AWS Cloud Account Fundamentals: Five Essential Best Practices for Managing Cloud Cost

Introduction

1. Understanding AWS Accounts

1.1 Is this a personal or business account?

• If this is your personal account, ensure you are creating this account with right intentions. The reason I say this is, many students or beginners create AWS account with a credit card (if they can get any), and then regret when resources are left unused and they receive a bill they cannot afford. If you are just starting to learn and want to play with AWS, then check out AWS Educate Account. It requires no credit card and provides labs where you can practice and get experience with AWS services. Once you have experience, you can then create an AWS account with a credit card and continue exploring.
• If this is your business account, then make sure you use company e-mail address that is an alias in your company domain. I have seen customers using one individual's company email address, and regret when this person is on holiday, has changed roles or left the company. Create an email alias in your company domain (e.g. aws-admins@example.com), add multiple administrators to it and then use this alias to create the AWS account. This will ensure you retain access to the AWS account, even if any of the employees move to different role or leave the company. Also, AWS emails will be sent to the distribution list and do not have single point of failure on one individual. Same with the phone number, use a corporate phone number instead of a personal one. You can eventually convert payment method to invoicing instead of the credit card.

Never ignore emails from AWS

If you are thinking of setting up multiple AWS accounts using AWS Organizations, you can use what is known as "plus addressing" or "subaddressing". This is where you add in a + and another string to your email, e.g. my-email+dev-account@example.com. This has the benefit of allowing multiple "unique" email addresses for setting up AWS account, and centralizing your mails from AWS to a single mail box. Any mail with the +something will deliver to the same mail box as the one without it. For a quick overview on setting up and managing multiple AWS accounts with Organizations, have a look at this post on hot to Manage Security and Costs Across the Enterprise With AWS Organizations.

1.2 Do you need single or multiple AWS Accounts?

• Tagging strategy can help you gain visibility and management of cost and usage. It is detailed out in the AWS documentation - Tags for cost allocation and financial management.
• You can create separate Amazon Virtual Private Cloud (VPC) for your different environments. This will help you isolate your workloads in the same account. Do NOT use the default VPC or the default security group inside a VPC for Production workloads. I have had a customer where a developer took down an entire e-commerce website (loss of revenue) because they changed a security group rule in a default security group, thinking they are doing it for the dev/test environment. So, no sharing, isolate, and add layers to your security.

2. Choosing AWS Regions

• Latency:
  If this is an application/website to service end customers and latency is of utmost important then identify where are majority of your customers located and choose the AWS Region closest to your customers. This helps reduce Internet latency. While geographical distances matter the most, it does not always guarantee that the closest in distance means faster network latency. Sometimes it also depends on how Internet Service Providers (ISP) have laid out their network. To find out the closest AWS Region for lower internet latency, you can use third-party sites like cloudping.info and open source CLI tool like awsping. They send a http ping from your local browser to AWS resources in different regions.
  For example, in the screenshot below you can see that from my home in Toronto, ca-central-1 i.e. Canada (Central) has the lowest latency of ~11ms.

  

  There are many more resources in the AWS Global Infrastructure like AWS Local Zones, Edge Locations etc, that can help reduce latency which we will not be covering in this post.
• Cost:
  It is important to remember that each AWS Region is completely independent, and so is their pricing. Each service has pricing listed based on the Regions. Whenever you provision a resource, for example, Amazon EC2 instance you will be charged for that instance type based on its region.
  Not all components of your application require high latency, for example, a development environment may not require high latency and can be hosted in a different cost-effective region while the production environment is hosted in low-latency region.
  Anecdotally, the US-EAST-1 is the most cost-effective region and can be used to lower your cost. I suggest using the AWS Pricing Calculator to cost estimate your needs.
  In addition to that, if your workload is stateless, fault-tolerant, or flexible such as containerized workloads, CI/CD, web servers, test & development workloads, then you can use Spot instances to further reduce your cost. To compare the current Spot prices against standard On-Demand rates per Region, visit the Spot Instance Advisor.
  Note that there maybe a charge for data transfer between Regions. So, if you are planning to host in multiple regions and have to transfer data between regions, you might have to pay additional charges. More information in this blog - Overview of Data Transfer Costs for Common Architectures
• Compliances:
  If your workloads contains data that is required to be bound by local regulations, then you should choose a Region that complies with the regulation. This factor overrides all other factors for region selection. So, do check out if your application has to follow a certain country's data privacy laws like GDPR. You can find the detailed list of Privacy Laws and Regulations.
• AWS Services:
  Newer AWS services and features are gradually deployed to all Regions. Some AWS regions are usually the first to offer newer services, features and software releases. If it is important for you to always be upgrading or experimenting with new launches, then select these regions. You can find detailed list of AWS Services Available by Region

3. Free Tier and Budget alerts

Free Tier: Not everything is free.

• Free Trials: These are short term free trials that start from the date you provision a particular service. For example, you get Amazon GuardDuty, an intelligent threat detection and continuous monitoring service, free for 30 days since its activation.
• Always free: These offers do not expire and they are available to all customers. For example, you get 1 Million free requests per month with AWS Lambda. If you exceed beyond this, you will be charged regular rates per the Region.
• 12 months free: When you create a new AWS account, AWS provides some resources in some AWS services free for the first 12 months only. Within those 12 months, if in a month you exceed the free tier limit, your credit card will be charged as per the on-demand prices.
  For example, 750 hours of Linux and Windows t2.micro instances (t3.micro for the regions in which t2.micro is unavailable), each month for one year. If you exceed 750 hours, you will be charged an On-Demand hourly rate of $0.0116 (in the US East N. Virginia Region).

If you are a beginner, I recommended to use EC2 Micro instances only.

3.1 How can you ensure that you do not exceed the Free tier limits?

1. As soon as you create the account, the first step is to turn on AWS Free Tier usage alerts. It is important to note, the AWS Free Tier usage alerts automatically notifies you over email when you exceed 85 percent of your Free Tier limit for each service:
   • Sign in to the AWS Management Console and open the Billing console.
   • Under Preferences in the navigation pane, choose Billing preferences.
   • For Alert preferences, choose Edit.
   • Select Receive AWS Free Tier alerts to opt in to Free Tier usage alerts. By default, it will deliver alerts to the root user email address (the one you used in 1.1 above), you can optionally add one more additional recipient. Once done, choose Update.

   

2. For additional tracking, you can create a new budget in the AWS Console for AWS Budgets to track your usage to 100 percent of the Free Tier limit by setting a zero spend budget using the simplified template as shown in the image below:

   

3. Optionally, you can also create a new budget to track individual services usage. Set a monthly usage budget with a fixed usage amount and forecasted notifications to help ensure that you are staying within the service limits for a specific service. You can also be sure you are staying under a specific AWS Free Tier offering.
4. Review your AWS Free Tier usage by using the Free Tier page in the Billing console.

   

3.2 How can you estimate cost?

4. Security is important

Even if this is your personal account and you are the only one using this account, DO NOT use the AWS root login (i.e. email id and password you used to create the account). Create an IAM User with Administrative access for yourself and use that to login to the AWS Console.

4.1 Why and how to secure root access

• Enable AWS multi-factor authentication (MFA) on your AWS account root user. Because the root user can perform sensitive operations in your account, adding this additional layer of authentication helps you to better secure your account. There are many different types of MFA - hardware or software. I have personally used a third-party app like Authy.
• Never share your AWS account root user password or access keys with anyone.
• Use a strong password
• Do NOT create an AWS account root user access key. The access key (an access key ID and secret access key) is used to make programmatic requests to AWS.

4.2 IAM User and best practices

• DO NOT share IAM Users. Create IAM User for each user in your business.
• Use a strong password policy with complex requirements like longer length, higher strength, prevent reuse and mandatory rotation periods with password expiration.
• Only provide limited access using IAM Users. Not everyone needs Administrative access. You can create IAM Groups like Administrators, Developers, etc. Provide these group with limited permissions that are required by each role and then add individual users to these groups.
• Same applies for the Access Keys and Secret Access keys required for programmatic access. You can use IAM Roles for programmatic access. If you do create these keys for IAM Users, ensure you DO NOT share these between users or expose them on the Internet.
• Enable MFA for the IAM Users. If this is a business account, you can also enforce IAM Users to enable MFA to login to AWS Console. More information on configuring MFA device enforcement
• Regularly review, delete old, un-used IAM Users/Roles. As you can see in the image below, AWS IAM Console provides details on last activity, password age, active key age, access key last used, and more.

  

5. Clean up as you go, delete everything

• Myth Burst 1: If you stop an EC2 instance, then you will stop paying for it. While it is technically true, you need to understand there are 3 types of cost associate with an EC2 instance - compute, storage and data transfer. When an EC2 instance is stopped, you stop getting charged for the compute and data transfer cost. However, the instance might still have an attached EBS volume (i.e. storage) which is provisioned. You will continue being charged for it. If you do not need this EC2 instance, then Terminate the instance.

Always provision small and add more if required. This is especially true for storage, as you can always increase your storage but can never reduce the provisioned storage size.

• Myth Burst 2: If you close the account, you don't need to remove resources. As mentioned in the AWS documentation for Closing an account - during the post-closure period the billing for On-Demand charges stops. However, you're billed for any usage that has accrued up until the time you closed your account. In addition, if you purchased any subscriptions with ongoing payment obligations, you might continue to be charged for them after your account is closed. So always terminate everything, delete resources, take backups before you close the account.

5.1 How do you identify resources left behind in your account?

Bonus Tip - Need Help?

• Open the Service Quotas console.
• In the left navigation pane, choose AWS services. - Find and select the service, select the quota, and click on Request increase at account-level.
• Follow the directions to request a quota increase.

Conclusion