsoft AD is ~$88/month; Simple AD is cheaper.

A managed instance that runs database migration and replication tasks. Priced per instance-hour by class, doubled for Multi-AZ, plus storage.

MongoDB-compatible managed document database. Instance-hour ($0.277/hour for db.r6g.large) plus storage ($0.10/GB-month) plus I/O ($0.20/M-requests). Backup storage above retention is $0.021/GB-month.

A dedicated physical network link to AWS, billed per port-hour by speed plus data transfer out. A 1 Gbps port is ~$219/month before egress.

A managed NoSQL table. Pay-per-request (on-demand) or provisioned capacity, plus storage. No instances to manage.

A DynamoDB table item is free to define, but it adds to the table's stored data and consumes write and read capacity, so its cost is realized on the table.

A point-in-time backup of an EBS volume, stored in S3. $0.05/GB-month standard (incremental), or $0.0125/GB-month in the archive tier.

A persistent block storage volume. Priced per GB-month by volume type, with separate IOPS and throughput charges on certain types.

A physical server dedicated to your account, billed per host-hour by instance family. An m5 dedicated host is ~$3,700/month, you pay for the whole host, not the instances on it.

A network hub connecting multiple VPCs, VPNs, and Direct Connects. $0.05/hour per attachment plus $0.02/GB processed.

Attaches a VPC to a Transit Gateway, billed ~$0.05/hour (~$36.50/month) per attachment plus the data the TGW processes for it.

A container image registry. Priced per GB-month stored, with the first 500 MB free, plus data transfer charges.

An ECS cluster. The cluster itself is free. Cost comes from the EC2 instances and Fargate tasks that run inside it.

A long-running ECS service. Cost depends on launch type: EC2 (pay for nodes), Fargate (pay per task vCPU/memory), or Fargate Spot.

A task definition is free. It declares CPU and memory for a container task, and those numbers set the Fargate cost when an ECS service runs the task.

An EFS access point is free. It is an application-specific entry point into an EFS file system, and the cost is the EFS storage and throughput it maps into.

A managed NFS file system for shared access from EC2, ECS, EKS, and Lambda. Priced per GB stored, with tiered storage classes.

An EFS mount target is free. It gives an EFS file system a network endpoint in one subnet, and the real cost is the EFS storage and throughput behind it.

A static public IPv4 address. Free while attached and in use, $0.005/hour while detached or unassociated. As of 2024, also charges per-hour for attached IPv4 in some scenarios.

An EIP association is free. It binds an Elastic IP to an instance or network interface. The cost sits on the Elastic IP itself, which is free while attached to a running instance and billed when idle.

A managed Kubernetes control plane. Flat $0.10/hour per cluster, with worker nodes and storage billed separately.

A Fargate profile is free. It is a selector that decides which Kubernetes pods run on Fargate, and those pods are billed per vCPU-hour and per GB-hour while they run.

Managed EC2 worker nodes for an EKS cluster. The node group has no charge of its own, it bills as the EC2 instances it launches. 3× m5.large is ~$210/month.

Managed Redis or Memcached. Priced per node-hour by instance type, with no storage or request charges.

A named set of engine parameters for ElastiCache (Redis or Memcached) clusters. Parameter groups are free. The clusters they configure bill per node-hour, from about $0.017/hour for cache.t3.micro to $0.90+/hour for large nodes.

A Redis (or Valkey) replication group with primary and replica nodes, optionally cluster-mode sharded. Priced per node-hour by node type across all shards and replicas.

A serverless Redis or Valkey cache that scales automatically. Priced per GB-hour of data stored plus per million ElastiCache Processing Units (ECPUs).

An ElastiCache subnet group is free. It tells ElastiCache which subnets a cache cluster can run in, and the cost is entirely the cache nodes it enables.

The legacy Elasticsearch Service domain (now OpenSearch). Bills per data-node instance-hour plus storage. A single t3.small.search node is ~$26/month.

Managed Hadoop, Spark, Hive, Presto, and HBase. Bills EC2 instance hours plus EMR service fee (typically $0.063-$0.27/instance-hour on top of EC2). EMR Serverless eliminates instance management; EMR on EKS allows reusing EKS clusters.

A Firewall Manager policy that centrally manages WAF/Shield/security-group rules across accounts, billed ~$100/policy/region/month, plus the resources it deploys.

Managed file storage for Windows, Lustre, NetApp ONTAP, and OpenZFS workloads. Pricing varies wildly: from $0.025/GB-month (Lustre HDD) to $0.30+/GB-month (Windows SSD with deduplication).

A high-performance Lustre file system for HPC and ML. Bills per GB of provisioned storage, with throughput coupled to capacity. 1.2 TB at 125 MB/s/TiB is ~$174/month.

A managed NetApp ONTAP file system with multiprotocol access and NetApp features, billed per GB of SSD capacity plus throughput. 1 TB Multi-AZ is ~$256/month.

A managed OpenZFS file system for NFS workloads with ZFS features, billed per GB of SSD capacity plus throughput. 64 GB Single-AZ is ~$5.76/month.

A managed SMB file system with Active Directory integration. Bills per GB of provisioned storage plus throughput; 32 GB SSD Single-AZ is ~$4/month, scaling with capacity.

A vault for long-term archival storage, billed per GB-month at the deep-archive rate. 1 TB is ~$3.60/month, cheap to store, but retrieval costs time and money.

Anycast IPs that route users to the nearest healthy endpoint over the AWS backbone. Priced as a fixed hourly fee plus a per-GB data transfer premium.

A Glue Data Catalog database is effectively free (the first million objects and requests are free) and the real cost is the querying, crawling, and ETL that use it.

A crawler that catalogs data sources into the Glue Data Catalog, billed per DPU-hour while it runs. 10 DPU-hours/month is ~$4.40, it only bills during crawl runs.

A managed ETL job using Spark or Python shell. Priced per DPU-hour with 1-minute billing minimum, plus development endpoint and Data Catalog costs.

A managed Grafana workspace for dashboards. Priced purely per active user per month by role, with no always-on infrastructure fee.

Managed threat detection billed by the volume of CloudTrail events, VPC flow logs, and DNS logs analyzed. ~10M events + 100 GB logs is ~$140/month.

A long-lived access key ID and secret for an IAM user. Access keys are free to create and use, but a leaked key is one of the most expensive incidents in AWS, capable of running up tens of thousands of dollars in hours.

An IAM group is free. It bundles users so they share a set of policies. AWS charges nothing for the group. Cost comes from what the member users are permitted to do.

An instance profile is free. It is the wrapper that passes an IAM role to an EC2 instance. AWS charges nothing for it. Cost lives in the instance and what its role lets it do.

An IAM policy is free. It is a JSON permission document. AWS charges nothing for creating, attaching, or evaluating policies. Cost lives in the services the policy permits.

An IAM role is completely free. IAM is a no-cost service. A role grants permissions to whatever assumes it, and the cost is whatever those services do, never the role.

An inline IAM policy embedded directly in a role. IAM is completely free, there is no charge for roles, policies, or evaluation. The cost lives in the AWS services the policy grants access to.

Links a managed IAM policy to a role. The attachment is free, as is all of IAM. What it grants determines how much the role can spend, so it is a cost-governance control point.

An IAM user is free. Creating users, their access keys, and login profiles costs nothing. The cost is whatever AWS services the user is permitted to operate.

An EC2 virtual machine. Priced per hour by instance type, OS, tenancy, and region, with separate charges for attached EBS volumes and data transfer.

An internet gateway is free. Attaching one to a VPC and routing through it costs nothing. The cost is the data transfer out to the internet that it enables.

A managed intelligent-search index. Priced as a flat hourly fee by edition, billed continuously, with a substantial monthly floor.

A managed stream that loads data into S3, Redshift, OpenSearch, or Splunk. Priced per GB ingested, with extras for format conversion and VPC delivery.

A real-time data stream. Two capacity modes: Provisioned (priced per shard-hour) or On-Demand (priced per record and per GB).

A managed Apache Flink (Kinesis Data Analytics) application billed per Kinesis Processing Unit-hour. Two KPUs run ~$161/month, billed while the application runs.

A KMS alias is free. It is a friendly name pointing at a KMS key. AWS charges nothing for the alias. Cost comes from the underlying KMS key and its API requests.

A temporary, scoped permission to use a KMS key. Grants are free. The key it points at costs about $1/month, and the encrypt/decrypt API calls the grant enables bill per request.

A managed encryption key. Flat $1/month per key, plus per-request charges for cryptographic operations.

A Lambda alias is free. It is a named pointer to a function version used for stable references and traffic shifting, and cost stays on the function it points to.

An event source mapping is free. It connects a stream or queue to a Lambda function, and the cost is the invocations it drives plus any polling charges on the source.

A serverless function billed by request count and execution duration. Free tier covers 1M requests and 400,000 GB-seconds per month.

A Lambda function URL is free. It gives a function a public HTTPS endpoint with no API Gateway, and the cost is the function invocations that requests trigger.

A Lambda layer version is free to publish and store. It packages shared dependencies for functions, and the cost stays on the Lambda functions that use it.

A Lambda permission is free. It grants a service or account the right to invoke a function, and cost comes from the invocations that permission then enables.

A launch configuration is free. It is a legacy blueprint for EC2 instances, so cost appears only when an Auto Scaling Group uses it to launch instances.

A launch template is free. It is a blueprint for EC2 instances, so its cost is realized only when an Auto Scaling Group or fleet uses it to launch instances.

A managed load balancer (ALB or NLB). Priced per hour plus per LCU/NLCU based on processed traffic.

A listener is free. It checks for connections on a port and forwards them, so the cost is the load balancer it belongs to, not the listener.

A target group is free. It routes traffic to registered targets for an ALB or NLB, and the cost sits on the load balancer and the targets themselves.

Simplified object storage sold as a flat monthly bundle with included storage and transfer. The small bundle is ~$1/month, all-in.

A simplified managed database (MySQL/PostgreSQL) sold as a flat monthly bundle. The micro bundle is ~$15/month, all-in; HA bundles cost more.

A simplified CDN fronting a Lightsail (or other) origin, sold as a flat monthly bundle with an included transfer allowance. The small bundle is ~$2.50/month.

Simplified VPS bundles for small workloads. Flat monthly pricing from $3.50/month (512 MB) to $160/month (64 GB). Includes data transfer allowance. Much simpler than EC2 but limited features.

Managed sensitive-data discovery for S3, billed per bucket evaluated plus per GB inspected. 50 buckets + 100 GB inspected is ~$105/month.

Sets which route table is the main (default) table for a VPC. The association is free, but it decides the default path for any subnet without an explicit table, and that path can silently route traffic through paid NAT or transit gateways.

A durable, Redis-compatible in-memory database. Priced per node-hour across all shards and replicas, plus per-GB data written and snapshot storage.

A managed ActiveMQ or RabbitMQ message broker. Priced per broker-instance-hour by instance type and deployment mode, plus storage.

A managed Apache Kafka cluster. Priced per broker-hour by instance type, plus EBS storage per GB-month and data transfer.

A serverless Apache Kafka cluster that scales automatically. Priced per cluster-hour plus partition-hours, storage, and data in/out.

A managed Apache Airflow environment. Priced per environment-hour by size, plus additional worker and scheduler hours and metadata storage.

A managed NAT gateway for outbound internet access from private subnets. Notoriously expensive: $0.045/hour plus $0.045/GB processed.

Managed graph database supporting Gremlin, openCypher, and SPARQL. Instance hours ($0.348/hour for db.r5.large) plus storage ($0.10/GB-month) plus I/O ($0.20/M requests). Neptune Serverless offers auto-scaling per-NCU.

A compute instance in a Neptune graph-database cluster, billed per instance-hour by class. A db.r5.large runs ~$254/month, and a cluster usually has a writer plus readers.

An elastic network interface is free. AWS charges nothing for the ENI or its private IPs. Cost comes from the instance it attaches to, any Elastic IP left idle on it, and the traffic it carries.

A managed VPC firewall billed per endpoint-hour plus traffic processed. One endpoint with 100 GB is ~$295/month, and multi-AZ deployments multiply the endpoint fee.

A managed OpenSearch (formerly Elasticsearch) cluster. Priced per node-hour by instance type, plus storage and optional UltraWarm/Cold tiers.

Serverless OpenSearch billed per OpenSearch Compute Unit-hour, with a minimum capacity floor. The 4-OCU minimum is ~$701/month.

A member account inside an AWS Organization. Creating and managing accounts is free. The cost lives inside each account: all EC2, S3, RDS, and data transfer usage rolls up to the organization's consolidated bill.

The root container for multi-account AWS. AWS Organizations is free. It is the mechanism behind consolidated billing, Reserved Instance and Savings Plans sharing, and Service Control Policies that cap spend.

Service Control Policies, tag policies, and backup policies attached to an organization. The policies are free. Their job is to prevent spend: SCPs can block expensive instance families, regions, and untagged resources.

Managed Prometheus billed by samples ingested and metrics stored, no node cost. 1B samples + 100 GB storage is ~$93/month, and the bill scales with metric cardinality.

A serverless immutable ledger database billed by write IOs, read IOs, and journal/indexed storage, no instances. 10M write IOs + 20 GB is ~$12/month.

An Aurora cluster (MySQL or PostgreSQL compatible). Priced by per-instance compute, storage by GB used, and I/O (Standard) or compute (I/O-Optimized).

A compute instance in an Aurora cluster, billed per instance-hour by class. A db.r6g.large Aurora PostgreSQL instance is ~$247/month, and a cluster usually runs several.

A managed data warehouse. Two compute models: classic node-based pricing (per-hour) or Redshift Serverless (per-RPU-hour), plus managed storage.

A set of engine parameters for a Redshift cluster. Parameter groups are free. The clusters they configure bill per node-hour, from $0.25/hour for dc2.large to $13/hour for ra3.16xlarge, plus Spectrum and concurrency scaling.

Serverless Redshift compute billed per RPU-hour only while queries run. 100 RPU-hours is ~$36; idle workgroups cost nothing for compute.

A single entry in a VPC route table. Routes are free, but they point traffic at targets like NAT gateways, transit gateways, and VPC peering, and those targets plus the data transfer they carry are where the cost is.

A route table is free. It is a set of routing rules for a VPC, and AWS charges nothing for the table, its routes, or its associations. Cost lives in the targets those routes point at.

A health check that monitors an endpoint for DNS failover, billed ~$0.50/month for AWS endpoints or ~$0.75 for external ones, plus optional feature add-ons.

Enables DNS query logging for a Route 53 public hosted zone. The logging config is free, but every query it records is written to CloudWatch Logs, which bills for ingestion and storage.

A Route 53 record is free to create. There is no per-record charge. Cost comes from DNS queries against the hosted zone and from any health checks the record uses.

An inbound or outbound DNS resolver endpoint for hybrid name resolution, billed per elastic network interface (IP) per hour. Two IPs are ~$183/month, plus DNS query charges.

A DNS hosted zone. Flat $0.50/month per zone, plus tiered per-query charges.

A zone association is free. It attaches a VPC to a private hosted zone so the VPC can resolve its records. Cost comes from the hosted zone and its query volume, not the association.

Object storage on S3. Priced by storage class, request count, and data transfer, with the bucket itself being free.

Sets the access control list on an S3 bucket. The ACL configuration is free. The bucket it governs bills for storage, requests, and data transfer, which is where all S3 cost lives.

Defines cross-origin resource sharing rules for an S3 bucket. The CORS config is free. It enables browsers to fetch objects directly, which drives the request and data transfer charges on the bucket.

An S3 lifecycle configuration is free, and it is one of the strongest cost levers in S3: it transitions objects to cheaper storage classes and expires old data automatically.

Enabling S3 server access logging is free, but it writes a stream of log objects into a target bucket that you pay to store and, eventually, to query or delete.

An S3 bucket notification is free to configure. It routes bucket events to Lambda, SQS, or SNS, and cost lands on whichever destination processes the events.

An S3 bucket policy is free. It is an IAM resource policy attached to a bucket, and cost stays with the bucket and the requests the policy allows.

A public access block is free. It is a safety toggle that stops a bucket from becoming public, and cost stays with the bucket and the requests it serves.

Setting default encryption on a bucket is free. Encryption itself adds no charge, but choosing aws:kms means each object request also triggers a billable KMS call.

Enabling S3 versioning is free, but it multiplies storage cost by keeping every old version of an object as billable data until something deletes it.

An S3 object is billed for the bytes it stores at its storage class rate, plus the request to upload it, so cost scales with object size and how many objects you keep.

Real-time ML inference endpoint. Bills instance hours 24/7 (e.g., $0.0532/hour for ml.t2.medium, up to $30+/hour for ml.p4d.24xlarge). Serverless inference bills per-invocation. Async inference for batch-like workloads.

A managed Jupyter notebook instance billed per hour while running. An ml.t3.medium is ~$37/month if left on 24/7, and idle notebooks are the classic waste.

A managed secret with versioning, rotation, and IAM-controlled access. Flat $0.40/month per secret plus per-API-call charges.

A secret version is free. It is one stored value of a secret. Secrets Manager bills per secret and per API call, not per version, so adding versions adds nothing.

Security groups are free. There is no charge for the group, its rules, or the traffic it allows. The cost sits in the resources it protects.

Centralized security posture management, billed per security check and per finding ingested. 100K checks/month is ~$100, with tiers lowering the rate at scale.

Workflow orchestration. Standard workflows at $0.025 per 1,000 state transitions. Express workflows at $1 per 1M requests + duration fees. Standard for long-running workflows; Express for high-volume short workflows.

Enrolls a resource in AWS Shield Advanced DDoS protection. Shield Advanced is a flat ~$3,000/month subscription per organization, shared across all protected resources.

A pub/sub topic for sending notifications. Priced per message published, per delivery, and by destination protocol.

Subscribes an endpoint to an SNS topic. Creating the subscription is free, but SNS bills per message delivered, and the rate varies enormously by protocol: HTTP and email are cheap, SMS can be expensive.

An EC2 instance run at Spot prices, up to ~90% below on-demand, in exchange for possible interruption. c3x prices it at the on-demand ceiling (a t3.micro is ~$7.59/month).

A managed message queue. Priced per request, with no per-queue or storage fee. Generous free tier.

A resource policy that controls who can send to or receive from an SQS queue. The policy is free. The queue bills per request, and a policy that opens the queue too wide can enable a flood of billable requests.

Binds an SSM document to target instances so State Manager keeps them in a desired configuration. The association is free on standard EC2, but hybrid on-premises nodes in advanced tier and heavy Automation use do bill.

An SSM document is free. It is a JSON or YAML definition of commands or an automation workflow. AWS charges nothing to store it. Cost comes from what its steps run.

An SSM maintenance window is free. It is a schedule for running automation on your fleet, and cost comes from what the tasks do on instances you already pay for.

A standard SSM parameter is free to store and read at standard throughput. Cost only appears if you choose the advanced tier or higher-throughput API calls.

An SSM patch baseline is free. It defines which patches are approved for your fleet, and cost comes from the instances that run the patching, not the baseline.

Hybrid storage bridging on-premises to AWS. File Gateway ($0.023/GB-month + data transfer), Volume Gateway (per-GB cached or stored mode), Tape Gateway (VTL for backup). Pricing varies significantly by gateway type.

A subnet is free. It carves an IP range out of a VPC in one Availability Zone, and AWS charges nothing for it. Cost comes from the resources you place in it and the traffic they generate.

A serverless time-series table billed by writes, storage tier, and queries, no instances. 100M writes + 500 GB magnetic storage is ~$65/month.

Managed SFTP, FTPS, or FTP access to S3 and EFS. Priced per protocol-hour the endpoint is enabled, plus per-GB uploaded and downloaded.

A VPC is free. The network itself, subnets, route tables, and security groups cost nothing. The cost comes from the paid components you run inside it.

A private endpoint into AWS services from your VPC. Gateway endpoints (S3, DynamoDB) are free; Interface endpoints are ~$7/month per AZ plus data fees.

A VPC peering connection is free to create and has no hourly charge. The cost is the data transfer that crosses it, which depends on whether the VPCs are in the same or different regions.

A site-to-site IPsec VPN connection between your VPC and on-premises network. $0.05/hour per active connection plus data transfer.

A virtual private gateway is free to attach to a VPC. The cost is the Site-to-Site VPN connection you terminate on it, billed hourly, plus data transfer.

A web application firewall. $5/month per Web ACL, $1/month per rule, plus $0.60 per million inspected requests.

A managed cloud desktop billed monthly or hourly by bundle. An always-on Value bundle is ~$25/month; larger bundles run up to ~$220.

Distributed tracing billed per trace recorded plus per trace retrieved/scanned. 10M traces recorded + 1M scanned is ~$50.50.