Tagged
GuardDuty bills across nine separate data sources: CloudTrail management events at a flat $4/M, VPC Flow Logs at $1/GB tiered, EKS Runtime Monitoring per vCPU-month, plus S3, DNS, Lambda, RDS, and Malware Protection. The 30-day free trial regularly hides the true production bill, and organization-wide auto-enable turns every new account into a billing line.
Kevin W.Lightsail bundles compute, storage, and bandwidth into flat monthly prices starting at $3.50/month (IPv6-only; $5 with a public IPv4 address), dramatically cheaper than the equivalent EC2 + EBS + Data Transfer math for predictable small workloads. The trap: data transfer overages bill at $0.09/GB, scaling locks you into bundle tiers, and migration to EC2 is more disruptive than starting on EC2 from day one.
Kevin W.Macie bills two ways: bucket-level evaluation at $0.10 per bucket per month, and sensitive-data discovery at $1.00 per GB inspected. A 500 GB bucket scanned for PII costs $500 just for the discovery; multi-bucket organizations easily hit $10K+ per month. Automated discovery is cheaper than full jobs but compounds across the bucket footprint.
Kevin W.Amazon MQ bills per broker instance hour: an mq.m5.large ActiveMQ active/standby pair is ~$420/month before storage. Add EFS storage, data transfer, and monitoring and a production HA deployment lands at $510 to $560/month, or $720 to $770 for a three-node RabbitMQ cluster, with zero messages flowing. Use MQ only when AMQP, JMS, STOMP, MQTT, or OpenWire protocol compatibility is non-negotiable.
Kevin W.SNS bills publish and delivery separately. Standard topic publish is $0.50/M, but HTTP delivery is $0.60/M on top, email is $2/100K, SMS varies by country, and mobile push is $0.50/M. A single publish to a topic fanned out to four protocols generates four billable lines, five if you count the cross-region data transfer.
Kevin W.SQS charges $0.40 per million standard requests and $0.50 per million FIFO requests, but a single 256 KB message counts as four requests under the 64 KB rule. Short polling on idle queues generates roughly 200 times the requests of long polling. Cross-region data transfer adds a line many teams never count.
Kevin W.The VPC itself, subnets, security groups, and route tables are free. The bill comes from what you attach: public IPv4 at $3.60/month per address (since Feb 2024), Interface VPC Endpoints at $0.01/hour per AZ, Transit Gateway at $0.05/hour per attachment, VPN at $0.05/hour, and inter-AZ data transfer at $0.01/GB each way. A modest production VPC easily lands at $500–$2,000/month.
Kevin W.AWS Backup bills at a service-specific rate: EFS warm at $0.05/GB-month, DynamoDB continuous backup at $0.20/GB-month, and cold storage at $0.01/GB-month with a 90-day minimum retention penalty. Cross-region copies double the storage line and add $0.02/GB transfer. Backup Audit Manager bills per control per resource, and the charges accumulate.
Kevin W.Management events are free for the first trail. Data events bill $0.10 per 100K, and on a busy S3 bucket that lands at thousands per month. CloudTrail Lake is $0.75/GB ingested with one-year extendable retention ($0.023/GB-month after year one), or $2.50/GB with seven years of retention included. Insights events analyze every management event for anomalies at $0.35/100K. Wildcard data-event selectors are the usual source of the overspend.
Kevin W.The standard FinOps loop is monthly: bill arrives, FinOps team flags variance, engineering investigates, fix lands the next sprint. Shift-left collapses that loop to minutes: cost estimation in PRs, per-team budget alarms in Slack, and cost ownership tags enforced at IaC time. The result is engineers making cost-aware decisions at design time.
Kevin W.KMS keys cost $1/month each, which is the easy number. The hidden bill is request volume at $0.03 per 10K calls, multi-region replicas that each bill $1/month independently, and asymmetric operations at 5× the symmetric rate. An S3 bucket with 100M SSE-KMS objects and an active read pattern can generate thousands per month in KMS requests alone.
Kevin W.SageMaker AI Savings Plans deliver up to 64% off SageMaker training, real-time inference, async inference, serverless inference, and processing jobs in exchange for 1-year or 3-year hourly commitment. Compute Savings Plans do NOT cover SageMaker, so this is a separate purchase. The break-even is much faster than RI-style commits for steady ML production workloads.
Kevin W.
