Latest / The Cloud Business Podcast with Fexingo: AWS, Azure, GCP, and Enterprise Infrastructure / Why Cloud Contracts Now Charge for IAM Role Assumption Events
Transcript
- Lucas: So you've got a CI/CD pipeline that deploys to three different AWS accounts — dev, staging, production. Each time it switches roles to grab credentials, that's an IAM role assumption event. And as of this year, those events are no longer free. Luna: Wait — we're now being charged for identity operations? I thought IAM was always included in the cost of doing business. Lucas: It used to be. But in early 2026, AWS quietly added a line item to their billing for 'IAM Role Assumption Requests' — specifically for roles that assume another role. The first 100,000 per account per month are free, then it's $0.01 per 10,000 after that. Sounds tiny, but when you're running hundreds of pipeline runs daily, it adds up. Luna: This is exactly the kind of background noise that kills budgets. And I bet most teams haven't even noticed yet because it shows up under 'CloudTrail costs' or something obscure. Lucas: Exactly. And that's why we do these episodes — to surface the hidden line items. Before we dig into the numbers, a quick note: we deliberately don't run ads on this show. If these conversations help you keep your cloud bills in check, and you want to support that mission, you can find us at buy me a coffee dot com slash fexingo. No pressure, just a way to keep this independent. Luna: Yeah, and it really helps. Now back to role assumption — give us the real-world example you mentioned. Lucas: Sure. I talked to a finops engineer at a mid-sized SaaS company — about 300 employees. They use a central CI/CD platform that assumes roles into each environment. Between their pipelines, automated security scans, and data backups, they were hitting around 2 million role assumptions per month. That's 1.9 million billable events after the free tier. At $0.01 per 10,000, that's $1.90. Sounds negligible, but then they also have cross-account monitoring tools doing role switches every few minutes. Luna: So it's not just the direct cost — it's the aggregate across all the automation. What was their total? Lucas: Across all accounts, they ended up with about 12 million billable events per month, which translated to roughly $12,000 annually. Not catastrophic for a company their size, but it's a completely new line item that didn't exist a year ago. And for larger enterprises with thousands of accounts, it could be six figures. Luna: So what's driving this? Why do they want us to pay for identity switching? Lucas: On the record, AWS says it's about recovering infrastructure costs — every role assumption requires a secure token service lookup, auditing, and logging. But off the record, it's pretty clearly a way to monetize the fact that cloud usage patterns have shifted from long-lived users to short-lived automation roles. Luna: And they can do it because they own the endpoint. There's no competition on IAM calls. Lucas: Right. Azure and GCP haven't announced similar charges yet, but I'd bet they're watching. AWS generally leads on these micro-billing changes. So the immediate question is: how do you reduce your role assumption volume? Luna: I assume the first step is auditing. Are there tools to track this? Lucas: Yes. You can use CloudTrail Insights or Athena queries on the 'AssumeRole' event. Load that into a cost-intelligence tool, and you'll see which roles are being called most often. One pattern we saw was a pipeline that assumed a role for every single build step — instead of reusing the same session. Consolidating that into fewer switches cut their volume by 40%. Luna: So caching the credential session instead of re-authenticating each time. That's the obvious fix. Lucas: Exactly. Another approach is to use IAM Roles Anywhere — that issues temporary credentials without needing a role assumption chain. Or you can use AWS Systems Manager to run commands directly without switching roles. Luna: But aren't those services also getting metered now? I heard Systems Manager parameter store calls are becoming billable. Lucas: That's a topic for another episode, but you're right — the days of free infrastructure actions are ending. The cloud providers are moving towards a per-operation billing model. So the strategic takeaway is: design your automation to minimize API calls, cache tokens, and batch operations where possible. Luna: It's like the old adage: if you don't measure it, you can't optimize it. And now you have to measure identity. Lucas: Precisely. I think the broader lesson is that cloud financial management needs to include identity operations. Most FinOps teams focus on compute, storage, and data transfer — they ignore IAM. This billing change forces them to incorporate it. Luna: So for someone listening right now, what's the one action they should take this week? Lucas: Run a CloudTrail query for all AssumeRole events in the last 30 days. Get a count per role, per account. You'll see which pipelines are the biggest offenders. Then start consolidating role switches. A 50% reduction is achievable in a month. Luna: And check if your cloud provider has started charging for this. AWS already has. Any timeline for Azure or GCP? Lucas: Nothing public yet. But based on the pattern, I'd expect Azure to introduce something similar within the next two quarters. They've been rebranding Azure AD to Microsoft Entra ID — that might be a vehicle for metering identity calls. Luna: So we're moving to a world where every API call has a microcost. That's a big shift from the 'infinite resource' era of cloud. Lucas: It really is. And it means the cloud is becoming more like a utility — you pay for every unit of consumption. The winning architectures will be the ones that minimize overhead operations like role switching. Luna: Alright, Lucas — thanks for walking us through this. I'm going to go audit my own pipelines tonight. Lucas: Good call. We'll keep tracking these changes and share what we find. Until next time.