AWS Terraform Resources

Serverless query engine for S3 data. $5 per TB scanned (standard). Provisioned capacity option starts at $0.30/DPU-hour with 24-hour minimum. Workgroups themselves are free; the queries within bill.

The legacy Elasticsearch Service domain (now OpenSearch). Bills per data-node instance-hour plus storage. A single t3.small.search node is ~$26/month.

Managed Hadoop, Spark, Hive, Presto, and HBase. Bills EC2 instance hours plus EMR service fee (typically $0.063-$0.27/instance-hour on top of EC2). EMR Serverless eliminates instance management; EMR on EKS allows reusing EKS clusters.

A crawler that catalogs data sources into the Glue Data Catalog, billed per DPU-hour while it runs. 10 DPU-hours/month is ~$4.40 — it only bills during crawl runs.

A managed intelligent-search index. Priced as a flat hourly fee by edition, billed continuously, with a substantial monthly floor.

A managed stream that loads data into S3, Redshift, OpenSearch, or Splunk. Priced per GB ingested, with extras for format conversion and VPC delivery.

A managed Apache Flink (Kinesis Data Analytics) application billed per Kinesis Processing Unit-hour. Two KPUs run ~$161/month, billed while the application runs.

A serverless Apache Kafka cluster that scales automatically. Priced per cluster-hour plus partition-hours, storage, and data in/out.

A managed Apache Airflow environment. Priced per environment-hour by size, plus additional worker and scheduler hours and metadata storage.

Serverless OpenSearch billed per OpenSearch Compute Unit-hour, with a minimum capacity floor. The 4-OCU minimum is ~$701/month.

Serverless Redshift compute billed per RPU-hour only while queries run. 100 RPU-hours is ~$36; idle workgroups cost nothing for compute.

A managed GraphQL API with real-time subscriptions. Priced per query/mutation operation and per real-time update, plus connection minutes and optional caching.

A managed ActiveMQ or RabbitMQ message broker. Priced per broker-instance-hour by instance type and deployment mode, plus storage.

Logical container for backups managed by AWS Backup. Vaults themselves are free; you pay for the storage of recovery points ($0.05/GB-month warm, $0.01/GB-month cold) plus restore data transfer.

A managed container service that scales to zero between requests. Priced on provisioned memory plus active vCPU, with separate build minutes.

A physical server dedicated to your account, billed per host-hour by instance family. An m5 dedicated host is ~$3,700/month — you pay for the whole host, not the instances on it.

An EC2 virtual machine. Priced per hour by instance type, OS, tenancy, and region, with separate charges for attached EBS volumes and data transfer.

Simplified VPS bundles for small workloads. Flat monthly pricing from $3.50/month (512 MB) to $160/month (64 GB). Includes data transfer allowance. Much simpler than EC2 but limited features.

Workflow orchestration. Standard workflows at $0.025 per 1,000 state transitions. Express workflows at $1 per 1M requests + duration fees. Standard for long-running workflows; Express for high-volume short workflows.

An EC2 instance run at Spot prices — up to ~90% below on-demand — in exchange for possible interruption. c3x prices it at the on-demand ceiling (a t3.micro is ~$7.59/month).

A container image registry. Priced per GB-month stored, with the first 500 MB free, plus data transfer charges.

An ECS cluster. The cluster itself is free. Cost comes from the EC2 instances and Fargate tasks that run inside it.

A long-running ECS service. Cost depends on launch type: EC2 (pay for nodes), Fargate (pay per task vCPU/memory), or Fargate Spot.

A managed Kubernetes control plane. Flat $0.10/hour per cluster, with worker nodes and storage billed separately.

Managed EC2 worker nodes for an EKS cluster. The node group has no charge of its own — it bills as the EC2 instances it launches. 3× m5.large is ~$210/month.

An in-memory write-through cache for DynamoDB. Priced per node-hour by node type, multiplied across the cluster's node count.

A managed relational database instance on RDS. Priced per hour by instance class, engine, deployment option, and region, with storage and IOPS billed separately.

A managed connection pool in front of RDS or Aurora. Priced per vCPU-hour of the proxied database instances, billed continuously.

A manual snapshot of an RDS instance, billed per GB-month of backup storage beyond the free allowance. A 50 GB snapshot is ~$4.75/month.

A managed instance that runs database migration and replication tasks. Priced per instance-hour by class, doubled for Multi-AZ, plus storage.

MongoDB-compatible managed document database. Instance-hour ($0.277/hour for db.r6g.large) plus storage ($0.10/GB-month) plus I/O ($0.20/M-requests). Backup storage above retention is $0.021/GB-month.

A managed NoSQL table. Pay-per-request (on-demand) or provisioned capacity, plus storage. No instances to manage.

Managed Redis or Memcached. Priced per node-hour by instance type, with no storage or request charges.

A Redis (or Valkey) replication group with primary and replica nodes, optionally cluster-mode sharded. Priced per node-hour by node type across all shards and replicas.

A serverless Redis or Valkey cache that scales automatically. Priced per GB-hour of data stored plus per million ElastiCache Processing Units (ECPUs).

A managed ETL job using Spark or Python shell. Priced per DPU-hour with 1-minute billing minimum, plus development endpoint and Data Catalog costs.

A simplified managed database (MySQL/PostgreSQL) sold as a flat monthly bundle. The micro bundle is ~$15/month, all-in; HA bundles cost more.

A durable, Redis-compatible in-memory database. Priced per node-hour across all shards and replicas, plus per-GB data written and snapshot storage.

Managed graph database supporting Gremlin, openCypher, and SPARQL. Instance hours ($0.348/hour for db.r5.large) plus storage ($0.10/GB-month) plus I/O ($0.20/M requests). Neptune Serverless offers auto-scaling per-NCU.

A compute instance in a Neptune graph-database cluster, billed per instance-hour by class. A db.r5.large runs ~$254/month, and a cluster usually has a writer plus readers.

A managed OpenSearch (formerly Elasticsearch) cluster. Priced per node-hour by instance type, plus storage and optional UltraWarm/Cold tiers.

A serverless immutable ledger database billed by write IOs, read IOs, and journal/indexed storage — no instances. 10M write IOs + 20 GB is ~$12/month.

An Aurora cluster (MySQL or PostgreSQL compatible). Priced by per-instance compute, storage by GB used, and I/O (Standard) or compute (I/O-Optimized).

A compute instance in an Aurora cluster, billed per instance-hour by class. A db.r6g.large Aurora PostgreSQL instance is ~$247/month — and a cluster usually runs several.

A managed data warehouse. Two compute models: classic node-based pricing (per-hour) or Redshift Serverless (per-RPU-hour), plus managed storage.

A serverless time-series table billed by writes, storage tier, and queries — no instances. 100M writes + 500 GB magnetic storage is ~$65/month.

Managed hosting for web apps, billed by build minutes, served data, and storage. A small app (500 build min, 15 GB served, 5 GB stored) is ~$7/month.

A package-registry domain billed by stored artifacts, requests, and cross-region data transfer. 100 GB + 1M requests is ~$10/month.

A managed build environment for CI/CD. Priced per build-minute by compute type, with no idle cost between builds.

A managed CI/CD pipeline billed ~$1/month per active pipeline (V1). The cost is trivial; the spend lives in the compute the pipeline triggers.

A fleet of streaming application instances. Bills per instance-hour by type × fleet size. Two stream.standard.medium instances always-on are ~$146/month.

A managed cloud desktop billed monthly or hourly by bundle. An always-on Value bundle is ~$25/month; larger bundles run up to ~$220.

An EventBridge (CloudWatch Events) rule that routes events to targets. The rule is free; custom events published cost ~$1/million. AWS-service events are free.

Real-time ML inference endpoint. Bills instance hours 24/7 (e.g., $0.0532/hour for ml.t2.medium, up to $30+/hour for ml.p4d.24xlarge). Serverless inference bills per-invocation. Async inference for batch-like workloads.

A managed Jupyter notebook instance billed per hour while running. An ml.t3.medium is ~$37/month if left on 24/7 — and idle notebooks are the classic waste.

A managed Grafana workspace for dashboards. Priced purely per active user per month by role, with no always-on infrastructure fee.

A real-time data stream. Two capacity modes: Provisioned (priced per shard-hour) or On-Demand (priced per record and per GB).

A managed Apache Kafka cluster. Priced per broker-hour by instance type, plus EBS storage per GB-month and data transfer.

A pub/sub topic for sending notifications. Priced per message published, per delivery, and by destination protocol.

A managed message queue. Priced per request, with no per-queue or storage fee. Generous free tier.

A REST API endpoint. Priced per request, with no base hourly fee. Cheaper than ALB at low volume.

HTTP and WebSocket APIs. HTTP API is 70% cheaper than REST API: $1.00 per million requests vs $3.50. WebSocket connections billed separately by connection-minute and messages.

A CDN distribution. Priced by data transfer to viewers and request count, with rates varying by region.

A dedicated physical network link to AWS, billed per port-hour by speed plus data transfer out. A 1 Gbps port is ~$219/month before egress.

A dedicated physical network connection from on-premises to AWS. Priced per port-hour by bandwidth, plus per-GB data transfer at a lower rate than internet.

A network hub connecting multiple VPCs, VPNs, and Direct Connects. $0.05/hour per attachment plus $0.02/GB processed.

Attaches a VPC to a Transit Gateway, billed ~$0.05/hour (~$36.50/month) per attachment plus the data the TGW processes for it.

A static public IPv4 address. Free while attached and in use, $0.005/hour while detached or unassociated. As of 2024, also charges per-hour for attached IPv4 in some scenarios.

Anycast IPs that route users to the nearest healthy endpoint over the AWS backbone. Priced as a fixed hourly fee plus a per-GB data transfer premium.

A managed load balancer (ALB or NLB). Priced per hour plus per LCU/NLCU based on processed traffic.

A simplified CDN fronting a Lightsail (or other) origin, sold as a flat monthly bundle with an included transfer allowance. The small bundle is ~$2.50/month.

A managed NAT gateway for outbound internet access from private subnets. Notoriously expensive: $0.045/hour plus $0.045/GB processed.

A managed VPC firewall billed per endpoint-hour plus traffic processed. One endpoint with 100 GB is ~$295/month — and multi-AZ deployments multiply the endpoint fee.

A health check that monitors an endpoint for DNS failover, billed ~$0.50/month for AWS endpoints or ~$0.75 for external ones, plus optional feature add-ons.

An inbound or outbound DNS resolver endpoint for hybrid name resolution, billed per elastic network interface (IP) per hour. Two IPs are ~$183/month, plus DNS query charges.

A DNS hosted zone. Flat $0.50/month per zone, plus tiered per-query charges.

A private endpoint into AWS services from your VPC. Gateway endpoints (S3, DynamoDB) are free; Interface endpoints are ~$7/month per AZ plus data fees.

A site-to-site IPsec VPN connection between your VPC and on-premises network. $0.05/hour per active connection plus data transfer.

An audit log of AWS API calls. Management events are free. Data events and Insights are billed per event.

A CloudWatch dashboard for visualizing metrics, billed ~$3/dashboard/month. The first 3 dashboards (with limited metrics) are free.

A log group for storing application and AWS service logs. Priced by ingestion ($0.50/GB), storage ($0.03/GB-month), and queries.

Alarm that triggers actions when a metric breaches a threshold. $0.10/alarm-month for standard resolution. High-resolution alarms (10s) cost $0.30/month. Composite alarms are free per logical condition.

Managed Prometheus billed by samples ingested and metrics stored — no node cost. 1B samples + 100 GB storage is ~$93/month, and the bill scales with metric cardinality.

Distributed tracing billed per trace recorded plus per trace retrieved/scanned. 10M traces recorded + 1M scanned is ~$50.50.

TLS certificates for AWS services. Public certificates are free with auto-renewal. Private CA-issued certificates bill $400/month per private CA. Wildcard and SAN certificates included at no extra cost.

A managed private certificate authority. Priced as a flat monthly CA fee by mode, plus a per-certificate issuance charge.

A managed user directory for sign-up and sign-in. Priced per monthly active user (MAU) above a free tier, with the rate set by the feature tier.

A managed encryption key. Flat $1/month per key, plus per-request charges for cryptographic operations.

A managed secret with versioning, rotation, and IAM-controlled access. Flat $0.40/month per secret plus per-API-call charges.

A web application firewall. $5/month per Web ACL, $1/month per rule, plus $0.60 per million inspected requests.

A dedicated, single-tenant hardware security module billed per HSM-hour. One HSM is ~$1,168/month — and production needs at least two for HA.

A compliance rule evaluated by AWS Config, billed per rule evaluation. 10,000 evaluations is ~$10; cost scales with resource changes and rule count.

Records resource configuration changes into AWS Config, billed per configuration item. 10,000 items is ~$30; cost is driven by recording scope and churn.

A managed directory (Microsoft AD, Simple AD, or AD Connector) billed per hour. Standard Microsoft AD is ~$88/month; Simple AD is cheaper.

A Firewall Manager policy that centrally manages WAF/Shield/security-group rules across accounts, billed ~$100/policy/region/month — plus the resources it deploys.

Managed threat detection billed by the volume of CloudTrail events, VPC flow logs, and DNS logs analyzed. ~10M events + 100 GB logs is ~$140/month.

Managed sensitive-data discovery for S3, billed per bucket evaluated plus per GB inspected. 50 buckets + 100 GB inspected is ~$105/month.

Centralized security posture management, billed per security check and per finding ingested. 100K checks/month is ~$100, with tiers lowering the rate at scale.

Enrolls a resource in AWS Shield Advanced DDoS protection. Shield Advanced is a flat ~$3,000/month subscription per organization — shared across all protected resources.

A serverless function billed by request count and execution duration. Free tier covers 1M requests and 400,000 GB-seconds per month.

A point-in-time backup of an EBS volume, stored in S3. $0.05/GB-month standard (incremental), or $0.0125/GB-month in the archive tier.

A persistent block storage volume. Priced per GB-month by volume type, with separate IOPS and throughput charges on certain types.

A managed NFS file system for shared access from EC2, ECS, EKS, and Lambda. Priced per GB stored, with tiered storage classes.

Managed file storage for Windows, Lustre, NetApp ONTAP, and OpenZFS workloads. Pricing varies wildly: from $0.025/GB-month (Lustre HDD) to $0.30+/GB-month (Windows SSD with deduplication).

A high-performance Lustre file system for HPC and ML. Bills per GB of provisioned storage, with throughput coupled to capacity. 1.2 TB at 125 MB/s/TiB is ~$174/month.

A managed NetApp ONTAP file system with multiprotocol access and NetApp features, billed per GB of SSD capacity plus throughput. 1 TB Multi-AZ is ~$256/month.

A managed OpenZFS file system for NFS workloads with ZFS features, billed per GB of SSD capacity plus throughput. 64 GB Single-AZ is ~$5.76/month.

A managed SMB file system with Active Directory integration. Bills per GB of provisioned storage plus throughput; 32 GB SSD Single-AZ is ~$4/month, scaling with capacity.

A vault for long-term archival storage, billed per GB-month at the deep-archive rate. 1 TB is ~$3.60/month — cheap to store, but retrieval costs time and money.

Simplified object storage sold as a flat monthly bundle with included storage and transfer. The small bundle is ~$1/month, all-in.

Object storage on S3. Priced by storage class, request count, and data transfer, with the bucket itself being free.

Hybrid storage bridging on-premises to AWS. File Gateway ($0.023/GB-month + data transfer), Volume Gateway (per-GB cached or stored mode), Tape Gateway (VTL for backup). Pricing varies significantly by gateway type.

Managed SFTP, FTPS, or FTP access to S3 and EFS. Priced per protocol-hour the endpoint is enabled, plus per-GB uploaded and downloaded.