Cloud cost, FinOps, and multi-cloud governance writing from Cloud Horizons.https://cloud-horizons.com/en-ushttps://cloud-horizons.com/blog/amazon-api-gateway-pricing-explained/https://cloud-horizons.com/blog/amazon-api-gateway-pricing-explained/Amazon API Gateway has three API types and they price differently: REST per million requests tiered, HTTP at a lower first-tier rate, WebSocket per million messages plus connection-minutes. Plus data transfer, caching, and logging. The rates, the structure, and the REST vs HTTP trade-offs.Thu, 16 Jul 2026 12:00:00 GMThttps://cloud-horizons.com/blog/amazon-cloudfront-pricing-explained/https://cloud-horizons.com/blog/amazon-cloudfront-pricing-explained/CloudFront pricing has six components: data transfer out by price class, HTTP and HTTPS requests, origin fetches, invalidations past the free allowance, real-time logs, and edge compute. Plus the 1 TB always-free tier. The structure, the rates as published, and why fronting S3 with CloudFront reduces total cost.Thu, 16 Jul 2026 12:00:00 GMThttps://cloud-horizons.com/blog/azure-marketplace-onboarding-for-finops/https://cloud-horizons.com/blog/azure-marketplace-onboarding-for-finops/Buying through Azure Marketplace is a procurement shortcut, but offer types, the SaaS activation flow, where charges land, MACC eligibility, and the SaaS tagging gap all change what shows up on the bill.Thu, 16 Jul 2026 12:00:00 GMThttps://cloud-horizons.com/blog/estimating-rds-costs-before-you-deploy/https://cloud-horizons.com/blog/estimating-rds-costs-before-you-deploy/RDS estimates go wrong because of six line items: instance hours, storage, IOPS, backup storage, Multi-AZ doubling, and data transfer. The estimation method for each, the multipliers that bite, and where the calculators live.Thu, 16 Jul 2026 12:00:00 GMThttps://cloud-horizons.com/blog/azure-vm-reserved-instance-when-it-pays/https://cloud-horizons.com/blog/azure-vm-reserved-instance-when-it-pays/Azure Reserved VM Instances cut pay-as-you-go rates by up to 72 percent on a three-year term, but only on stable, always-on compute. Dev clusters, bursty analytics, and right-sized-down production VMs are where RIs lose money. The utilization threshold, the AHB stack, and the audit query.Fri, 12 Jun 2026 12:00:00 GMThttps://cloud-horizons.com/blog/ebs-snapshot-storage-the-hidden-multiplier/https://cloud-horizons.com/blog/ebs-snapshot-storage-the-hidden-multiplier/EBS snapshots look incremental until you count the chains, the orphaned AMIs, and the DLM policy nobody reviewed. At $0.05 per GB-month the line stays quiet for years, then a retention change doubles it overnight. The audit query, the math, and the lifecycle fix.Fri, 12 Jun 2026 12:00:00 GMThttps://cloud-horizons.com/blog/gcp-sustained-use-vs-committed-discount/https://cloud-horizons.com/blog/gcp-sustained-use-vs-committed-discount/Sustained use discounts apply automatically and cap around 30 percent on compute that runs all month. Committed use discounts require a one- or three-year spend pledge and push toward 57 percent on vCPUs. The wrong choice leaves money on the table or locks you into capacity you no longer run. The utilization math and the audit path.Fri, 12 Jun 2026 12:00:00 GMThttps://cloud-horizons.com/blog/idle-elastic-ip-the-monthly-tax/https://cloud-horizons.com/blog/idle-elastic-ip-the-monthly-tax/An Elastic IP attached to a running instance is free. One sitting unassociated or on a stopped instance costs $0.005 per hour, about $3.65 per month, forever. After a migration or teardown the addresses linger. The audit query, the math, and the release checklist.Fri, 12 Jun 2026 12:00:00 GMThttps://cloud-horizons.com/blog/mcp-aws-connector-cloud-horizon/https://cloud-horizons.com/blog/mcp-aws-connector-cloud-horizon/AWS has no native MCP endpoint, so we built one. Cloud Horizons's AWS MCP server lets Claude ask about EC2 inventory, S3 buckets, CloudWatch logs, and Cost Explorer data in plain English. No agents, no Terraform, no VPC access. Here is how it works and what we learned.Tue, 12 May 2026 12:00:00 GMThttps://cloud-horizons.com/blog/mcp-gcp-connector-cloud-horizon/https://cloud-horizons.com/blog/mcp-gcp-connector-cloud-horizon/The Model Context Protocol is an open standard for connecting AI assistants to live systems. We built a GCP MCP server that reads Compute Engine, Cloud SQL, and Cost data with nothing but a service account key. The architecture, the security model, and why it matters for multi-cloud operations.Tue, 12 May 2026 12:00:00 GMThttps://cloud-horizons.com/blog/mcp-m365-connector-cloud-horizon/https://cloud-horizons.com/blog/mcp-m365-connector-cloud-horizon/Microsoft does not ship an MCP server for M365 or Entra ID. We built a bridge that turns Microsoft Graph API calls into MCP tools, so Claude can reason about user licenses, sign-in logs, and conditional access policies in real time. Why this is harder than it looks, and what is coming next.Tue, 12 May 2026 12:00:00 GMThttps://cloud-horizons.com/blog/nat-gateway-the-aws-bill-that-hides-in-private-subnets/https://cloud-horizons.com/blog/nat-gateway-the-aws-bill-that-hides-in-private-subnets/NAT Gateway looks like plumbing until the private-subnet traffic grows. The hourly fee is predictable, the per-GB processing fee is not, and the expensive traffic is usually S3, ECR, package mirrors, or cross-AZ chatter that should not be there. The audit path, the math, and the fixes that cut the line without breaking production.Sun, 10 May 2026 12:00:00 GMThttps://cloud-horizons.com/blog/alb-the-line-item-nobody-watches/https://cloud-horizons.com/blog/alb-the-line-item-nobody-watches/AWS Application Load Balancer has a quiet hourly base and a loud LCU column. The LCU is the maximum of four dimensions, so tuning the wrong one saves nothing. Here is how to read the bill, audit your inventory, and cut 30 percent without breaking traffic.Fri, 08 May 2026 12:00:00 GMThttps://cloud-horizons.com/blog/api-gateway-rest-vs-http-the-71-percent-discount/https://cloud-horizons.com/blog/api-gateway-rest-vs-http-the-71-percent-discount/AWS HTTP API has been a 71 percent discount on REST API since 2020. Most teams who started before that are still on REST. The migration is one Terraform resource for new APIs and a measured cutover for existing ones. The math, the trade-offs, and the audit query.Fri, 08 May 2026 12:00:00 GMThttps://cloud-horizons.com/blog/azure-hybrid-benefit-the-discount-most-teams-still-miss/https://cloud-horizons.com/blog/azure-hybrid-benefit-the-discount-most-teams-still-miss/AHB takes 40 percent off Windows VM rates and up to 55 percent off SQL Server. It stacks with Reserved Instances. The license entitlement was already paid in your EA. The audit, the math, and the reasons teams leave it on the table.Fri, 08 May 2026 12:00:00 GMThttps://cloud-horizons.com/blog/azure-sql-dtu-vs-vcore-when-each-is-the-wrong-choice/https://cloud-horizons.com/blog/azure-sql-dtu-vs-vcore-when-each-is-the-wrong-choice/DTU bundles compute, memory, and IO into one number and blocks both Hybrid Benefit and Reserved Capacity. vCore unbundles them and stacks both discounts. The migration mapping, the AHB stack math, the Hyperscale break-even, and the audit query.Fri, 08 May 2026 12:00:00 GMThttps://cloud-horizons.com/blog/cloudfront-the-cdn-line-item-that-pays-for-itself/https://cloud-horizons.com/blog/cloudfront-the-cdn-line-item-that-pays-for-itself/Raw S3 egress is $0.09/GB. CloudFront in front of S3 is $0.085/GB in North America and Europe and the inter-service hop is free. For most workloads the CDN line is cheaper than going direct, before you count the latency win. The math, the price-class trick, and the audit query.Fri, 08 May 2026 12:00:00 GMThttps://cloud-horizons.com/blog/cloudwatch-logs-the-bill-that-grows-quietly/https://cloud-horizons.com/blog/cloudwatch-logs-the-bill-that-grows-quietly/New log groups default to indefinite retention. VPC Flow Logs default to full mode. Together they explain four-figure monthly CloudWatch Logs bills on accounts that never thought of logs as a line item. The pattern, the audit query, and the three-step fix.Fri, 08 May 2026 12:00:00 GMThttps://cloud-horizons.com/blog/cold-storage-aws-azure-gcp-compared/https://cloud-horizons.com/blog/cold-storage-aws-azure-gcp-compared/All three clouds advertise sub-cent-per-GB archival storage. The actual bill depends on retrieval frequency, minimum-duration billing, and how often you accidentally rehydrate. Side-by-side math on real workload shapes.Fri, 08 May 2026 12:00:00 GMThttps://cloud-horizons.com/blog/cosmos-db-the-rus-vs-storage-tradeoff/https://cloud-horizons.com/blog/cosmos-db-the-rus-vs-storage-tradeoff/Manual provisioned, Autoscale, and Serverless are not interchangeable. The wrong model on a Cosmos workload costs two to four times the right one. The autoscale tipping point, the serverless ceiling, the multi-region multiplier, and the indexing audit that cuts RUs in half before any pricing change.Fri, 08 May 2026 12:00:00 GMThttps://cloud-horizons.com/blog/cross-az-data-transfer-the-quiet-tax/https://cloud-horizons.com/blog/cross-az-data-transfer-the-quiet-tax/Cross-AZ data transfer charges $0.01 per GB in each direction. That sounds like nothing until you see what a chatty microservice mesh, a multi-AZ RDS, and a misplaced NAT Gateway can do to it. The patterns we see, and the architectural fixes that pay back in weeks.Fri, 08 May 2026 12:00:00 GMThttps://cloud-horizons.com/blog/dynamodb-the-on-demand-vs-provisioned-tipping-point/https://cloud-horizons.com/blog/dynamodb-the-on-demand-vs-provisioned-tipping-point/On-demand DynamoDB is roughly 7x the per-request cost of fully-utilized provisioned. The tipping point is 14 to 18 percent sustained utilization. Below, on-demand wins. Above, switch and turn on autoscaling. The math, the GSI multiplier, the audit query.Fri, 08 May 2026 12:00:00 GMThttps://cloud-horizons.com/blog/ebs-gp2-to-gp3-the-easiest-aws-savings/https://cloud-horizons.com/blog/ebs-gp2-to-gp3-the-easiest-aws-savings/gp3 launched in December 2020. It is 20 percent cheaper per GB than gp2 and includes 3,000 IOPS and 125 MB/s for free. Most accounts still run gp2. The math, the migration command, and why it is the safest production change AWS offers.Fri, 08 May 2026 12:00:00 GMThttps://cloud-horizons.com/blog/lambda-cost-the-three-knobs-that-matter/https://cloud-horizons.com/blog/lambda-cost-the-three-knobs-that-matter/Lambda pricing has two components and three knobs that move the bill. Memory, architecture, duration. Provisioned Concurrency is the fourth knob most teams should not touch. The math, the audit query, and the change you can ship before lunch.Fri, 08 May 2026 12:00:00 GMThttps://cloud-horizons.com/blog/multi-cloud-egress-when-leaving-aws-pays/https://cloud-horizons.com/blog/multi-cloud-egress-when-leaving-aws-pays/Cloudflare R2 has $0 egress. AWS charges around $0.05 per GB at scale. The math is obvious until you price the migration. Three workload shapes where the move pays back in months, and three where it never does.Fri, 08 May 2026 12:00:00 GMThttps://cloud-horizons.com/blog/rds-the-quiet-doubler-on-the-aws-bill/https://cloud-horizons.com/blog/rds-the-quiet-doubler-on-the-aws-bill/Multi-AZ doubles instance and storage hours. A read replica adds another 100 percent. Backup retention past 100 percent of storage is paid. None look big in isolation. Together they explain the four-figure RDS line that started at $400. The audit, the math, the fixes.Fri, 08 May 2026 12:00:00 GMThttps://cloud-horizons.com/blog/s3-intelligent-tiering-vs-standard-ia/https://cloud-horizons.com/blog/s3-intelligent-tiering-vs-standard-ia/Both classes look like a free lunch at first glance. The math says otherwise on small objects, short-lived data, and predictable access patterns. The decision tree we run on every audit, with the dollar thresholds where each class breaks even.Fri, 08 May 2026 12:00:00 GMThttps://cloud-horizons.com/blog/the-s3-gateway-endpoint-nobody-enabled/https://cloud-horizons.com/blog/the-s3-gateway-endpoint-nobody-enabled/A Gateway Endpoint for S3 is free. It costs zero hourly, zero per GB, and routes private-subnet S3 traffic around NAT entirely. It is also the single most-missed line in the AWS audit playbook. The pattern, the math on a real account we audited, and the one Terraform resource that fixes it.Fri, 08 May 2026 12:00:00 GMThttps://cloud-horizons.com/blog/transit-gateway-the-tax-on-multi-vpc/https://cloud-horizons.com/blog/transit-gateway-the-tax-on-multi-vpc/Transit Gateway looks cheap on the spec sheet. $0.05 per attachment per hour, $0.02 per GB processed. Then a 12-VPC hub-and-spoke quietly costs $1,300 a month, and the cross-AZ surcharge is hidden on a different bill line entirely. The patterns that drive the cost and the four moves that bring it down.Fri, 08 May 2026 12:00:00 GMThttps://cloud-horizons.com/blog/aws-reserved-instance-vs-savings-plan/https://cloud-horizons.com/blog/aws-reserved-instance-vs-savings-plan/Most teams pick one over the other and stop thinking about it. The right answer is usually both. Here is how to decide, with the math and the workload patterns that actually show up in production.Thu, 07 May 2026 12:00:00 GMThttps://cloud-horizons.com/blog/multi-cloud-cost-attribution-without-agents/https://cloud-horizons.com/blog/multi-cloud-cost-attribution-without-agents/Tag-based plus account-based attribution across AWS and Azure, using the cost data both clouds already give you. No agents, no Terraform, no extra runtime.Wed, 29 Apr 2026 12:00:00 GMThttps://cloud-horizons.com/blog/aws-bill-anomaly-detection-2026/https://cloud-horizons.com/blog/aws-bill-anomaly-detection-2026/Real examples: a lapsed RDS Reserved Instance, a misconfigured Lambda hammering S3, a NAT Gateway data transfer surprise. What the patterns look like and how to catch them next time.Wed, 22 Apr 2026 12:00:00 GMThttps://cloud-horizons.com/blog/egress-lock-in-discovered-at-migration/https://cloud-horizons.com/blog/egress-lock-in-discovered-at-migration/A director plans a multi-cloud or repatriation move to cut cost, then learns the one-time data-egress charge to move petabytes out dwarfs a year of the savings. The exit cost was never modeled, and the lock-in was financial all along.Tue, 03 Mar 2026 12:00:00 GMThttps://cloud-horizons.com/blog/forecast-built-on-last-month-times-twelve/https://cloud-horizons.com/blog/forecast-built-on-last-month-times-twelve/Finance builds the annual cloud budget by extrapolating a single month, ignoring seasonality, committed-discount amortization, and the growth curve of new workloads. The forecast holds until a launch or a seasonal peak blows through it, and the variance lands on the director who signed off.Fri, 13 Feb 2026 12:00:00 GMThttps://cloud-horizons.com/blog/shadow-cloud-account-outside-finops/https://cloud-horizons.com/blog/shadow-cloud-account-outside-finops/A product team spins up its own cloud account outside the central organization to move fast, and its spend never appears in the consolidated bill, the commitment pool, or any showback report. The director discovers the shadow account only when its spend grows large enough to notice it's missing.Thu, 22 Jan 2026 12:00:00 GMThttps://cloud-horizons.com/blog/focus-spec-multi-cloud-comparison-blind/https://cloud-horizons.com/blog/focus-spec-multi-cloud-comparison-blind/The director is asked which cloud is cheapest for a workload, but AWS, Azure, and GCP each export cost data in incompatible schemas with different cost types and amortization rules. Without the FOCUS standard normalizing them, every cross-cloud comparison is a spreadsheet argument nobody can win.Thu, 01 Jan 2026 12:00:00 GMThttps://cloud-horizons.com/blog/rds-multi-az-doubled-for-nonprod/https://cloud-horizons.com/blog/rds-multi-az-doubled-for-nonprod/A default to Multi-AZ for safety means dev, staging, and ephemeral databases all run the doubled-cost high-availability configuration. The resilience policy was right for production and quietly doubles the bill everywhere it shouldn't apply.Wed, 10 Dec 2025 12:00:00 GMThttps://cloud-horizons.com/blog/board-asks-why-cloud-cost-jumped-no-answer/https://cloud-horizons.com/blog/board-asks-why-cloud-cost-jumped-no-answer/Two-thirds of CFOs now treat cloud spend as a board-level issue, and the quarter it jumps the CTO is expected to explain the driver, the owner, and the plan. Without line-item attribution and a forecast, 'we're looking into it' becomes a credibility event, not a status update.Wed, 19 Nov 2025 12:00:00 GMThttps://cloud-horizons.com/blog/cloudwatch-logs-ingestion-debug-flag/https://cloud-horizons.com/blog/cloudwatch-logs-ingestion-debug-flag/A debug log level shipped to production during an incident and never got reverted, multiplying CloudWatch Logs ingestion and retention across the fleet. The observability bill quietly overtakes the compute it was meant to observe, and no alert fires because logs aren't an outage.Tue, 28 Oct 2025 12:00:00 GMThttps://cloud-horizons.com/blog/cosmos-ru-provisioning-silent-burn/https://cloud-horizons.com/blog/cosmos-ru-provisioning-silent-burn/To clear a latency complaint, an engineer doubles provisioned Cosmos DB throughput across containers and never dials it back. The change ships invisibly, the RU/s burn becomes the new baseline, and the director only learns the number when it's a renewal line.Tue, 07 Oct 2025 12:00:00 GMThttps://cloud-horizons.com/blog/gcp-committed-use-discount-overcommit/https://cloud-horizons.com/blog/gcp-committed-use-discount-overcommit/A finance partner signs a three-year GCP committed-use discount to maximize the rate, then the team migrates half the workload to GKE Autopilot and a different machine family. The CUD now covers capacity the architecture moved past, and the commitment outlives the design it priced.Mon, 15 Sep 2025 12:00:00 GMThttps://cloud-horizons.com/blog/cross-az-transfer-microservices-tax/https://cloud-horizons.com/blog/cross-az-transfer-microservices-tax/A director champions a move to multi-AZ microservices for resilience, and every inter-service call now crosses an availability-zone boundary at a per-gigabyte rate. The resilience is real; so is the cross-AZ transfer line that scales with every chatty service you add.Wed, 27 Aug 2025 12:00:00 GMThttps://cloud-horizons.com/blog/offboarded-engineer-took-the-cost-context/https://cloud-horizons.com/blog/offboarded-engineer-took-the-cost-context/The one person who knew why the GCP committed-use discounts were sized that way, which accounts mapped to which products, and what the untagged spend really was, gives notice. The cost knowledge walks out the door with no runbook, and the next renewal decision is a guess.Tue, 05 Aug 2025 12:00:00 GMThttps://cloud-horizons.com/blog/ebs-snapshot-graveyard-orphaned-volumes/https://cloud-horizons.com/blog/ebs-snapshot-graveyard-orphaned-volumes/Automated snapshot policies were set once and never pruned, so orphaned snapshots from deleted volumes and terminated instances accumulate for years. The line item is individually trivial and collectively a steady, owner-less drain that no single team will claim.Thu, 17 Jul 2025 12:00:00 GMThttps://cloud-horizons.com/blog/azure-hybrid-benefit-license-audit-trap/https://cloud-horizons.com/blog/azure-hybrid-benefit-license-audit-trap/A finance partner books the Azure Hybrid Benefit discount across the estate to hit a savings number, but the Software Assurance entitlements and core counts were never reconciled. When Microsoft's licensing audit lands, the unprovable claims convert into back-billing plus the discount clawed back.Wed, 25 Jun 2025 12:00:00 GMThttps://cloud-horizons.com/blog/savings-plan-expiry-nobody-renewed/https://cloud-horizons.com/blog/savings-plan-expiry-nobody-renewed/A one-year Compute Savings Plan expires with no owner watching the calendar, and the entire baseline reverts to On-Demand pricing overnight. The 40 percent rate increase is invisible until the next bill, because nothing broke and nothing alerted.Wed, 04 Jun 2025 12:00:00 GMThttps://cloud-horizons.com/blog/due-diligence-cloud-bill-killed-the-deal/https://cloud-horizons.com/blog/due-diligence-cloud-bill-killed-the-deal/During acquisition diligence, the buyer's technical team pulls the cloud cost trend and finds 25 percent waste, no commitment strategy, and unit economics that contradict the pitch. The valuation haircut comes not from the spend itself but from the absence of any FinOps discipline behind it.Wed, 14 May 2025 12:00:00 GMThttps://cloud-horizons.com/blog/nat-gateway-egress-surprise-private-subnet/https://cloud-horizons.com/blog/nat-gateway-egress-surprise-private-subnet/A director mandates moving workloads into private subnets for security, and the architecture quietly routes every package update and S3 pull through NAT Gateways billed per gigabyte. The security win lands the same month as an egress bill nobody modeled.Tue, 22 Apr 2025 12:00:00 GMThttps://cloud-horizons.com/blog/thirty-percent-untagged-no-showback/https://cloud-horizons.com/blog/thirty-percent-untagged-no-showback/When the CFO asks which product line drove the cloud increase, the FinOps lead discovers 30 to 50 percent of resources are untagged and the unallocated bucket has become a dumping ground. There is no defensible showback answer, so every team plausibly blames every other team.Thu, 03 Apr 2025 12:00:00 GMThttps://cloud-horizons.com/blog/anomaly-caught-after-the-quarter-closed/https://cloud-horizons.com/blog/anomaly-caught-after-the-quarter-closed/A misconfigured cron loops cross-region replication for six weeks, but the spike only surfaces when finance reconciles the closed quarter. The director who owned cost visibility learns about a six-figure overrun from the same email that goes to the CFO.Mon, 17 Mar 2025 12:00:00 GMThttps://cloud-horizons.com/blog/reserved-instances-for-workloads-you-rightsized-away/https://cloud-horizons.com/blog/reserved-instances-for-workloads-you-rightsized-away/A platform lead locks in a three-year RI commitment to hit a savings target, then the SRE team right-sizes and re-platforms the exact instance families the reservations were bought for. Now you're paying upfront for capacity nobody runs, and the savings plan you should have used is off the table.Sun, 23 Feb 2025 12:00:00 GMThttps://cloud-horizons.com/blog/finops-hire-eighteen-months-too-late/https://cloud-horizons.com/blog/finops-hire-eighteen-months-too-late/By the time cloud spend is painful enough to justify a dedicated FinOps lead, the commitment mistakes, untagged sprawl, and missed discounts have already compounded into a seven-figure annual leak. The role is reactive when it should have been the cheapest insurance you ever bought.Tue, 04 Feb 2025 12:00:00 GMT