Cost

Cost#

Cost is an architectural property, not an accounting afterthought. The choices made elsewhere in this section, the tenancy model, the resilience targets, the network topology, each commit the infrastructure to a spend profile that is hard to change once workloads land on it.

The levers are few and the discipline (FinOps) is in applying them deliberately. On-demand trades price for flexibility; committed and spot capacity trade flexibility for price. Data egress and cross-region traffic are the charges that surprise infrastructure that optimized only compute. The operator architects for a predictable cost profile, and treats a target’s spend as a tell, idle capacity, an over-provisioned tier, or a sudden egress spike all leak intent.

        flowchart LR
  Inform["Inform<br/>visibility + allocation"] --> Optimize["Optimize<br/>rightsize + commit"]
  Optimize --> Operate["Operate<br/>govern + automate"]
  Operate --> Inform

Pricing#

Compute is sold three ways, and the spread between them is large. The operator runs the steady baseline on committed capacity, the spiky top on on-demand, and the interruptible batch on spot.

Model

What it trades

On-demand

Pay per second, no commitment, highest unit price

Committed

A one to three year reservation or spend commitment for a large discount

Spot

Spare capacity at a deep discount the provider can reclaim on short notice

Traps#

Most surprise bills come from charges that no compute dashboard shows. The operator accounts for the data plane, not just the instances.

Charge

Where it hides

Egress

Data leaving the provider or a region, billed per GB

Cross-AZ traffic

Replication and chatty services crossing availability zones

NAT gateway

Per-GB processing on every byte of egress through NAT

Idle resources

Provisioned capacity that is billed whether used or not

Over-provisioned tiers

Instances and volumes sized for a peak that never arrives

Wrong storage tier

Hot storage holding data that is never read

Allocation#

Spend that cannot be attributed cannot be controlled. The infrastructure is structured so every dollar maps back to a team and a service before anyone tries to cut it.

  • Tag, owner, environment, and service on every resource.

  • Separate, an account or project per environment for a clean billing boundary.

  • Showback, surface each team’s spend, then charge it back so they own it.

Rightsizing#

Most infrastructure is provisioned for a guess and never corrected. The operator sizes to observed demand and lets capacity follow the curve instead of sitting at the peak.

  • Match, set instance and volume size to measured usage, not the first guess.

  • Autoscale, follow demand up and down rather than provisioning for peak.

  • Schedule, shut non-production capacity down outside working hours.

FinOps#

FinOps is the operating loop that keeps the cost profile honest as the infrastructure changes. Visibility informs the team, the team optimizes, and governance keeps the gains from eroding, then the loop runs again.

  • Inform, give every team visibility into its own spend.

  • Optimize, rightsize, commit the baseline, and kill the waste.

  • Operate, automate the guardrails so the savings hold.

Pitfalls#

  • Compute tunnel vision, optimizing instances while egress dominates the bill.

  • Untagged infrastructure, spend nobody can attribute to a team or service.

  • Premature commitment, reserving capacity before the usage pattern is known.

  • Orphaned resources, unattached volumes, idle balancers, and old snapshots left billing.

References#

Contents