Ecommerce Growth & Retail Marketplaces
GuardDuty bills across nine separate data sources: CloudTrail management events at a flat $4/M, VPC Flow Logs at $1/GB tiered, EKS Runtime Monitoring per vCPU-month, plus S3, DNS, Lambda, RDS, and Malware Protection. The 30-day free trial regularly hides the true production bill, and organization-wide auto-enable turns every new account into a billing line.
Lightsail bundles compute, storage, and bandwidth into flat monthly prices starting at $3.50/month (IPv6-only; $5 with a public IPv4 address), dramatically cheaper than the equivalent EC2 + EBS + Data Transfer math for predictable small workloads. The trap: data transfer overages bill at $0.09/GB, scaling locks you into bundle tiers, and migration to EC2 is more disruptive than starting on EC2 from day one.
Macie bills two ways: bucket-level evaluation at $0.10 per bucket per month, and sensitive-data discovery at $1.00 per GB inspected. A 500 GB bucket scanned for PII costs $500 just for the discovery; multi-bucket organizations easily hit $10K+ per month. Automated discovery is cheaper than full jobs but compounds across the bucket footprint.
Amazon MQ bills per broker instance hour: an mq.m5.large ActiveMQ active/standby pair is ~$420/month before storage. Add EFS storage, data transfer, and monitoring and a production HA deployment lands at $510 to $560/month, or $720 to $770 for a three-node RabbitMQ cluster, with zero messages flowing. Use MQ only when AMQP, JMS, STOMP, MQTT, or OpenWire protocol compatibility is non-negotiable.
SNS bills publish and delivery separately. Standard topic publish is $0.50/M, but HTTP delivery is $0.60/M on top, email is $2/100K, SMS varies by country, and mobile push is $0.50/M. A single publish to a topic fanned out to four protocols generates four billable lines, five if you count the cross-region data transfer.
SQS charges $0.40 per million standard requests and $0.50 per million FIFO requests, but a single 256 KB message counts as four requests under the 64 KB rule. Short polling on idle queues generates roughly 200 times the requests of long polling. Cross-region data transfer adds a line many teams never count.
The VPC itself, subnets, security groups, and route tables are free. The bill comes from what you attach: public IPv4 at $3.60/month per address (since Feb 2024), Interface VPC Endpoints at $0.01/hour per AZ, Transit Gateway at $0.05/hour per attachment, VPN at $0.05/hour, and inter-AZ data transfer at $0.01/GB each way. A modest production VPC easily lands at $500–$2,000/month.
AWS Backup bills at a service-specific rate: EFS warm at $0.05/GB-month, DynamoDB continuous backup at $0.20/GB-month, and cold storage at $0.01/GB-month with a 90-day minimum retention penalty. Cross-region copies double the storage line and add $0.02/GB transfer. Backup Audit Manager bills per control per resource, and the charges accumulate.
Most FinOps reviews happen weeks after infrastructure ships, when the bill arrives. CDK cost estimation flips that: synthesize the stack, walk the resource graph, query the AWS Pricing API per resource, and post a monthly-cost diff on every pull request. The cost feedback loop drops from weeks to minutes; the failure modes (request volume, token usage, data transfer) are documented up front.
Management events are free for the first trail. Data events bill $0.10 per 100K, and on a busy S3 bucket that lands at thousands per month. CloudTrail Lake is $0.75/GB ingested with one-year extendable retention ($0.023/GB-month after year one), or $2.50/GB with seven years of retention included. Insights events analyze every management event for anomalies at $0.35/100K. Wildcard data-event selectors are the usual source of the overspend.
The standard FinOps loop is monthly: bill arrives, FinOps team flags variance, engineering investigates, fix lands the next sprint. Shift-left collapses that loop to minutes: cost estimation in PRs, per-team budget alarms in Slack, and cost ownership tags enforced at IaC time. The result is engineers making cost-aware decisions at design time.
KMS keys cost $1/month each, which is the easy number. The hidden bill is request volume at $0.03 per 10K calls, multi-region replicas that each bill $1/month independently, and asymmetric operations at 5× the symmetric rate. An S3 bucket with 100M SSE-KMS objects and an active read pattern can generate thousands per month in KMS requests alone.
Our articles share what we know. Our consulting engagements apply that knowledge to your specific AWS environment.
