AWSAWS ConfigManagement & Governance

`aws_config_delivery_channel` cost estimation

Defines where AWS Config delivers configuration snapshots and history (an S3 bucket, optionally an SNS topic). The channel is free. AWS Config bills $0.003 per configuration item recorded plus rule evaluations and S3 storage.

The aws_config_delivery_channel resource tells AWS Config where to send configuration snapshots and change history: an S3 bucket, an optional SNS topic for notifications, and a delivery frequency. The delivery channel itself is free. It is a required piece of wiring, but AWS does not bill for it.

The billed engine behind it is AWS Config recording. The aws_config_configuration_recorder captures a configuration item every time a tracked resource is created, changed, or deleted, and each configuration item costs $0.003 in us-east-1. This sounds tiny until you multiply. An account with thousands of resources that change frequently (Auto Scaling groups scaling in and out, security group edits, tag changes) can record hundreds of thousands of configuration items a month. At $0.003 each, 500,000 items is $1,500/month, and that is per region per account. Turning on recording for all resource types across every account and region in an organization is the single most common way Config surprises finance.

Config rules add a second meter. Each rule evaluation is billed on a tiered scale: $0.001 per evaluation for the first 100,000, $0.0008 for the next 400,000, and $0.0005 beyond that per region per month. Conformance packs and organization-wide rules multiply evaluation counts. On top of Config's own charges, the delivery channel drives S3 storage for the snapshots and history files ($0.023/GB-month), plus SNS charges if you attach a topic with many subscribers.

The gotcha that saves the most money is scoping. Recording all resource types including global resources (IAM, which is recorded in every region by default) duplicates items across regions. Recording only the resource types you actually audit, disabling global-resource recording in all but one region, and setting a periodic (rather than continuous) snapshot frequency all cut configuration-item volume. The delivery channel is free, but it is the mouth of a pipe whose contents bill by the item.

c3x flags aws_config_delivery_channel as free and attributes configuration-item, rule-evaluation, and S3 storage cost to AWS Config and the recorder.

Terraform example

A minimal but realistic configuration that C3X can estimate.

resource "aws_s3_bucket" "config" {
  bucket = "org-config-history"
}

resource "aws_config_delivery_channel" "main" {
  name           = "default"
  s3_bucket_name = aws_s3_bucket.config.bucket
  sns_topic_arn  = aws_sns_topic.config.arn

  snapshot_delivery_properties {
    delivery_frequency = "TwentyFour_Hours"
  }

  depends_on = [aws_config_configuration_recorder.main]
}

resource "aws_config_configuration_recorder" "main" {
  name     = "default"
  role_arn = aws_iam_role.config.arn

  recording_group {
    all_supported                 = false
    include_global_resource_types = false
    resource_types = [
      "AWS::EC2::SecurityGroup",
      "AWS::EC2::Instance",
      "AWS::S3::Bucket",
    ]
  }
}

Pricing dimensions

What you actually pay for when you provision aws_config_delivery_channel.

Dimension	Unit	What's being charged
Delivery channel	free	Defining where Config delivers snapshots and history carries no AWS charge. $0 (free)
Configuration items recorded	per item	AWS Config bills for each configuration item captured when a tracked resource changes, per region per account. $0.003 per configuration item in us-east-1
Config rule evaluations	per evaluation	Each rule evaluation is billed on a tiered scale per region per month. $0.001 per evaluation (first 100,000)
S3 storage for history	per GB-month	Snapshots and change history delivered to the S3 bucket accrue standard storage charges. $0.023/GB-month S3 Standard

Optimization tips

Common ways to reduce aws_config_delivery_channel cost without changing the workload.

Record only the resource types you audit

Often 50 to 80 percent of Config item cost

Turning off all_supported and listing just the resource types you actually review cuts configuration-item volume dramatically. High-churn types like Auto Scaling groups and security groups generate the most items, so exclude what you do not need.

Disable global-resource recording in all but one region

Removes duplicate IAM items across every extra region

Global resources like IAM are recorded in every region by default, duplicating items. Set include_global_resource_types to true in a single home region and false everywhere else.

Use periodic snapshots instead of continuous where possible

A daily snapshot delivery frequency plus scoped recording keeps history without capturing every transient change. Match the frequency to how often you actually query the history.

Lifecycle the S3 history bucket

Glacier is roughly 6x cheaper than S3 Standard for old history

Config history and snapshots accumulate in S3 forever unless you expire them. Add lifecycle rules to transition old objects to Glacier or delete them past your audit-retention window.

FAQ

Does the AWS Config delivery channel cost anything?

No. The delivery channel is free wiring that points Config at an S3 bucket and optional SNS topic. Cost comes from AWS Config recording configuration items ($0.003 each), evaluating rules, and the S3 storage the delivered history consumes.

Why is my AWS Config bill so high?

Almost always because recording is set to all resource types across every region and account. Configuration items bill at $0.003 each, and high-churn resources plus duplicated global resources can push item counts into the hundreds of thousands per month. Scoping recording to the resource types you audit is the fix.

How do Config rules add to the cost?

Each rule evaluation is billed, starting at $0.001 for the first 100,000 evaluations per region per month and dropping at higher volume. Conformance packs and organization-wide rules multiply evaluations, so a broad rule set across many accounts adds up separately from configuration-item charges.

What is the cheapest safe way to run Config?

Record only the resource types you review, enable global-resource recording in a single home region, use a daily snapshot frequency, and lifecycle the S3 history bucket. This keeps the compliance value while cutting configuration-item volume, which is where nearly all the cost is.