Lesson 7 of 7 · 9 min
Cost, observability and the Well-Architected pillars
Find where the money actually goes, monitor what matters, and apply the six design pillars.
Where the money goes
Compute is the obvious line and rarely the surprising one. The surprises are data transfer out to the internet, cross-AZ traffic billed in both directions, NAT gateway per-gigabyte processing, and storage nobody deleted — unattached EBS volumes, old snapshots, noncurrent S3 versions.
The 'EC2-Other' line on a bill bundles most of these, which is why it is usually the first thing worth breaking down.
The levers, roughly in order of impact
- Commit to a discount for steady baseline load — Savings Plans cover EC2, Fargate and Lambda.
- Use Spot for anything interruption-tolerant, diversified across instance types.
- Add VPC endpoints so AWS-bound traffic bypasses the NAT gateway.
- Put CloudFront in front of high-volume egress; its per-gigabyte rate is lower than S3's.
- Apply S3 lifecycle rules, including expiry for noncurrent versions.
- Turn off what is idle — stop non-production databases and instances on a schedule.
- Right-size from observed utilisation using Compute Optimizer.
The observability services, and what each answers
| Service | Answers |
|---|---|
| CloudWatch | How is it behaving? Metrics, logs, alarms, dashboards |
| CloudTrail | Who did that, when, and from where? |
| AWS Config | What did this resource look like before and after? |
| VPC Flow Logs | What traffic was accepted or rejected? (metadata only) |
| X-Ray | Where did the latency go across services? |
The six pillars
Operational excellence, security, reliability, performance efficiency, cost optimisation and sustainability. They exist to make trade-offs explicit rather than accidental.
The useful habit is noticing when two pillars conflict. Multi-Region active-active improves reliability and worsens cost. Encrypting an attribute improves security and removes your ability to query on it. Stating which pillar you are optimising, and what you are giving up, is exactly what a good architecture answer sounds like.
Worth remembering
- Data transfer, NAT processing and forgotten volumes dominate more bills than compute does.
- CloudTrail is who did what; CloudWatch is how it is behaving; Config is what it looks like.
- The pillars are a checklist for arguing about trade-offs, not a scoring system.
Test it now
Cost reasoning and trade-off questions concentrate in the hard bank.