Latest / The Cloud Business Podcast with Fexingo: AWS, Azure, GCP, and Enterprise Infrastructure / Why Cloud Contracts Now Bill for VPC Flow Logs
Transcript
- Lucas: If you're running workloads in any major cloud and you've got VPC flow logs enabled — and most of you do — there's a good chance your August bill is going to look noticeably different than July's. And not in a good way. Luna: I've seen some chatter about this. Flow log pricing used to be basically free, right? Just the cost of storing them in S3 or CloudWatch? Lucas: Right. Historically, AWS, Azure, and GCP all treated VPC flow log data as a free feature — you only paid for the destination storage. But starting late last year, AWS began charging per gigabyte for flow log ingestion into CloudWatch Logs. Azure followed with per-gigabyte charges for NSG flow logs sent to Log Analytics. And GCP is now charging for VPC flow logs routed to BigQuery or Pub/Sub. Luna: So it's not just one provider. They all moved roughly in sync. What's the actual per-gigabyte cost looking like? Lucas: Let's use a concrete example. I talked to a SaaS company last month — they run about 800 EC2 instances across three AWS regions. They had VPC flow logs enabled for all traffic, sending everything to CloudWatch Logs. Their July bill showed a new line item: 'VPC Flow Log Ingestion — 4.7 TB — $46,830.' That's at the standard rate of roughly 50 cents per gigabyte ingested. And that's just for flow logs. Luna: Fifty cents per gig might not sound like a lot, but when you're shipping every single packet header across hundreds of instances, it adds up fast. 4.7 terabytes is a lot of metadata. Lucas: It is. And that's only if you're sending to CloudWatch. If you're routing flow logs to a third-party SIEM like Splunk or Datadog, you're paying the cloud provider for the log ingestion and then you're paying the SIEM vendor for storage and indexing. Double hit. Luna: Yeah, I've seen cases where the SIEM bill doubles because of this. So the question is: what changed? Why did cloud vendors start charging for something that was essentially free for years? Lucas: The official line is infrastructure cost recovery. Flow log data passes through the cloud provider's network and uses compute resources to aggregate, filter, and route. As traffic volumes exploded — especially with microservices architectures generating tons of east-west traffic — the cost of handling that metadata became significant. AWS said at re:Invent that they were processing exabytes of flow log data daily. That's not free to operate. Luna: So they're basically saying, 'Hey, we've been subsidizing your network monitoring. Now you need to pay for it.' Which is fair, but it's a big shift for FinOps teams who budgeted zero for this. Lucas: Exactly. And the pricing isn't uniform across providers. Let's compare. AWS charges $0.50 per gigabyte for VPC flow logs ingested into CloudWatch Logs, but if you send them to S3, the ingestion is still free — you just pay S3 storage rates. Azure charges $0.60 per gigabyte for NSG flow logs sent to Log Analytics. GCP charges $0.08 per gigabyte for VPC flow logs sent to BigQuery, but with a caveat: if you use the default 'routing' mode that aggregates logs, it's cheaper than if you send raw logs. Luna: GCP at eight cents sounds like a bargain. But I bet there's a catch — like you need to be in a specific region or commit to a certain volume. Lucas: There is. The eight-cent rate applies to logs in the 'aggregated' tier, which means the cloud provider groups flows by destination and protocol before sending. That loses some granularity — you can't see every individual packet flow. If you need raw, unaggregated logs, GCP charges twenty cents per gig. Still cheaper than AWS or Azure, but you lose visibility. Luna: Which ties back to what we hear from listeners: that these pricing changes feel opaque. One day you're not paying for it, the next day you are. And the cloud providers don't exactly put up a big banner saying 'We're adding a charge for this feature you rely on.' Lucas: It's a pattern we've seen across several episodes — cloud contracts now charge for things that were previously bundled. And it's part of why we do this show: to help operators and builders understand what's actually in their contracts and bills. Luna: If these conversations are useful for what you're building or running, listener support is what keeps this show ad-free and independent. You can find us at buy me a coffee dot com slash fexingo. Just a simple way to say this matters to you. Lucas: Appreciated. Okay — back to flow logs. So you've got this new cost. What can you actually do about it? First, take a hard look at your flow log retention. Many teams enable flow logs and never revisit the configuration. If you're keeping 90 days of flow logs in CloudWatch Logs, ask yourself: do you really need that granularity for the full 90 days, or could you archive older data to S3 and query it only when needed? Luna: That's the big one. Also, sampling. I've seen AWS users set a sampling rate of 1 in 10 packets for non-critical environments. That cuts the cost by 90 percent. But you lose some accuracy for security investigations. Lucas: Right. The trade-off is always between visibility and cost. But for many applications, you don't need every single flow. You need enough to detect anomalies and measure traffic patterns. Another tactic: aggregate logs before they leave your VPC. AWS offers a feature called 'aggregated flow logs' that groups flows by the same five-tuple over a five-minute window. That reduces volume significantly — the SaaS company I mentioned cut their flow log volume from 4.7 TB to 1.2 TB just by enabling aggregation. Luna: That's a 75 percent reduction. At 50 cents per gig, that's going from $46,000 to around $12,000. Worth doing. Lucas: Exactly. On Azure, you can use 'traffic analytics' which aggregates NSG flow logs and provides intelligence — but that comes with its own per-gigabyte cost, so you have to calculate whether the aggregation saves enough to offset the analytics fee. GCP's built-in aggregation is essentially free in terms of compute, but you lose some metadata. Luna: What about routing to cheaper destinations? You mentioned S3 for AWS. Is that a viable alternative to CloudWatch? Lucas: Absolutely. If you send VPC flow logs directly to S3, AWS charges zero for ingestion. You pay only S3 storage, which is about 2.3 cents per gigabyte for standard storage. That's a massive difference from 50 cents. The trade-off is that you lose CloudWatch's built-in querying and alerting. But you can set up Athena to query S3 flow logs, or use a third-party tool like Logstash or Fluentd to process them. Many teams are doing exactly that. Luna: So the pattern is: avoid the premium ingestion destination, use cheap object storage, and process logs yourself. That's the opposite of what the cloud vendors want you to do, but it's financially rational. Lucas: Right. And this is where understanding your contract matters. Some enterprise agreements include volume discounts on CloudWatch Logs ingestion. If you're committed to a certain spend, you might get flow log ingestion at a lower effective rate — maybe 30 cents per gig instead of 50. But that's only if you negotiate it. The default pricing is the list price. Luna: I've also seen teams reduce flow log volume by tightening the scope. Instead of enabling flow logs for every VPC and every subnet, they enable them only for production environments or for subnets that handle sensitive data. That's obvious, but you'd be surprised how many companies have flow logs on development VPCs generating terabytes of noise. Lucas: Good point. Another thing: filter by traffic type. AWS allows you to specify 'accepted' or 'rejected' traffic only. If you're only interested in blocked traffic for security monitoring, you can reject all accepted traffic — which is usually the bulk of flow log data. That can cut volume by 80 percent or more. Luna: But then you miss out on baselining normal traffic. So again, trade-off. I think the key takeaway is that flow log costs are now a real line item, and teams need to proactively manage them rather than just enabling and forgetting. Lucas: Absolutely. And as cloud providers continue to unbundle features and charge separately, FinOps teams need to stay on top of these changes. The era of 'free metadata' is over. Luna: One more thing I've seen: some organizations are moving to agent-based monitoring instead of VPC flow logs. They deploy agents on each instance that capture and send network data to their SIEM, bypassing the cloud's native flow log service entirely. Lucas: That works, but it adds operational overhead — you have to manage agents, updates, and credentials. And the SIEM still charges per gigabyte of data ingested. So you're shifting cost from the cloud provider to the SIEM provider, but not necessarily reducing total cost. The real savings come from reducing the volume of data you send anywhere. Luna: Right. So the first step is always: measure your current flow log volume. Then apply sampling, aggregation, filtering, and destination optimization. Then re-evaluate. Lucas: And if you're negotiating a new cloud contract or renewal, consider adding a specific line item for flow log pricing. Push for a discounted ingestion rate or a cap on total costs. Some cloud providers are willing to include flow log ingestion in their 'commitment-based discounts' if you ask. Luna: Interesting. So the pricing is not set in stone. It's negotiable, especially if you're a large customer. Lucas: Exactly. The SaaS company I spoke with originally had no discount on flow logs. After they noticed the $46,000 charge, they went back to their AWS account team and negotiated a 30 percent discount on CloudWatch Logs ingestion, bringing their rate down to 35 cents per gig. They also moved older logs to S3. Combined, they cut their flow log cost from $46,000 to about $8,000. Luna: That's an 83 percent reduction. All from a conversation and some configuration changes. Lucas: Right. So the message is: don't accept the default pricing. Question every line item. And for flow logs specifically, take control before the bill arrives. Luna: Good advice. Next episode, we'll look at another hidden charge that's quietly showing up on cloud bills. Until then, keep an eye on those flow logs.