AWS cost engineering notes
What we learn running AWS cost pipelines in production. Billing data, Kubernetes, networking, storage, and whatever else the bill throws up. Every figure is checked against AWS documentation and linked, including the parts that do not work.
-
Step Functions pricing: the 2026 break-even
One Step Functions state transition costs the same as 24 seconds of Express duration. Past 12 states, Express caps out before Standard ever gets cheaper.
-
Updated SQS / Messaging / Serverless / FinOps
SQS pricing in 2026: requests, not messages
SQS pricing bills a 1 MiB message as 16 requests, and ten short-polling consumers on an empty queue as $103 a month. Long polling makes it $0.12.
-
Kinesis Data Streams pricing in 2026
An empty on-demand Kinesis stream costs $28.80 a month, which buys 2.67 shards. Above 3.6% shard utilisation, provisioned Kinesis is cheaper at any scale.
-
Network cost / VPN / FinOps
Site-to-Site VPN pricing: $36 is 7% (2026)
An AWS Site-to-Site VPN connection is $36 a month, but in AWS's own example that is 6.87% of the bill. On a Transit Gateway the tunnel is metered three ways.
-
Amazon Bedrock AgentCore pricing (2026)
Bedrock AgentCore bills CPU only when used, but memory until the session ends, 15 minutes after the last request by default. AWS's own example undercounts it.
-
Updated Network cost / Direct Connect / FinOps
AWS Direct Connect pricing in 2026
A 1 Gbps AWS Direct Connect port is $219 a month and repays itself at 3,257 GB of data transfer out. The break-even table for every port speed, from AWS rates.
-
Updated AWS Backup / Storage / EBS / FinOps
AWS Backup pricing and where it bills (2026)
AWS Backup does not bill backup storage for EBS, EC2 or RDS: it lands under their own services. Plus cold storage minimums, copy charges and Audit Manager fees.
-
AWS Shield Advanced pricing and cost (2026)
AWS Shield Advanced is $3,000 a month on a 1-year term. Its base WAF inclusion only matches that fee near 5 billion requests. DDoS credits pay only Shield.
-
Updated Global Accelerator / Network cost / FinOps
AWS Global Accelerator pricing in 2026
An idle AWS Global Accelerator costs $25.20 a month, and DT-Premium is charged on top of data transfer out, not instead of it. Rates by region.
-
Aurora Serverless v2 pricing: idle cost (2026)
An idle Aurora Serverless v2 cluster bills its minimum ACUs on every writer and reader. RDS Proxy, replication or one open connection stops it pausing to zero.
-
Updated CloudFront / Network cost / FinOps
CloudFront pricing: the S3 break-even (2026)
CloudFront is $0.085 per GB from US edges against $0.09 direct from S3, so CloudFront pricing undercuts S3 egress in two of eight regions and loses in six.
-
Updated S3 / Storage / Network cost
S3 replication pricing: CRR, SRR, RTC (2026)
S3 replication bills a PUT per object plus $0.020/GB between Regions, so objects under 262 KB cost more in requests than transfer. SRR, RTC and Batch priced.
-
S3 request pricing: the 18 KB line (2026)
One S3 GET a month costs more than a month of S3 Standard storage for any object under 18 KiB. S3 request pricing by class, with the crossover table.
-
SES / Serverless / FinOps
Amazon SES pricing and the plan default (2026)
New Amazon SES accounts start on Essentials at $0.16 per 1,000 emails, 60% above à la carte. Why that pays off only with VDM, plus the inbound chunk meter.
-
AWS Security Hub pricing: two models (2026)
Security Hub bills $3.75 per resource unit in US East (N. Virginia), while Security Hub CSPM bills per security check plus separately priced AWS Config items.
-
S3 Intelligent-Tiering cost break-even (2026)
S3 Intelligent-Tiering monitoring costs $0.0025 per 1,000 objects a month, so under a 250 KB average object size it loses to plain S3 Standard.
-
Cognito pricing: Lite, Essentials, Plus (2026)
Cognito Plus bills $0.020 per MAU with no free tier for direct sign-in, and a token refresh or AdminGetUser call makes a user active. All three plans compared.
-
What S3 Glacier retrieval really costs (2026)
Restoring 10 TB from S3 Glacier Deep Archive costs $268, 2.2x a year of storage. S3 Glacier retrieval is three charges: per GB, per request, plus a copy.
-
S3 incomplete multipart uploads cost (2026)
Incomplete S3 multipart uploads bill as storage with no expiry, and expiration rules never remove them. How to list them, and the one lifecycle rule that does.
-
Reserved Instances vs Savings Plans (2026)
Savings Plans cannot reserve capacity or be resold. Two things Reserved Instances still do, and why AWS applies Reserved Instances first.
-
Updated Network cost / Load balancing / EC2
NLB pricing: why TLS listeners cost more (2026)
NLB pricing: a TLS listener gets 33x fewer active connections per NLCU than TCP, so AWS's own example bills the same traffic at $25.92 vs $1.55 a month.
-
Updated Redshift / Serverless / FinOps
Redshift Serverless pricing: the minute (2026)
Redshift Serverless bills a 60-second minimum per query, so a two-second dashboard query on the default 128-RPU workgroup costs 80 cents, not a fraction of one.
-
Updated API Gateway / Serverless / FinOps
API Gateway: REST vs HTTP API cost (2026)
API Gateway HTTP APIs are 3.5x cheaper per request until the payload passes 1.5 MB, where the 512 KB metering increment flips it.
-
Updated OpenSearch / Serverless / FinOps
OpenSearch Serverless pricing: OCU floor 2026
An idle OpenSearch Serverless Classic collection bills a 2-OCU minimum: $350.40 a month at AWS's $0.24 OCU-hour. Only NextGen collections scale to zero.
-
When a cheap S3 storage class costs more (2026)
Minimum durations, the 128 KB rounding rule and the 40 KB Glacier overhead billed partly at S3 Standard rate.
-
Updated Security / Network cost / Governance
AWS WAF pricing and what it costs (2026)
Ten million requests cost $6. The nineteen WAF rules inspecting them cost $19. Plus two overage meters that live in a footnote.
-
Updated Network cost / VPC
What a NAT Gateway actually costs (2026)
The two meters a NAT Gateway bills, why one zonal gateway across three AZs costs more, and what regional mode changed in 2025.
-
Cut Amazon Bedrock inference cost (2026)
Bedrock batch inference is 50% off, cache-read discounts vary by model, and AWS states batch and caching cannot be combined. Plus the silent caching failure.
-
Updated Bedrock / AI cost / CUR 2.0 / Cost allocation
Amazon Bedrock cost per team (2026)
Bedrock does not split by team by default. IAM principal cost allocation and application inference profiles: what each answers, and why CloudWatch cannot.
-
Updated EKS / Kubernetes / FinOps
EKS Auto Mode: the third bill (2026)
EKS Auto Mode adds a management fee that varies by instance type, on top of EC2 and the control plane. And split cost allocation does not divide it.
-
Updated Governance / Budgets / FinOps
AWS Budgets vs Cost Anomaly Detection (2026)
They catch different failures, and only Budgets sees AWS Marketplace charges. Detection lags, monitor types, and what to run.
-
Updated Credits / Organizations / FinOps
How AWS credits actually apply (2026)
Soonest to expire first, largest charge first, biggest account first. Plus what credits will not cover, including Marketplace.
-
Updated EKS / Kubernetes / FinOps
EKS extended support: $0.10 to $0.60 (2026)
EKS extended support is six times the control plane rate, on a published date, enabled by default. Once a cluster is in it you cannot turn it off.
-
Updated Cost allocation / Cost categories / FinOps
AWS Cost Categories: split charge limits (2026)
Cost categories apply retroactively to the start of the month. Split charge results never reach the CUR or Cost Explorer.
-
Updated Organizations / FinOps / Cost allocation
Does consolidated billing save money? (2026)
AWS's worked example puts consolidated billing's volume tiering at about 4%. Commitment sharing is worth far more than that.
-
Updated Network cost / VPC / S3
VPC endpoint cost: gateway vs interface (2026)
VPC gateway endpoints for S3 and DynamoDB carry no charge. Three documented ways one silently stops covering your traffic.
-
Updated Security / Governance / FinOps
Secrets Manager vs Parameter Store (2026)
AWS prices 1,500 secrets at $604.50 a month in Secrets Manager. Standard Parameter Store parameters are free. Plus a tier change you cannot undo.
-
Updated Governance / FinOps / Kubernetes
AWS Cost Optimization Hub: the gaps (2026)
EKS spend counts toward Cost Optimization Hub's efficiency score but generates no recommendations, so a wasteful cluster raises the number.
-
RDS extended support: priced per vCPU (2026)
RDS extended support scales with instance size, unlike EKS, and runs three years. Disabling it on a lapsed database upgrades the engine immediately.
-
Updated Lambda / Serverless / FinOps
Do Lambda cold starts cost money? (2026)
Since 1 August 2025 every Lambda is billed for INIT, the cold start phase. What changed, how to measure it, what does not fix it.
-
Updated Network cost / VPC / Flow logs
What VPC Flow Logs actually cost (2026)
VPC Flow Logs bill the tiered Vended Logs meter. The aggregation interval AWS overrides on Nitro, and records you pay for twice.
-
Updated Network cost / DNS / FinOps
What Route 53 actually costs (2026)
Route 53 hosted zones are not prorated, alias queries to AWS services are free, and a Resolver endpoint is about $182 a month.
-
Updated Network cost / VPC / EC2
Elastic IP and public IPv4 pricing (2026)
A public IPv4 is $0.005 an hour, and idle addresses cost exactly the same as in-use ones. Plus AWS's formula for whether a NAT Gateway is cheaper.
-
Updated ECS / SCAD / CUR 2.0 / Kubernetes
ECS split cost allocation data vs EKS (2026)
SCAD covers ECS tasks too, but ECS gets no service-generated tags and no GPU splitting. Plus the row count formula.
-
EC2 Capacity Reservations: unused cost (2026)
An EC2 Capacity Reservation bills at full On-Demand whether used or not, and the idle half arrives as UnusedBox. Plus who pays when it is shared.
-
Updated EKS / Kubernetes / Observability
Container Insights pricing on EKS (2026)
Container Insights with enhanced observability is $51.75 a month on AWS's 10-node example. Turning it off costs $101.73.
-
Query your CUR in Athena, no crawler (2026)
Athena partition projection computes partitions from table properties. The config, and six ways it returns zero rows not an error.
-
Updated DynamoDB / Serverless / FinOps
DynamoDB on-demand vs provisioned (2026)
AWS publishes the DynamoDB break-even: on-demand costs less below 35% utilisation. Plus the console switch that deletes your auto scaling.
-
Are AWS Glue crawlers free? (2026)
No. Glue crawlers bill $0.44 per DPU-hour with a 10-minute minimum per crawl, so an hourly schedule costs about $1,285 a year.
-
Updated Cost allocation / CUR 2.0 / Tagging
Why cost allocation tags show up empty (2026)
Tagging a resource is not activating cost allocation tags. The two 24-hour delays, what a backfill can recover, and the CUR 2.0 key change.
-
EFS pricing: storage is the cheap half (2026)
EFS Standard storage is $0.30 per GB-month, but Elastic Throughput bills $0.03 per GB read and $0.06 written. EFS pricing flips to Provisioned near 6%.
-
Updated Savings Plans / FinOps / Cost allocation
Savings Plans: coverage vs utilization (2026)
Savings Plans coverage and utilization move in opposite directions. What each low value means, and the documented order AWS applies discounts in.
-
Does a stopped EC2 instance cost money? (2026)
A stopped EC2 instance bills no compute. The EBS volume, any Elastic IP and any Savings Plan under it do, and hibernating costs more.
-
Updated ECR / Containers / FinOps
ECR pricing: storage is 13% of it (2026)
Amazon ECR storage is $0.10 per GB-month and same-Region pulls are free. Scanning and the network path are 87% of what an ECR pipeline really costs.
-
Updated Governance / Logging / FinOps
AWS CloudTrail pricing and costs (2026)
CloudTrail's first copy of management events is free; the second costs $2.00 per 100,000, twenty times the rate of S3 data events.
-
Updated Rightsizing / EC2 / FinOps
AWS Compute Optimizer cost in 2026
AWS Compute Optimizer is free, but its 93-day lookback is $0.25 per instance a month and memory visibility costs $0.30 more. Its own example halves its total.
-
Updated EKS / Kubernetes / Discovery
Find every Kubernetes cluster in AWS (2026)
eks list-clusters misses two of three Kubernetes populations. The flag for connected GKE and AKS, the EC2 tag scan, and the dedup.
-
Updated CloudWatch / Observability / FinOps
CloudWatch custom metrics cost in 2026
A CloudWatch custom metric is $0.30 a month, but AWS bills per unique dimension combination: one request-ID dimension at 100 rps bills $32,500 a month.
-
AWS KMS key pricing at scale (2026)
A rotated key costs $3 a month, not $1. And S3 Bucket Keys cut KMS request charges by up to 99% with no code change.
-
Updated Tagging / Governance / Cost allocation / FinOps
AWS tag policies do not require tags (2026)
A tag policy never blocks an untagged resource. Enforcement mode covers 343 of 1,493 resource types, and the tag still has to be activated to reach your bill.
-
Updated Free tier / AWS credits / FinOps
AWS free tier changes: what you get (2026)
The AWS free tier dropped its 12-month trials. A new account gets $100 at sign-up, $100 more to earn, and six months to spend it before AWS closes it.
-
What an EBS snapshot actually costs (2026)
Archiving converts an incremental EBS snapshot to a full one, so the cheap tier can bill 10x more. Plus why deleting frees nothing.
-
Updated Network cost / Data transfer / FinOps
AWS data transfer out pricing in 2026
AWS data transfer out is $0.09 per GB after 100 GB free, but the blended egress rate rises until 10 TB a month and the $0.05 floor is never reachable.
-
Updated Cost Explorer / CUR 2.0 / FinOps
Why Cost Explorer and your CUR differ (2026)
Same dataset, three totals. The six documented causes, which number you owe, and what Cost Explorer charges per request.
-
Updated Security / Network cost / Governance
GuardDuty bills flow logs you never made (2026)
GuardDuty analyses an independent duplicate stream of VPC Flow Logs, so deleting your own changes nothing. Plus the per-Region trial trap.
-
Updated CUR 2.0 / Cost allocation / FinOps
Amortized vs unblended cost in AWS (2026)
Five CUR cost columns, one right answer per question. When to use amortized, when unblended, and why blended cost is never the answer.
-
Updated EKS / SCAD / Kubernetes
EKS split cost allocation data (2026)
The three measurement options in EKS split cost allocation data, why the choice matters, and the Fargate-derived 9:1 CPU-to-memory weighting.
-
Updated Governance / FinOps / Compliance
What AWS Config actually costs (2026)
You are billed per configuration item, and AWS confirms one is recorded even when no resource is created. Churn is the driver.
-
Updated Network cost / VPC / CUR 2.0
What cross-AZ data transfer costs (2026)
Cross-AZ transfer is $0.01 per GB each direction, so $0.02 a round trip. What is free, what a public IP costs, and the usage type that changed in 2025.
-
Limit what one Athena query can scan (2026)
Athena's per-query limit cancels; the per-workgroup limit only alerts. Cancelled queries are still billed and leave debris.
-
Updated Logging / Governance / FinOps
What CloudWatch Logs actually cost (2026)
The CloudWatch Logs Infrequent Access class halves ingestion only, removes metric filters and alarms, and can never be changed after creation.
-
CUR 2.0 vs FOCUS: only one costs pods (2026)
A field-level comparison from the AWS column dictionaries: what CUR 2.0 has that FOCUS does not, and four gotchas.
-
Updated Network cost / VPC / FinOps
Transit Gateway pricing and costs (2026)
Transit Gateway attachment hours land on the VPC owner, not the gateway owner, and three types bill three different accounts.
-
Updated Cost Explorer / Network cost / CUR 2.0
What is EC2 - Other in Cost Explorer? (2026)
EC2 - Other is not a service. What the bucket holds, the usage types that break it down, and why it never appears on your invoice.
-
Updated Network cost / Load balancing / EC2
ALB pricing: what an LCU actually is (2026)
An ALB LCU has four dimensions and AWS charges only for the largest. Which one is yours, and why the eleventh listener rule starts a meter.