Macie bills two ways: bucket-level evaluation at $0.10 per bucket per month, and sensitive-data discovery at $1.00 per GB inspected. A 500 GB bucket scanned for PII costs $500 just for the discovery; multi-bucket organizations easily hit $10K+ per month. Automated discovery is cheaper than full jobs but compounds across the bucket footprint.
Amazon MQ bills per broker instance hour — an mq.m5.large active/standby HA pair is ~$440/month before storage. Add EFS or EBS for the broker, and a typical production HA deployment lands at $700+/month with zero messages flowing. Use MQ only when AMQP, JMS, STOMP, MQTT, or OpenWire protocol compatibility is non-negotiable.
SNS bills publish and delivery separately. Standard topic publish is $0.50/M, but HTTP delivery is $0.60/M on top, email is $2/100K, SMS varies by country, and mobile push is $0.50/M. A single publish to a topic fanned out to four protocols generates four billable lines — five if you count the cross-region data transfer.
SQS charges $0.40 per million standard requests and $0.50 per million FIFO requests, but a single 256 KB message counts as four requests under the 64 KB rule. Short polling on idle queues silently quadruples the bill. Cross-region data transfer adds a line many teams never count.
The VPC itself, subnets, security groups, and route tables are free. The bill comes from what you attach: public IPv4 at $3.60/month per address (since Feb 2024), Interface VPC Endpoints at $0.01/hour per AZ, Transit Gateway at $0.05/hour per attachment, VPN at $0.05/hour, and inter-AZ data transfer at $0.01/GB each way. A modest production VPC easily lands at $500–$2,000/month.
AWS Backup bills per service-specific rate — EFS warm at $0.05/GB-month, DynamoDB continuous backup at $0.20/GB-month, cold storage at $0.0125/GB-month with a 90-day minimum retention penalty. Cross-region copies double the storage line plus $0.02/GB transfer. Backup Audit Manager bills per control per resource and quietly accumulates.
Management events are free for the first trail. Data events bill $0.10 per 100K — and on a busy S3 bucket that lands at thousands per month. CloudTrail Lake is $2.50/GB ingested plus $0.10/GB-month storage. Insights events analyze every management event for anomalies at $0.35/100K. Most accounts pay 5× more for CloudTrail than they need to.
The standard FinOps loop is monthly: bill arrives, FinOps team flags variance, engineering investigates, fix lands the next sprint. Shift-left collapses that loop to minutes — cost estimation in PRs, per-team budget alarms in Slack, cost ownership tags enforced at IaC time. The result is engineers making cost-aware decisions at design time, not at bill-review time.
KMS keys cost $1/month each — the easy number. The hidden bill is request volume at $0.03 per 10K calls, multi-region replicas that each bill $1/month independently, and asymmetric operations at 5× the symmetric rate. An S3 bucket with 100M SSE-KMS objects and an active read pattern can generate thousands per month in KMS requests alone.
SageMaker AI Savings Plans deliver up to 64% off SageMaker training, real-time inference, async inference, serverless inference, and processing jobs in exchange for 1-year or 3-year hourly commitment. Compute Savings Plans do NOT cover SageMaker — this is a separate purchase. The break-even is dramatically faster than RI-style commits for steady ML production workloads.
