Latest / The Cloud Business Podcast with Fexingo: AWS, Azure, GCP, and Enterprise Infrastructure / How Cloud Bills Now Meter Your Firewall Rule Evaluations
Transcript
- Lucas: So there's a new line item showing up on enterprise cloud invoices that most architects haven't even noticed yet, and it's tied to something you've always assumed was free: firewall rules. Luna: Wait, firewall rules? As in, the security group rules I've been configuring for a decade — those are now metered? Lucas: Exactly. The big three — AWS, Azure, and GCP — have all quietly moved toward metering firewall rule evaluations. Not the rules themselves, but the actual evaluation of each packet against your rule set. And the billing model is very different from what you'd expect. Luna: So it's not like a flat fee per rule? It's based on how many times a packet gets checked? Lucas: Right. Think of it like this: every time your instance sends or receives traffic, the hypervisor's firewall engine has to run through your security group's rules to decide whether to allow or drop it. Under the new metering, each of those evaluations can generate a billable event. And the pricing is per million evaluations — I've seen rates around five to eight dollars per million, depending on the provider and region. Luna: That sounds small. But for a busy production environment with high packet-per-second rates, those millions add up fast. Lucas: That's the catch. A single web server handling, say, fifty thousand requests per second can generate billions of evaluations in a day. Suddenly that five dollars per million becomes five thousand dollars per day just for one instance. And that's before you count the rest of your fleet. Luna: Wow. So this is a game-changer for anyone running large-scale workloads. But why did providers make this change? I mean, firewall rule evaluation was always a cost to them, but they used to eat it. Lucas: It's the same story we've seen across the industry: as infrastructure becomes more software-defined, every CPU cycle gets metered. The providers argue that firewall evaluation is a compute-intensive operation, especially with stateful engines that track connection state. And they've been under pressure to align pricing with actual resource consumption. So instead of baking it into the instance cost, they're itemizing it. Luna: Makes sense from their perspective, but it puts a new burden on us to understand our traffic patterns. How do you even see what you're being charged for? Lucas: All three providers now expose firewall evaluation metrics in their billing dashboards. You can see the number of evaluations per rule per hour, which is actually useful for optimization. But the challenge is that the bill often arrives with a single aggregated line item, so you have to dig into the metrics to see which rules are driving the cost. Luna: So what's the actual impact on a typical enterprise? Can you give me a concrete example? Lucas: I've been looking at a fintech company that runs a large Kubernetes cluster on AWS. They have a security group with about three thousand rules — the kind of thing you get when every microservice gets its own rule set. Their traffic is maybe two thousand packets per second per node, and they have a hundred nodes. That's two hundred thousand evaluations per second. Over a month, that's about five hundred billion evaluations. At even five dollars per million, that's two and a half million dollars a year. Luna: Two and a half million? That's not a rounding error. That's a line item your CFO is going to question. Lucas: And the kicker is, most of those rules are probably redundant. The classic mistake is creating per-microservice security groups with overlapping CIDR blocks. You end up with dozens of rules that all allow traffic from the same range, just with different ports. Luna: So consolidation is the obvious fix. But how do you do that without breaking security? Lucas: The first step is to look at your rule-ordering. Firewall evaluation often stops at the first match, so if you have a broad allow rule at the top, you can skip evaluating the rest of the rule set for that packet. In the metered world, that means fewer evaluations per packet. So reordering can cut your bill significantly. Luna: That's a smart optimization. But doesn't that only work if your rules are actually evaluated in order? I thought security groups were stateless and evaluated in a random order. Lucas: Good question. AWS security groups are actually stateful, and they do evaluate in order — but the order isn't something you directly control in the console. However, you can control the order by using rule numbers in Azure Network Security Groups, and GCP firewall rules have a priority field. So you have more control than you think. Luna: Got it. So for AWS, you're stuck with the order they give you. But you can still consolidate rules to reduce the number of evaluations, right? Lucas: Exactly. Instead of having ten rules for ten different ports from the same source, you can use a single rule with a port range. And more importantly, you can use prefix lists to group IP ranges, so you're not evaluating against a hundred separate CIDR blocks. That can reduce the rule count dramatically. Luna: Prefix lists — that's a solid tip. I've seen those used for VPC endpoints and such, but applying them to security group rules is a great way to cut down on rule count. Lucas: And there's another angle: think about your default security postures. A lot of teams have a broad 'allow-all-egress' rule because it's easy. But under the new metering, that rule is evaluated for every outbound packet. If you tighten your egress rules to only allow the specific destinations you actually use, you can cut down on evaluations and also improve your security posture. Luna: So it's a win-win: lower cost and better security. But what about the architecture side? Are there patterns that naturally minimize firewall evaluation overhead? Lucas: One pattern is to move your firewall enforcement to a centralized point, like a network virtual appliance or a cloud-native firewall service. Instead of having security groups on every instance, you route traffic through a central inspection point. That way, you're evaluating once per flow, not once per packet across many rules. But that introduces latency and its own costs, so it's a trade-off. Luna: Right. And what about using security groups at the subnet level instead of instance level? Does that change the evaluation count? Lucas: Yes — network ACLs, which are stateless, are evaluated at the subnet boundary. They're often simpler, but because they're stateless, they require both inbound and outbound rules for every flow, which can double the number of evaluations. So you might be better off with stateful security groups that track connections automatically. Luna: Interesting. So the choice between stateless and stateful has direct billing implications now. I never thought of it that way. Lucas: And it's not just about your security groups. If you're using managed services like load balancers or API gateways, they also have their own firewall evaluations that get passed down to you. So you need to look at the whole path of your traffic, not just the instance-level rules. Luna: That's a lot to consider. But before we go deeper into that, I want to pause on something. We've been talking about how these charges can add up — and it reminds me of how important it is to have tools that help you see this clearly. And honestly, the reason I can explore these topics freely is because of the listeners who support the show. Lucas: Yeah, absolutely. A couple of dollars a month is genuinely what keeps these going. If you've gotten value from our deep dives into cloud billing, you can help us keep doing it at buy me a coffee dot com slash fexingo. It's a small thing that makes a real difference. Luna: And we don't have any ads, so this is how we keep the lights on. Any support is appreciated, but no pressure. Lucas: Right. Now, back to those managed services — they can really amplify your firewall bill. For example, an application load balancer evaluates rules for every request, and if you have a large number of rules, that's a lot of evaluations. But you can use listener rules with host-based routing to reduce the number of rules per request. Luna: So the same principle applies: fewer rules per packet, lower bill. Are there any tools or scripts that can help you analyze your current firewall rule usage? Lucas: All the major cloud providers now have cost-analysis tools that break down firewall evaluation usage. You can query the metrics via APIs and build your own dashboards. There are also third-party FinOps tools that can flag redundant rules and suggest consolidations. The key is to start measuring now, because the bills are only going to get more granular. Luna: And with August 2026 just starting, I bet a lot of teams are looking at their Q3 forecasts and seeing these new line items for the first time. Lucas: Absolutely. We're in the middle of the first full quarter where these charges are hitting everyone who signed new contracts after the pricing change. So if you haven't checked your latest invoice, now's the time. Luna: What's the one thing you'd tell our listeners to do tomorrow to get ahead of this? Lucas: Pull your firewall evaluation metrics for the last thirty days. Look for any security group that has more than fifty rules, and see if you can consolidate them using prefix lists or allow lists. Even a ten percent reduction in rule count can translate to significant savings at scale. Luna: And if you're on Azure or GCP, the same advice applies — though the console might look different. But the principle is universal: every rule you remove is money back in your pocket. Lucas: Exactly. And as the cloud providers continue to meter every layer of the stack, staying on top of these granular costs will separate the efficient operators from the ones who get surprised at the end of the month. Luna: Well said. And I think that's a great note to end on — though I'm curious to see how many listeners check their bills tonight and find a surprise.