AWS solutions documentation change
Summary
Updated cost estimates and pricing details for AWS services involved in automated security response deployments. Added new service pricing entries (Cognito, CloudFront, S3, API Gateway), modified free tier descriptions, and introduced Web UI/Action Log configuration examples.
Security assessment
Changes focus on cost calculations and service pricing updates without addressing vulnerabilities or security controls. While KMS/WAF/Cognito are security services, the modifications only document pricing aspects rather than security features or vulnerabilities.
Diff
diff --git a/solutions/latest/automated-security-response-on-aws/cost.md b/solutions/latest/automated-security-response-on-aws/cost.md index 69402fba2..1f5fad3ea 100644 --- a//solutions/latest/automated-security-response-on-aws/cost.md +++ b//solutions/latest/automated-security-response-on-aws/cost.md @@ -13 +13 @@ As of this revision, the estimated monthly costs are: - * Small deployment (10 accounts, 1 region - US East/N. Virginia): Approximately $21.17 for 300 remediations/month + * Small deployment (10 accounts, 1 region - US East/N. Virginia): Approximately $20.73 for 300 remediations/month @@ -15 +15 @@ As of this revision, the estimated monthly costs are: - * Medium deployment (100 accounts, 1 region - US East/N. Virginia): Approximately $134.86 for 3,000 remediations/month + * Medium deployment (100 accounts, 1 region - US East/N. Virginia): Approximately $136.57 for 3,000 remediations/month @@ -17 +17 @@ As of this revision, the estimated monthly costs are: - * Large deployment (1,000 accounts, 10 regions): Approximately $10,271.70 for 30,000 remediations/month + * Large deployment (1,000 accounts, 10 regions): Approximately $10,460.80 for 30,000 remediations/month @@ -49,2 +49,2 @@ Service | Free Tier | Pricing [USD] -[AWS Systems Manager Automation - Step Count](https://aws.amazon.com/systems-manager/pricing/) | 100,000 steps per account per month | Beyond the free tier, each basic step is charged at $0.002 per step. For multi-account automations, all steps including those run in any child accounts are counted only in the originating account. -[AWS Systems Manager Automation - Step Duration](https://aws.amazon.com/systems-manager/pricing/) | 5,000 seconds per month | Beyond the free tier, each aws:executeScript action step is charged at $0.00003 for every second after a free tier of 5,000 seconds per month. +[AWS Systems Manager Automation - Step Count](https://aws.amazon.com/systems-manager/pricing/) | No free tier | Each basic step is charged at $0.002 per step. For multi-account automations, all steps including those run in any child accounts are counted only in the originating account. +[AWS Systems Manager Automation - Step Duration](https://aws.amazon.com/systems-manager/pricing/) | No free tier | Each `aws:executeScript` action step is charged at $0.00003 for every second. @@ -53,3 +53,3 @@ Service | Free Tier | Pricing [USD] -[AWS Security Hub - Security Checks](https://aws.amazon.com/security-hub/pricing/) | No free tier | First 100,000 checks/account/Region/month costs $0.0010 per check Next 400,000 checks/account/Region/month costs $0.0008 per check Over 500,000 checks/account/Region/month costs $0.0005 per check -[AWS Security Hub - Finding Ingestion Events](https://aws.amazon.com/security-hub/pricing/) | First 10,000 events/account/Region/month is free. Finding ingestion events associated with Security Hub’s security checks. | Over 10,000 events/account/Region/month costs $0.00003 per event -[Amazon CloudWatch - Metrics](https://aws.amazon.com/cloudwatch/pricing/) | Basic Monitoring Metrics (at 5-minute frequency) 10 Detailed Monitoring Metrics (at 1-minute frequency) 1 Million API requests (not applicable to GetMetricData and GetMetricWidgetImage) | First 10,000 metrics costs $0.30 metric/month Next 240,000 metrics costs $0.10 metric/month Next 750,000 metrics costs $0.05 metric/month Over 1,000,000 metrics costs $0.02 metric/month API calls cost $0.01 per 1,000 requests +[AWS Security Hub CSPM - Security Checks](https://aws.amazon.com/security-hub/cspm/pricing/) | No free tier | First 100,000 checks/account/Region/month costs $0.0010 per check Next 400,000 checks/account/Region/month costs $0.0008 per check Over 500,000 checks/account/Region/month costs $0.0005 per check +[AWS Security Hub CSPM - Finding Ingestion Events](https://aws.amazon.com/security-hub/cspm/pricing/) | First 10,000 events/account/Region/month is free. Finding ingestion events associated with Security Hub’s security checks. | Over 10,000 events/account/Region/month costs $0.00003 per event +[Amazon CloudWatch - Metrics](https://aws.amazon.com/cloudwatch/pricing/) | Basic Monitoring Metrics (at 5-minute frequency) 10 Detailed Monitoring Metrics (at 1-minute frequency) 1 1 Million API requests (not applicable to GetMetricData, GetInsightRuleReport and GetMetricWidgetImage) | First 10,000 metrics costs $0.30 metric/month Next 240,000 metrics costs $0.10 metric/month Next 750,000 metrics costs $0.05 metric/month Over 1,000,000 metrics costs $0.02 metric/month API calls cost $0.01 per 1,000 requests @@ -60 +59,0 @@ Service | Free Tier | Pricing [USD] -[Amazon CloudWatch - Events](https://aws.amazon.com/cloudwatch/pricing/) | All events except custom events are included | $1.00 per million events for custom events $1.00 per million events for cross-account events @@ -68 +67,5 @@ Service | Free Tier | Pricing [USD] -[AWS Key Management Service pricing](https://aws.amazon.com/kms/pricing/) | 20,000 requests/month | $1.00 per 1 KMS key. For KMS keys that you rotate automatically or on demand, the first and second rotation of the key adds $1/month (prorated hourly) in cost. +[AWS Key Management Service](https://aws.amazon.com/kms/pricing/) | 20,000 requests/month | $1.00 per 1 KMS key. For KMS keys that you rotate automatically or on demand, the first and second rotation of the key adds $1/month (prorated hourly) in cost. +[Amazon Cognito](https://aws.amazon.com/cognito/pricing/) | In the Essentials tier, the first 10,000 Monthly Active Users are free. Note: This free tier is 50 Monthly Active Users when users authenticate via external IdP (SAML/OIDC). | $0.015 per Monthly Active User greater than 10,000 users. +[Amazon CloudFront](https://aws.amazon.com/cloudfront/pricing/) | Free tier includes 1 TB of data transfer out and 10,000,000 HTTP or HTTPS Requests per month. | (US/Canada/Mexico) First 9TB is $0.085 per month. Next 40TB is $0.080 per month. $0.0075 per HTTP request. $0.0100 per HTTPS request. +[Amazon S3](https://aws.amazon.com/s3/pricing/) | No Free Tier | First 50 TB is $0.023 per GB per month. $0.005 per 1,000 PUT, COPY, POST, LIST requests. $0.0004 per 1,000 GET, SELECT, and all other requests. +[Amazon API Gateway](https://aws.amazon.com/api-gateway/pricing/) | 1 Million REST API calls in the first 12 months of usage. | $3.50 per million for the first 333 million API calls. @@ -78 +81,7 @@ Service | Free Tier | Pricing [USD] - * Total cost $21.17 per month + * 500 Security Hub findings processed per account/Region/month + + * **Web UI disabled** + + * **Action Log disabled** + + * Total cost $20.73 per month @@ -87,4 +96,4 @@ AWS Security Hub | No billable services utilized | $0 -Amazon CloudWatch Logs | 300 remediations * $0.000002 = $0.0006 $0.0006 * 0.03 = $0.000018 | < $0.01 -AWS Lambda - Requests | 300 remediations * 6 requests = 1,800 requests $0.20 * 1,000,000 requests = $0.20 | $0.20 -AWS Lambda - Duration | 256M: 1.875 GB sec * 300 remediations * $0.0000167 = $0.009375 | < $0.01 -AWS Step Functions | 17 state transitions * 300 remediations = 5,100 $0.025 * (5,100/1,000) state transitions = $0.15 | $0.15 +Amazon CloudWatch Logs | $0.50 per GB | < $0.01 +AWS Lambda - Requests | 300 remediations * 7 requests = 2,100 requests 5,000 findings * 1 request = 5,000 requests $0.20 / 1,000,000 requests = $0.0000002 per request | $0.00142 +AWS Lambda - Duration | (512MB Memory) 4,000ms * 300 remediations * $0.0000000083 = $0.00996 449ms * 5,000 findings * $0.0000000083 = $.0186 | $0.029 +AWS Step Functions | 19 state transitions * 300 remediations = 5,700 $0.025 * (5,700/1,000) state transitions = $0.14 | $0.14 @@ -92,2 +101,2 @@ Amazon EventBridge rules | No charge for rules | $0 -AWS Key Management Service | 1 key * 10 accounts * 1 Region * $1 = $10 | $10.00 -Amazon DynamoDB | $2.00 * 1,000,000 read and writes = $2.00 | $2.00 +AWS Key Management Service | 1 key * 10 accounts * 1 Region * $1 = $10 (Encrypt/Decrypt API requests) (300 remediations * 2 requests) + (5,000 findings * 4 requests) = 20,600 requests $0.03 per 10,000 requests ⇒ $0.03 * (20,600 / 10,000) = $0.06 | $10.06 +Amazon DynamoDB | $2.00 * 1,000,000 read and writes = $2.00 (Findings Table) 15MB * 10 accounts * 1 region = 150MB (History Table) 10MB * 10 accounts * 1 region = 100MB $0.25 per GB-month * 0.25 GB = $0.0625 | $2.0625 @@ -95,2 +104,2 @@ Amazon SQS | $0.40 * 1,000,000 requests = $0.40 | $0.40 -Amazon SNS | $0.50 * 1,000,000 notifications = $0.50 | $0.50 -Amazon CloudWatch - Metrics | $0.30 * 7 custom metrics = $2.10 $0.01 * (300 * 3 / 1,000) put metrics API calls = $0.01 | $2.11 +Amazon SNS | $0.50 * (600 / 1,000,000 notifications) = $0.0003 | $0.0003 +Amazon CloudWatch - Metrics | (Enhanced Metrics Disabled) $0.30 * 7 custom metrics = $2.10 $0.01 * (300 put metrics API calls / 1,000) = $0.003 | $2.10 @@ -98,2 +107,17 @@ Amazon CloudWatch - Dashboards | $3.00 * 1 dashboard = $3.00 | $3.00 -Amazon CloudWatch - Alarms | $0.10 * 3 alarms = $0.30 | $0.30 -**Total** | | **$21.17** +Amazon CloudWatch - Alarms | (Enhanced Metrics Disabled) $0.10 * 4 alarms = $0.40 | $0.40 +Amazon CloudWatch - X-Ray Traces | 300 remediations * 7 requests = 2,100 Lambda invocations 5,000 findings * 1 request = 5,000 Lambda invocations $0.000005 per trace * 7,100 traces = $0.0355 | $0.0355 +**Total** | | **$20.73** + +### Example 2: 300 remediations per month (Web UI Enabled) + + * 10 accounts, 1 Region + + * 30 remediations per account/Region/month + + * 5,000 Security Hub findings processed per account/Region/month + + * **Web UI enabled** + + * **Action Log disabled** + + * Total cost $36.35 per month @@ -101 +125,28 @@ Amazon CloudWatch - Alarms | $0.10 * 3 alarms = $0.30 | $0.30 -### Example 2: 3,000 remediations per month + + + +Service | Assumptions | Monthly charges [USD] +---|---|--- +AWS Systems Manager Automation | Steps: ~4 steps * 300 remediations * $0.002 = $2.40 Duration: 10s * 300 remediations * $0.00003 = $0.09 | $2.49 +AWS Security Hub | No billable services utilized | $0 +Amazon CloudWatch Logs | $0.50 per GB | < $0.01 +AWS Lambda - Requests | 300 remediations * 7 requests = 2,100 requests 5,000 findings * 1 request = 5,000 requests $0.20 / 1,000,000 requests = $0.0000002 per request | $0.00142 +AWS Lambda - Duration | (512MB Memory) 4,000ms * 300 remediations * $0.0000000083 = $0.00996 449ms * 5,000 findings * $0.0000000083 = $.0186 | $0.029 +AWS Step Functions | 19 state transitions * 300 remediations = 5,700 $0.025 * (5,700/1,000) state transitions = $0.14 | $0.14 +Amazon EventBridge rules | No charge for rules | $0 +AWS Key Management Service | 1 key * 10 accounts * 1 Region * $1 = $10 (Encrypt/Decrypt API requests) (300 remediations * 2 requests) + (5,000 findings * 4 requests) = 20,600 requests $0.03 per 10,000 requests ⇒ $0.03 * (20,600 / 10,000) = $0.06 | $10.06 +Amazon DynamoDB | $2.00 * 1,000,000 read and writes = $2.00 (Findings Table) 15MB * 10 accounts * 1 region = 150MB (History Table) 10MB * 10 accounts * 1 region = 100MB $0.25 per GB-month * 0.25 GB = $0.0625 | $2.0625 +Amazon SQS | $0.40 * 1,000,000 requests = $0.40 | $0.40 +Amazon SNS | $0.50 * (600 / 1,000,000 notifications) = $0.0003 | $0.0003 +Amazon CloudWatch - Metrics | (Enhanced Metrics Disabled) $0.30 * 7 custom metrics = $2.10 $0.01 * (300 put metrics API calls / 1,000) = $0.003 | $2.10 +Amazon CloudWatch - Dashboards | $3.00 * 1 dashboard = $3.00 | $3.00 +Amazon CloudWatch - Alarms | (Enhanced Metrics Disabled) $0.10 * 4 alarms = $0.40 | $0.40 +Amazon CloudWatch - X-Ray Traces | 300 remediations * 7 requests = 2,100 Lambda invocations 5,000 findings * 1 request = 5,000 Lambda invocations $0.000005 per trace * 7,100 traces = $0.0355 | $0.0355 +Amazon Cognito | (Essentials Tier) 500 Monthly Active Users | $0 +Amazon CloudFront | Regional Data Transfer Out to Origin (per GB) = $0.020 Regional Data Transfer Out to Internet (per GB) = $0.085 Request Pricing for All HTTP Methods (per 10,000) = $0.0075 | $0.1125 +Amazon S3 | (UI Hosting) $0.023 per GB * 0.002 GB = $0.000046 (History Export) $0.023 per GB * 0.50 GB = $0.0125 $0.0004 per 1,000 GET requests | $0.0125 +AWS WAF | 1 Web ACL = $5.00 per month 7 rules * $1.00 per rule = $7.00 | $12 +Amazon API Gateway | $3.50 per million REST API calls | $3.50 +**Total** | | **$36.35** + +### Example 3: 3,000 remediations per month @@ -107 +158,7 @@ Amazon CloudWatch - Alarms | $0.10 * 3 alarms = $0.30 | $0.30 - * Total cost $134.86 per month + * 500 Security Hub findings processed per account/Region/month + + * **Web UI disabled** + + * **Action Log disabled** + + * Total cost $136.57 per month @@ -116,4 +173,4 @@ AWS Security Hub | No billable services utilized | $0 -Amazon CloudWatch Logs | 3,000 remediations * $0.000002 = $0.006 $0.006 * 0.03 = $0.00018 | < $0.01 -AWS Lambda - Requests | 3,000 remediations * 6 requests = 18,000 requests $0.20 * 1,000,000 requests = $0.20 | $0.20 -AWS Lambda - Duration | 256M: 1.875 GB sec * 3,000 remediations * $0.000167 = $0.09375 | $0.09 -AWS Step Functions | 17 state transitions * 3,000 remediations = 51,000 $0.025 * (51,000/1,000) state transitions = $1.275 | $1.28 +Amazon CloudWatch Logs | $0.50 per GB | < $0.01 +AWS Lambda - Requests | 3,000 remediations * 7 requests = 2,100 requests 50,000 findings * 1 request = 50,000 requests $0.20 / 1,000,000 requests = $0.0000002 per request | $0.01 +AWS Lambda - Duration | (512MB Memory) 4,000ms * 3,000 remediations * $0.0000000083 = $0.0996 449ms * 50,000 findings * $0.0000000083 = $0.186 | $0.29 +AWS Step Functions | 19 state transitions * 3,000 remediations = 57,000 $0.025 * (57,000/1,000) state transitions = $1.425 | $1.425 @@ -121,2 +178,2 @@ Amazon EventBridge rules | No charge for rules | $0 -AWS Key Management Service | 1 key * 100 accounts * 1 Region * $1 = $100 | $100 -Amazon DynamoDB | $2.00 * 1,000,000 read and writes = $2.00 | $2.00 +AWS Key Management Service | 1 key * 100 accounts * 1 Region * $1 = $100 (Encrypt/Decrypt API requests) (3,000 remediations * 2 requests) + (50,000 findings * 4 requests) = 206,000 requests $0.03 per 10,000 requests ⇒ $0.03 * (206,000 / 10,000) = $0.618 | $100.618 +Amazon DynamoDB | $2.00 * 1,000,000 read and writes = $2.00 (Findings Table) 15MB * 100 accounts * 1 region = 1,500MB (History Table) 10MB * 100 accounts * 1 region = 1,000MB $0.25 per GB-month * 2.5 GB = $0.625 | $2.625 @@ -125 +182 @@ Amazon SNS | $0.50 * 1,000,000 notifications = $0.50 | $0.50 -Amazon CloudWatch - Metrics | $0.30 * 7 custom metrics = $2.10 $0.01 * (3000 * 3 / 1,000) put metrics API calls = $0.09 | $2.19 +Amazon CloudWatch - Metrics | (Enhanced Metrics Disabled) $0.30 * 7 custom metrics = $2.10 $0.01 * (3000 / 1,000) put metrics API calls = $0.03 | $2.13 @@ -127,2 +184,3 @@ Amazon CloudWatch - Dashboards | $3.00 * 1 dashboard = $3.00 | $3.00 -Amazon CloudWatch - Alarms | $0.10 * 3 alarms = $0.30 | $0.30 -**Total** | | **$134.86** +Amazon CloudWatch - Alarms | $0.10 * 4 alarms = $0.40 | $0.40 +Amazon CloudWatch - X-Ray Traces | 3,000 remediations * 7 requests = 2,100 Lambda invocations 50,000 findings * 1 request = 50,000 Lambda invocations $0.000005 per trace * 52,100 traces = $0.2605 | $0.2605 +**Total** | | **$136.57** @@ -130 +188 @@ Amazon CloudWatch - Alarms | $0.10 * 3 alarms = $0.30 | $0.30 -### Example 3: 30,000 remediations per months +### Example 4: 30,000 remediations per month @@ -136 +194,43 @@ Amazon CloudWatch - Alarms | $0.10 * 3 alarms = $0.30 | $0.30 - * Total cost $10,271.70 per month + * 500 Security Hub findings processed per account/Region/month + + * **Web UI disabled** + + * **Action Log disabled** + + * Total cost $10,460.80 per month + + + + +Service | Assumptions | Monthly charges [USD] +---|---|--- +AWS Systems Manager Automation | Steps: ~4 steps * 30,000 remediations * $0.002 = $240.00 Duration: 10s * 30,000 remediations * $0.00003 = $9.00 | $249.00 +AWS Security Hub | No billable services utilized | $0 +Amazon CloudWatch Logs | $0.50 per GB | < $0.01 +AWS Lambda - Requests | 30,000 remediations * 7 requests = 210,000 requests 5,000,000 findings * 1 request = 5,000,000 requests $0.20 / 1,000,000 requests = $0.0000002 per request | $1.042 +AWS Lambda - Duration | (512MB Memory) 4,000ms * 30,000 remediations * $0.0000000083 = $0.996 449ms * 5,000,000 findings * $0.0000000083 = $18.63 | $19.63 +AWS Step Functions | 19 state transitions * 30,000 remediations = 570,000 $0.025 * (570,000/1,000) state transitions = $14.25 | $14.25 +Amazon EventBridge rules | No charge for rules | $0 +AWS Key Management Service | (1 key) $1 * 1,000 accounts * 10 Region = $10,000 (Encrypt/Decrypt API requests) (30,000 remediations * 2 requests) + (5,000,000 findings * 4 requests) = 20,060,000 requests $0.03 per 10,000 requests ⇒ $0.03 * (20,060,000 / 10,000) = $60.18 | $10,060.18 +Amazon DynamoDB | $2.00 * (10,000,000 read and writes / 1,000,000) = $20.00 (Findings Table) 15MB * 1000 accounts * 10 region = 150GB (History Table) 10MB * 1000 accounts * 10 region = 100GB $0.25 per GB-month * 250 GB = $62.50 | $82.50 +Amazon SQS | $0.40 * (5,060,000 requests / 1,000,000 ) = $2.024 | $2.024 +Amazon SNS | $0.000005 * 1,000,000 notifications = $0.50 | $0.50 +Amazon CloudWatch - Metrics | (Enhanced Metrics Disabled) $0.30 * 7 custom metrics = $2.10 $0.01 * (30,000 / 1,000) put metrics API calls = $0.30 | $2.40 +Amazon CloudWatch - Dashboards | $3.00 * 1 dashboard = $3.00 | $3.00 +Amazon CloudWatch - Alarms | (Enhanced Metrics Disabled) $0.10 * 4 alarms = $0.40 | $0.40 +Amazon CloudWatch - X-Ray Traces | 30,000 remediations * 7 requests = 210,000 Lambda invocations 5,000,000 findings * 1 request = 5,000,000 Lambda invocations $0.000005 per trace * 5,210,000 traces = $26.05 | $26.05 +**Total** | | **$10,460.80** + +### Example 5: 30,000 remediations per month (Web UI Enabled) + + * 1,000 accounts, 10 Regions + + * 30 remediations per account/Region/month + + * 500 Security Hub findings processed per account/Region/month + + * **Web UI enabled** + + * **Action Log disabled** + + * Total cost $10,480.90 per month @@ -145,4 +245,4 @@ AWS Security Hub | No billable services utilized | $0 -Amazon CloudWatch Logs | 30,000 remediations * $0.000002 = $0.06 $0.06 * 0.03 = $0.0018 | < $0.01 -AWS Lambda - Requests | 30,000 remediations * 6 requests = 180,000 requests $0.20 * 1,000,000 requests = $0.20 | $0.20 -AWS Lambda - Duration | 256M: 1.875 GB sec * 30,000 remediations * $0.000167 = $0.9375 | $0.94 -AWS Step Functions | 17 state transitions * 30,000 remediations = 510,000 $0.025 * (510,000/1,000) state transitions = $12.75 | $12.75 +Amazon CloudWatch Logs | $0.50 per GB | < $0.01 +AWS Lambda - Requests | 30,000 remediations * 7 requests = 210,000 requests 5,000,000 findings * 1 request = 5,000,000 requests $0.20 / 1,000,000 requests = $0.0000002 per request | $1.042 +AWS Lambda - Duration | (512MB Memory) 4,000ms * 30,000 remediations * $0.0000000083 = $0.996 449ms * 5,000,000 findings * $0.0000000083 = $18.63 | $19.63