AWS Terraform Resources

Serverless query engine for S3 data. $5 per TB scanned (standard). Provisioned capacity option starts at $0.30/DPU-hour with 24-hour minimum. Workgroups themselves are free; the queries within bill.

The legacy Elasticsearch Service domain (now OpenSearch). Bills per data-node instance-hour plus storage. A single t3.small.search node is ~$26/month.

Managed Hadoop, Spark, Hive, Presto, and HBase. Bills EC2 instance hours plus EMR service fee (typically $0.063-$0.27/instance-hour on top of EC2). EMR Serverless eliminates instance management; EMR on EKS allows reusing EKS clusters.

A Glue Data Catalog database is effectively free (the first million objects and requests are free) and the real cost is the querying, crawling, and ETL that use it.

A crawler that catalogs data sources into the Glue Data Catalog, billed per DPU-hour while it runs. 10 DPU-hours/month is ~$4.40, it only bills during crawl runs.

A managed intelligent-search index. Priced as a flat hourly fee by edition, billed continuously, with a substantial monthly floor.

A managed stream that loads data into S3, Redshift, OpenSearch, or Splunk. Priced per GB ingested, with extras for format conversion and VPC delivery.

A managed Apache Flink (Kinesis Data Analytics) application billed per Kinesis Processing Unit-hour. Two KPUs run ~$161/month, billed while the application runs.

A serverless Apache Kafka cluster that scales automatically. Priced per cluster-hour plus partition-hours, storage, and data in/out.

A managed Apache Airflow environment. Priced per environment-hour by size, plus additional worker and scheduler hours and metadata storage.

Serverless OpenSearch billed per OpenSearch Compute Unit-hour, with a minimum capacity floor. The 4-OCU minimum is ~$701/month.

A set of engine parameters for a Redshift cluster. Parameter groups are free. The clusters they configure bill per node-hour, from $0.25/hour for dc2.large to $13/hour for ra3.16xlarge, plus Spectrum and concurrency scaling.

Serverless Redshift compute billed per RPU-hour only while queries run. 100 RPU-hours is ~$36; idle workgroups cost nothing for compute.

A managed GraphQL API with real-time subscriptions. Priced per query/mutation operation and per real-time update, plus connection minutes and optional caching.

A managed ActiveMQ or RabbitMQ message broker. Priced per broker-instance-hour by instance type and deployment mode, plus storage.

Subscribes an endpoint to an SNS topic. Creating the subscription is free, but SNS bills per message delivered, and the rate varies enormously by protocol: HTTP and email are cheap, SMS can be expensive.

A resource policy that controls who can send to or receive from an SQS queue. The policy is free. The queue bills per request, and a policy that opens the queue too wide can enable a flood of billable requests.

Logical container for backups managed by AWS Backup. Vaults themselves are free; you pay for the storage of recovery points ($0.05/GB-month warm, $0.01/GB-month cold) plus restore data transfer.

A managed container service that scales to zero between requests. Priced on provisioned memory plus active vCPU, with separate build minutes.

An Auto Scaling Group is free to create. Its cost is entirely the EC2 instances it launches, so the bill scales with desired_capacity times the instance type times uptime.

A physical server dedicated to your account, billed per host-hour by instance family. An m5 dedicated host is ~$3,700/month, you pay for the whole host, not the instances on it.

An EC2 virtual machine. Priced per hour by instance type, OS, tenancy, and region, with separate charges for attached EBS volumes and data transfer.

A launch configuration is free. It is a legacy blueprint for EC2 instances, so cost appears only when an Auto Scaling Group uses it to launch instances.

A launch template is free. It is a blueprint for EC2 instances, so its cost is realized only when an Auto Scaling Group or fleet uses it to launch instances.

Simplified VPS bundles for small workloads. Flat monthly pricing from $3.50/month (512 MB) to $160/month (64 GB). Includes data transfer allowance. Much simpler than EC2 but limited features.

Workflow orchestration. Standard workflows at $0.025 per 1,000 state transitions. Express workflows at $1 per 1M requests + duration fees. Standard for long-running workflows; Express for high-volume short workflows.

An EC2 instance run at Spot prices, up to ~90% below on-demand, in exchange for possible interruption. c3x prices it at the on-demand ceiling (a t3.micro is ~$7.59/month).

An SSM document is free. It is a JSON or YAML definition of commands or an automation workflow. AWS charges nothing to store it. Cost comes from what its steps run.

A container image registry. Priced per GB-month stored, with the first 500 MB free, plus data transfer charges.

An ECS cluster. The cluster itself is free. Cost comes from the EC2 instances and Fargate tasks that run inside it.

A long-running ECS service. Cost depends on launch type: EC2 (pay for nodes), Fargate (pay per task vCPU/memory), or Fargate Spot.

A task definition is free. It declares CPU and memory for a container task, and those numbers set the Fargate cost when an ECS service runs the task.

A managed Kubernetes control plane. Flat $0.10/hour per cluster, with worker nodes and storage billed separately.

A Fargate profile is free. It is a selector that decides which Kubernetes pods run on Fargate, and those pods are billed per vCPU-hour and per GB-hour while they run.

Managed EC2 worker nodes for an EKS cluster. The node group has no charge of its own, it bills as the EC2 instances it launches. 3× m5.large is ~$210/month.

An in-memory write-through cache for DynamoDB. Priced per node-hour by node type, multiplied across the cluster's node count.

A managed relational database instance on RDS. Priced per hour by instance class, engine, deployment option, and region, with storage and IOPS billed separately.

A container of optional features (like SQL Server native backup, Oracle OEM, or TDE) for an RDS instance. Option groups are free. The RDS instance bills per hour, and some options carry licensing or storage cost.

A DB parameter group is free. It is the engine configuration attached to an RDS instance, and the cost stays entirely on the instance it tunes.

A managed connection pool in front of RDS or Aurora. Priced per vCPU-hour of the proxied database instances, billed continuously.

A manual snapshot of an RDS instance, billed per GB-month of backup storage beyond the free allowance. A 50 GB snapshot is ~$4.75/month.

A DB subnet group is free. It tells RDS which subnets a database can live in, and the cost is entirely the RDS instance it enables.

A managed instance that runs database migration and replication tasks. Priced per instance-hour by class, doubled for Multi-AZ, plus storage.

MongoDB-compatible managed document database. Instance-hour ($0.277/hour for db.r6g.large) plus storage ($0.10/GB-month) plus I/O ($0.20/M-requests). Backup storage above retention is $0.021/GB-month.

A managed NoSQL table. Pay-per-request (on-demand) or provisioned capacity, plus storage. No instances to manage.

A DynamoDB table item is free to define, but it adds to the table's stored data and consumes write and read capacity, so its cost is realized on the table.

Managed Redis or Memcached. Priced per node-hour by instance type, with no storage or request charges.

A named set of engine parameters for ElastiCache (Redis or Memcached) clusters. Parameter groups are free. The clusters they configure bill per node-hour, from about $0.017/hour for cache.t3.micro to $0.90+/hour for large nodes.

A Redis (or Valkey) replication group with primary and replica nodes, optionally cluster-mode sharded. Priced per node-hour by node type across all shards and replicas.

A serverless Redis or Valkey cache that scales automatically. Priced per GB-hour of data stored plus per million ElastiCache Processing Units (ECPUs).

An ElastiCache subnet group is free. It tells ElastiCache which subnets a cache cluster can run in, and the cost is entirely the cache nodes it enables.

A managed ETL job using Spark or Python shell. Priced per DPU-hour with 1-minute billing minimum, plus development endpoint and Data Catalog costs.

A simplified managed database (MySQL/PostgreSQL) sold as a flat monthly bundle. The micro bundle is ~$15/month, all-in; HA bundles cost more.

A durable, Redis-compatible in-memory database. Priced per node-hour across all shards and replicas, plus per-GB data written and snapshot storage.

Managed graph database supporting Gremlin, openCypher, and SPARQL. Instance hours ($0.348/hour for db.r5.large) plus storage ($0.10/GB-month) plus I/O ($0.20/M requests). Neptune Serverless offers auto-scaling per-NCU.

A compute instance in a Neptune graph-database cluster, billed per instance-hour by class. A db.r5.large runs ~$254/month, and a cluster usually has a writer plus readers.

A managed OpenSearch (formerly Elasticsearch) cluster. Priced per node-hour by instance type, plus storage and optional UltraWarm/Cold tiers.

A serverless immutable ledger database billed by write IOs, read IOs, and journal/indexed storage, no instances. 10M write IOs + 20 GB is ~$12/month.

An Aurora cluster (MySQL or PostgreSQL compatible). Priced by per-instance compute, storage by GB used, and I/O (Standard) or compute (I/O-Optimized).

A compute instance in an Aurora cluster, billed per instance-hour by class. A db.r6g.large Aurora PostgreSQL instance is ~$247/month, and a cluster usually runs several.

A managed data warehouse. Two compute models: classic node-based pricing (per-hour) or Redshift Serverless (per-RPU-hour), plus managed storage.

A serverless time-series table billed by writes, storage tier, and queries, no instances. 100M writes + 500 GB magnetic storage is ~$65/month.

Managed hosting for web apps, billed by build minutes, served data, and storage. A small app (500 build min, 15 GB served, 5 GB stored) is ~$7/month.

A package-registry domain billed by stored artifacts, requests, and cross-region data transfer. 100 GB + 1M requests is ~$10/month.

A managed build environment for CI/CD. Priced per build-minute by compute type, with no idle cost between builds.

A CodeCommit repository is free to create and free for the first five active users per month; beyond that it bills a flat rate per active user with generous included storage and requests.

A logical container for CodeDeploy deployment groups. Applications are free, and deployments to EC2 and Lambda are free too. Only on-premises instance deployments bill, at $0.02 per instance update.

A CodeDeploy deployment group is free, and deployments to EC2, Lambda, and ECS carry no CodeDeploy charge; the cost is the compute it deploys to.

A managed CI/CD pipeline billed ~$1/month per active pipeline (V1). The cost is trivial; the spend lives in the compute the pipeline triggers.

A fleet of streaming application instances. Bills per instance-hour by type × fleet size. Two stream.standard.medium instances always-on are ~$146/month.

A managed cloud desktop billed monthly or hourly by bundle. An always-on Value bundle is ~$25/month; larger bundles run up to ~$220.

An EventBridge (CloudWatch Events) rule that routes events to targets. The rule is free; custom events published cost ~$1/million. AWS-service events are free.

Real-time ML inference endpoint. Bills instance hours 24/7 (e.g., $0.0532/hour for ml.t2.medium, up to $30+/hour for ml.p4d.24xlarge). Serverless inference bills per-invocation. Async inference for batch-like workloads.

A managed Jupyter notebook instance billed per hour while running. An ml.t3.medium is ~$37/month if left on 24/7, and idle notebooks are the classic waste.

An Application Auto Scaling target is free. It registers a resource (ECS service, DynamoDB table, and others) as scalable, and the cost is the capacity that resource runs at.

A managed Grafana workspace for dashboards. Priced purely per active user per month by role, with no always-on infrastructure fee.

Binds an SSM document to target instances so State Manager keeps them in a desired configuration. The association is free on standard EC2, but hybrid on-premises nodes in advanced tier and heavy Automation use do bill.

An SSM maintenance window is free. It is a schedule for running automation on your fleet, and cost comes from what the tasks do on instances you already pay for.

An SSM patch baseline is free. It defines which patches are approved for your fleet, and cost comes from the instances that run the patching, not the baseline.

Defines where AWS Config delivers configuration snapshots and history (an S3 bucket, optionally an SNS topic). The channel is free. AWS Config bills $0.003 per configuration item recorded plus rule evaluations and S3 storage.

A member account inside an AWS Organization. Creating and managing accounts is free. The cost lives inside each account: all EC2, S3, RDS, and data transfer usage rolls up to the organization's consolidated bill.

The root container for multi-account AWS. AWS Organizations is free. It is the mechanism behind consolidated billing, Reserved Instance and Savings Plans sharing, and Service Control Policies that cap spend.

Service Control Policies, tag policies, and backup policies attached to an organization. The policies are free. Their job is to prevent spend: SCPs can block expensive instance families, regions, and untagged resources.

A real-time data stream. Two capacity modes: Provisioned (priced per shard-hour) or On-Demand (priced per record and per GB).

A managed Apache Kafka cluster. Priced per broker-hour by instance type, plus EBS storage per GB-month and data transfer.

A pub/sub topic for sending notifications. Priced per message published, per delivery, and by destination protocol.

A managed message queue. Priced per request, with no per-queue or storage fee. Generous free tier.

A metric filter is free. It scans log events for a pattern and emits a CloudWatch metric, and cost sits on the log group and the metric or alarm it feeds.

A log stream is free. It is a named sequence of log events inside a log group, and cost comes from the bytes ingested and stored in the group, not the stream.

A subscription filter is free to define, but it streams matching log events in real time to a destination like Lambda or Kinesis, and that destination is where cost lands.

A REST API endpoint. Priced per request, with no base hourly fee. Cheaper than ALB at low volume.

HTTP and WebSocket APIs. HTTP API is 70% cheaper than REST API: $1.00 per million requests vs $3.50. WebSocket connections billed separately by connection-minute and messages.

A CDN distribution. Priced by data transfer to viewers and request count, with rates varying by region.

A customer gateway is free. It just records the on-premises side of a VPN (public IP and BGP ASN). The cost is the VPN connection it participates in.

A Direct Connect gateway is free. It is a global routing hub for Direct Connect. The cost is the Direct Connect connection port hours and the data transfer out that flows over it.

A dedicated physical network link to AWS, billed per port-hour by speed plus data transfer out. A 1 Gbps port is ~$219/month before egress.

A network hub connecting multiple VPCs, VPNs, and Direct Connects. $0.05/hour per attachment plus $0.02/GB processed.

Attaches a VPC to a Transit Gateway, billed ~$0.05/hour (~$36.50/month) per attachment plus the data the TGW processes for it.

A static public IPv4 address. Free while attached and in use, $0.005/hour while detached or unassociated. As of 2024, also charges per-hour for attached IPv4 in some scenarios.

An EIP association is free. It binds an Elastic IP to an instance or network interface. The cost sits on the Elastic IP itself, which is free while attached to a running instance and billed when idle.

Anycast IPs that route users to the nearest healthy endpoint over the AWS backbone. Priced as a fixed hourly fee plus a per-GB data transfer premium.

An internet gateway is free. Attaching one to a VPC and routing through it costs nothing. The cost is the data transfer out to the internet that it enables.

A managed load balancer (ALB or NLB). Priced per hour plus per LCU/NLCU based on processed traffic.

A listener is free. It checks for connections on a port and forwards them, so the cost is the load balancer it belongs to, not the listener.

A target group is free. It routes traffic to registered targets for an ALB or NLB, and the cost sits on the load balancer and the targets themselves.

A simplified CDN fronting a Lightsail (or other) origin, sold as a flat monthly bundle with an included transfer allowance. The small bundle is ~$2.50/month.

Sets which route table is the main (default) table for a VPC. The association is free, but it decides the default path for any subnet without an explicit table, and that path can silently route traffic through paid NAT or transit gateways.

A managed NAT gateway for outbound internet access from private subnets. Notoriously expensive: $0.045/hour plus $0.045/GB processed.

An elastic network interface is free. AWS charges nothing for the ENI or its private IPs. Cost comes from the instance it attaches to, any Elastic IP left idle on it, and the traffic it carries.

A managed VPC firewall billed per endpoint-hour plus traffic processed. One endpoint with 100 GB is ~$295/month, and multi-AZ deployments multiply the endpoint fee.

A single entry in a VPC route table. Routes are free, but they point traffic at targets like NAT gateways, transit gateways, and VPC peering, and those targets plus the data transfer they carry are where the cost is.

A route table is free. It is a set of routing rules for a VPC, and AWS charges nothing for the table, its routes, or its associations. Cost lives in the targets those routes point at.

A health check that monitors an endpoint for DNS failover, billed ~$0.50/month for AWS endpoints or ~$0.75 for external ones, plus optional feature add-ons.

Enables DNS query logging for a Route 53 public hosted zone. The logging config is free, but every query it records is written to CloudWatch Logs, which bills for ingestion and storage.

A Route 53 record is free to create. There is no per-record charge. Cost comes from DNS queries against the hosted zone and from any health checks the record uses.

An inbound or outbound DNS resolver endpoint for hybrid name resolution, billed per elastic network interface (IP) per hour. Two IPs are ~$183/month, plus DNS query charges.

A DNS hosted zone. Flat $0.50/month per zone, plus tiered per-query charges.

A zone association is free. It attaches a VPC to a private hosted zone so the VPC can resolve its records. Cost comes from the hosted zone and its query volume, not the association.

Security groups are free. There is no charge for the group, its rules, or the traffic it allows. The cost sits in the resources it protects.

A subnet is free. It carves an IP range out of a VPC in one Availability Zone, and AWS charges nothing for it. Cost comes from the resources you place in it and the traffic they generate.

A VPC is free. The network itself, subnets, route tables, and security groups cost nothing. The cost comes from the paid components you run inside it.

A private endpoint into AWS services from your VPC. Gateway endpoints (S3, DynamoDB) are free; Interface endpoints are ~$7/month per AZ plus data fees.

A VPC peering connection is free to create and has no hourly charge. The cost is the data transfer that crosses it, which depends on whether the VPCs are in the same or different regions.

A site-to-site IPsec VPN connection between your VPC and on-premises network. $0.05/hour per active connection plus data transfer.

A virtual private gateway is free to attach to a VPC. The cost is the Site-to-Site VPN connection you terminate on it, billed hourly, plus data transfer.

An HTTP verb (GET, POST, etc.) on a REST API resource. The method definition is free. The REST API it belongs to bills $3.50 per million requests plus data transfer, and optional caching adds $0.02 to $3.80 per hour.

A route (like GET /items or a WebSocket action) on an HTTP or WebSocket API. Routes are free. The parent API bills $1.00 per million requests for HTTP APIs, or per message plus connection minutes for WebSocket APIs.

A deployment stage (like prod or dev) for an HTTP or WebSocket API. Stages are free. They are where access logging and detailed metrics are enabled, and both of those feed billed CloudWatch Logs and metrics.

A Link Aggregation Group that bundles multiple Direct Connect connections into one logical link. The LAG object is free. Each member connection bills per port-hour, from about $0.30/hour for 1 Gbps to $22.50/hour for 100 Gbps, plus data transfer out.

An audit log of AWS API calls. Management events are free. Data events and Insights are billed per event.

A CloudWatch dashboard for visualizing metrics, billed ~$3/dashboard/month. The first 3 dashboards (with limited metrics) are free.

A log group for storing application and AWS service logs. Priced by ingestion ($0.50/GB), storage ($0.03/GB-month), and queries.

Alarm that triggers actions when a metric breaches a threshold. $0.10/alarm-month for standard resolution. High-resolution alarms (10s) cost $0.30/month. Composite alarms are free per logical condition.

Managed Prometheus billed by samples ingested and metrics stored, no node cost. 1B samples + 100 GB storage is ~$93/month, and the bill scales with metric cardinality.

Distributed tracing billed per trace recorded plus per trace retrieved/scanned. 10M traces recorded + 1M scanned is ~$50.50.

TLS certificates for AWS services. Public certificates are free with auto-renewal. Private CA-issued certificates bill $400/month per private CA. Wildcard and SAN certificates included at no extra cost.

A managed private certificate authority. Priced as a flat monthly CA fee by mode, plus a per-certificate issuance charge.

A managed user directory for sign-up and sign-in. Priced per monthly active user (MAU) above a free tier, with the rate set by the feature tier.

An IAM group is free. It bundles users so they share a set of policies. AWS charges nothing for the group. Cost comes from what the member users are permitted to do.

An instance profile is free. It is the wrapper that passes an IAM role to an EC2 instance. AWS charges nothing for it. Cost lives in the instance and what its role lets it do.

An IAM policy is free. It is a JSON permission document. AWS charges nothing for creating, attaching, or evaluating policies. Cost lives in the services the policy permits.

An IAM role is completely free. IAM is a no-cost service. A role grants permissions to whatever assumes it, and the cost is whatever those services do, never the role.

An IAM user is free. Creating users, their access keys, and login profiles costs nothing. The cost is whatever AWS services the user is permitted to operate.

A KMS alias is free. It is a friendly name pointing at a KMS key. AWS charges nothing for the alias. Cost comes from the underlying KMS key and its API requests.

A managed encryption key. Flat $1/month per key, plus per-request charges for cryptographic operations.

A managed secret with versioning, rotation, and IAM-controlled access. Flat $0.40/month per secret plus per-API-call charges.

A secret version is free. It is one stored value of a secret. Secrets Manager bills per secret and per API call, not per version, so adding versions adds nothing.

A standard SSM parameter is free to store and read at standard throughput. Cost only appears if you choose the advanced tier or higher-throughput API calls.

A web application firewall. $5/month per Web ACL, $1/month per rule, plus $0.60 per million inspected requests.

A dedicated, single-tenant hardware security module billed per HSM-hour. One HSM is ~$1,168/month, and production needs at least two for HA.

A compliance rule evaluated by AWS Config, billed per rule evaluation. 10,000 evaluations is ~$10; cost scales with resource changes and rule count.

Records resource configuration changes into AWS Config, billed per configuration item. 10,000 items is ~$30; cost is driven by recording scope and churn.

A managed directory (Microsoft AD, Simple AD, or AD Connector) billed per hour. Standard Microsoft AD is ~$88/month; Simple AD is cheaper.

A Firewall Manager policy that centrally manages WAF/Shield/security-group rules across accounts, billed ~$100/policy/region/month, plus the resources it deploys.

Managed threat detection billed by the volume of CloudTrail events, VPC flow logs, and DNS logs analyzed. ~10M events + 100 GB logs is ~$140/month.

A long-lived access key ID and secret for an IAM user. Access keys are free to create and use, but a leaked key is one of the most expensive incidents in AWS, capable of running up tens of thousands of dollars in hours.

An inline IAM policy embedded directly in a role. IAM is completely free, there is no charge for roles, policies, or evaluation. The cost lives in the AWS services the policy grants access to.

Links a managed IAM policy to a role. The attachment is free, as is all of IAM. What it grants determines how much the role can spend, so it is a cost-governance control point.

A temporary, scoped permission to use a KMS key. Grants are free. The key it points at costs about $1/month, and the encrypt/decrypt API calls the grant enables bill per request.

Managed sensitive-data discovery for S3, billed per bucket evaluated plus per GB inspected. 50 buckets + 100 GB inspected is ~$105/month.

Centralized security posture management, billed per security check and per finding ingested. 100K checks/month is ~$100, with tiers lowering the rate at scale.

Enrolls a resource in AWS Shield Advanced DDoS protection. Shield Advanced is a flat ~$3,000/month subscription per organization, shared across all protected resources.

A Lambda alias is free. It is a named pointer to a function version used for stable references and traffic shifting, and cost stays on the function it points to.

An event source mapping is free. It connects a stream or queue to a Lambda function, and the cost is the invocations it drives plus any polling charges on the source.

A serverless function billed by request count and execution duration. Free tier covers 1M requests and 400,000 GB-seconds per month.

A Lambda function URL is free. It gives a function a public HTTPS endpoint with no API Gateway, and the cost is the function invocations that requests trigger.

A Lambda layer version is free to publish and store. It packages shared dependencies for functions, and the cost stays on the Lambda functions that use it.

A Lambda permission is free. It grants a service or account the right to invoke a function, and cost comes from the invocations that permission then enables.

A point-in-time backup of an EBS volume, stored in S3. $0.05/GB-month standard (incremental), or $0.0125/GB-month in the archive tier.

A persistent block storage volume. Priced per GB-month by volume type, with separate IOPS and throughput charges on certain types.

An EFS access point is free. It is an application-specific entry point into an EFS file system, and the cost is the EFS storage and throughput it maps into.

A managed NFS file system for shared access from EC2, ECS, EKS, and Lambda. Priced per GB stored, with tiered storage classes.

An EFS mount target is free. It gives an EFS file system a network endpoint in one subnet, and the real cost is the EFS storage and throughput behind it.

Managed file storage for Windows, Lustre, NetApp ONTAP, and OpenZFS workloads. Pricing varies wildly: from $0.025/GB-month (Lustre HDD) to $0.30+/GB-month (Windows SSD with deduplication).

A high-performance Lustre file system for HPC and ML. Bills per GB of provisioned storage, with throughput coupled to capacity. 1.2 TB at 125 MB/s/TiB is ~$174/month.

A managed NetApp ONTAP file system with multiprotocol access and NetApp features, billed per GB of SSD capacity plus throughput. 1 TB Multi-AZ is ~$256/month.

A managed OpenZFS file system for NFS workloads with ZFS features, billed per GB of SSD capacity plus throughput. 64 GB Single-AZ is ~$5.76/month.

A managed SMB file system with Active Directory integration. Bills per GB of provisioned storage plus throughput; 32 GB SSD Single-AZ is ~$4/month, scaling with capacity.

A vault for long-term archival storage, billed per GB-month at the deep-archive rate. 1 TB is ~$3.60/month, cheap to store, but retrieval costs time and money.

Simplified object storage sold as a flat monthly bundle with included storage and transfer. The small bundle is ~$1/month, all-in.

Object storage on S3. Priced by storage class, request count, and data transfer, with the bucket itself being free.

Sets the access control list on an S3 bucket. The ACL configuration is free. The bucket it governs bills for storage, requests, and data transfer, which is where all S3 cost lives.

Defines cross-origin resource sharing rules for an S3 bucket. The CORS config is free. It enables browsers to fetch objects directly, which drives the request and data transfer charges on the bucket.

An S3 lifecycle configuration is free, and it is one of the strongest cost levers in S3: it transitions objects to cheaper storage classes and expires old data automatically.

Enabling S3 server access logging is free, but it writes a stream of log objects into a target bucket that you pay to store and, eventually, to query or delete.

An S3 bucket notification is free to configure. It routes bucket events to Lambda, SQS, or SNS, and cost lands on whichever destination processes the events.

An S3 bucket policy is free. It is an IAM resource policy attached to a bucket, and cost stays with the bucket and the requests the policy allows.

A public access block is free. It is a safety toggle that stops a bucket from becoming public, and cost stays with the bucket and the requests it serves.

Setting default encryption on a bucket is free. Encryption itself adds no charge, but choosing aws:kms means each object request also triggers a billable KMS call.

Enabling S3 versioning is free, but it multiplies storage cost by keeping every old version of an object as billable data until something deletes it.

An S3 object is billed for the bytes it stores at its storage class rate, plus the request to upload it, so cost scales with object size and how many objects you keep.

Hybrid storage bridging on-premises to AWS. File Gateway ($0.023/GB-month + data transfer), Volume Gateway (per-GB cached or stored mode), Tape Gateway (VTL for backup). Pricing varies significantly by gateway type.

Managed SFTP, FTPS, or FTP access to S3 and EFS. Priced per protocol-hour the endpoint is enabled, plus per-GB uploaded and downloaded.