Insights & Resources

Production checklist for Prowler and AWS Security Hub — multi-account setup, scheduled scans, finding workflows, and remediation patterns on AWS.

EC2 On-Demand is a matrix of family, size, OS, tenancy, and region. In us-east-1 (June 2026) a m7g.large Linux runs $0.0816/hr vs a g5.xlarge GPU at $1.006/hr.

AWS shipped ECS Express Mode on November 21, 2025 — three inputs (image + two IAM roles) and Express Mode provisions Fargate, ALB, HTTPS, auto scaling, and a *.ecs.*.on.aws URL. Up to 25 services can share one ALB. No Express Mode surcharge.

ElastiCache bills node-hours for Redis/Valkey clusters and ECPUs for Serverless. A cache.r7g.large with two replicas is 3× the primary node cost before data transfer. Serverless wins below ~$800/mo steady cache spend; provisioned nodes win above it.

Fargate bills per vCPU-second and GB-second, not per task hour. In us-east-1 a 0.25 vCPU / 0.5 GB task runs ~$9/mo; a 4 vCPU / 16 GB task ~$145/mo.

A 22-account AWS Organization spent $1.1M/yr on Compute Savings Plans but applied only 61% to production — dev sandboxes burned the commit while prod stayed On-Demand. Group Sharing (April 2026) fixed attribution; the waste was $312k/yr before they restructured purchases.

AWS Blocks (public preview, June 2026): 18+ open-source TypeScript building blocks that run locally without an AWS account and deploy with zero code changes.

CUR 2.0 (generally available 2024, default for new exports in 2025) adds line-item resource IDs and Savings Plan attribution columns Athena needs for serious chargeback. A standard FinOps query pack answers top-10 services, untagged spend, and SP coverage in under 60 seconds.

On June 15, 2026 AWS made Console Private Access work without internet — VPC endpoints route 100% of browser traffic. First-party benchmark: 161 interface endpoints and ~$263/mo for a 12-service 3-AZ pilot in us-east-1.

Compute Optimizer added 32-day lookback for cyclic workloads in 2025 — critical for monthly batch jobs that looked oversized on 14-day windows. In a June 2026 audit of a $48k/mo account, rightsizing recommendations alone modeled $11k/mo savings at low performance risk.

Aurora bills instance hours plus storage plus I/O — or storage at a 125% premium with I/O bundled (I/O-Optimized). Serverless v2 at $0.12 per ACU-hour wins on variable workloads, loses on steady traffic above 4 ACU. Global Database doubles the price per secondary region plus replicated-write fees. Backtrack adds per-change-record cost most teams never factor in.

Bedrock AgentCore is metered across twelve distinct components — Runtime, Browser, Code Interpreter, Gateway, Identity, Memory (two tiers), Observability, Evaluations, Payments, Search, and the underlying model spend. Two of them drive 80% of the bill.