Latest / The Cloud Business Podcast with Fexingo: AWS, Azure, GCP, and Enterprise Infrastructure / Why Cloud Vendors Now Charge for AWS Config Rule Evaluations
Transcript
- Lucas: In the second quarter of this year, one of our listeners at a midsize retail company saw their AWS Config bill jump by nearly 40 percent from the previous quarter. No new workloads, no new regions — just the existing set of compliance rules evaluating more resources. Luna: Forty percent just from Config? That's a huge swing for something many teams treat as a fixed cost. What changed? Lucas: What changed is that AWS, along with Azure and Google Cloud, have all slowly tightened the free tier and introduced per-evaluation pricing for their compliance configuration services. For AWS Config, the original free tier included 100,000 rule evaluations per rule per month. That threshold dropped to 10,000 a couple of years ago, and now any evaluation beyond that is billed at a fraction of a cent per evaluation. Luna: So if you have 500 rules and each one evaluates 50,000 resources per month, the math adds up fast. What does that look like in dollars? Lucas: Exactly. Our listener has about 300 rules across 500 accounts. Each rule evaluates an average of 20,000 resources per month. That's 6 billion evaluations. After the 10,000 free per rule, they're billed for about 3 billion evaluations. At $0.001 per evaluation, that's $3,000 a month just for Config. Luna: And that's before you add in the costs of storing the configuration history in S3 or the snapshot delivery to S3. Azure Policy has a similar model, right? Lucas: Yes. Azure Policy charges per policy assignment per evaluation, with a free tier of 10,000 evaluations per subscription per policy. Google Cloud's Policy Intelligence doesn't charge per evaluation but instead ties costs to the number of constraints and the volume of audit logs. The net effect is the same: as your resource count grows, so does your compliance cost. Luna: So what are the levers? How do you keep this from ballooning? Lucas: First, scope your rules aggressively. Instead of applying a rule to all resources in an account, target specific resource types or tag values. AWS Config allows you to use tags in the rule scope. That alone can cut evaluations by 80 percent. Luna: And conformance packs — those are pre-packaged sets of rules. Do they help? Lucas: Conformance packs can actually be more expensive if you're not careful, because they bundle many rules together. But they do offer a better way to manage rules as code, which can help you deprecate unnecessary rules faster. The key is to regularly audit your rule inventory and remove rules that are no longer relevant. Luna: Another thing we've seen is teams using AWS Config's aggregated view across accounts, but forgetting that each account still generates its own evaluations. So centralizing the dashboard doesn't centralize the cost. Lucas: Right. And then there's the resource count. Every time you add a new EC2 instance, Lambda function, or S3 bucket, it increases the evaluation count for every rule that covers that resource type. So controlling resource sprawl is a direct cost control. Luna: It really comes down to understanding that cloud compliance is now a variable cost, not a fixed overhead. The days of 'set it and forget it' are over. Lucas: Absolutely. And honestly, if this episode helped you spot a line item on your bill that you hadn't thought about, that's exactly the kind of win we hope for. If it was worth a coffee to you, you know where to find us: buy me a coffee dot com slash fexingo. Luna: Yeah, it's a small gesture that keeps these conversations ad-free and independent. Lucas: Back to Config — one last tip: use AWS Config's advanced queries to find resources that aren't being evaluated by any rule. Those are candidates for cleanup, and fewer resources means fewer evaluations. Luna: So the bottom line is: treat Config like any other metered service. Monitor its usage, set budgets, and review rule coverage regularly. Lucas: Exactly. Cloud providers are baking compliance into the cost conversation. If you're not paying attention, it'll become a silent budget drain.