Perfware Cost Estimator

← Back to perfware.cloud

Estimate your AWS infrastructure cost

Perfware runs entirely in your AWS account, so you pay AWS directly for the infrastructure it uses — there's no per-gigabyte software markup. This tool estimates that AWS cost for the products and tiers you choose. The Perfware software fee is a separate flat monthly subscription, shown below. Adjust the inputs to match your environment.

This is an estimate, not a quote. It approximates your AWS infrastructure cost from list pricing and the volumes you enter. Your actual AWS bill — billed directly to you by AWS — depends on real usage, retention, region, and account count.

Start with a size — or skip straight to the detailed inputs below

Not sure of your exact volumes? Pick the profile closest to your environment — it fills in the inputs below, which you can then fine-tune. Choosing Custom leaves everything as you set it.

Log Processor (required — owns the shared backbone)

Log Processor creates the shared VPC and OpenSearch domain that AI Monitor and AI SIEM run on. Its tier sets the fixed backbone cost.

Each log stream can route to OpenSearch (searchable), the S3 datalake (Athena SQL), or both — set per subscription.
Not sure of volume? A busy app is ~5–20 GB/day. Check CloudWatch Logs → the IncomingBytes metric for a real figure.
Heavy-log cost tip
Route high-volume or archival logs Athena-only to skip OpenSearch indexing entirely — you still get full SQL query on every event from cheap S3, without growing the OpenSearch domain. This is the biggest cost lever for large log estates.

Bonus: because logs are forwarded to the central store on arrival, you can also cut CloudWatch source retention to a few days — trimming a storage line on a bill you already pay AWS.

Right-size OpenSearch
Sizing is a lever you control. Data node count, per-node storage, and retention (OpenSearch and datalake) are CloudFormation stack parameters — set them at launch, or change them any time with a stack update. Right-size to your real needs: route heavy logs to Athena, trim retention, and drop nodes/storage to cut cost. (Dedicated master nodes and the instance type are set by the tier — move tiers to change those.) Routing heavy logs to Athena and shortening OpenSearch retention lets you run fewer, smaller nodes — logs are the heavy OpenSearch load. AI Monitor and AI SIEM use the domain only lightly (baselines, threats, and correlation records; their bulk data lives in S3/Athena), so they add little — just leave a little headroom, and note the domain backs dashboards/correlation, so it can't go to zero.

AI Monitor

Metric anomaly detection via CloudWatch Metric Streams. Runs on the shared backbone — no extra cluster.

Why this is a range — and how to control it
AI Monitor filters by namespace: subscribing to one metric in a namespace streams every metric in it, and the count depends on your own AWS footprint (how many Lambdas, instances, databases, queues exist). So cost is a range, not a fixed figure.

Control it three ways:
• Subscribe deliberately — pick the namespaces that matter, not everything.
• Drop chatty, low-value metrics — subscriptions toggle off without deleting them.
• Use 5-minute resolution where 1-minute isn't needed — it cuts update volume.

Most operators prune to the low end of the range. Look up your real metric count in CloudWatch → Metrics for a precise figure.

AI SIEM

Correlates AWS security signals into threat timelines. Cheap always-on baseline; deep AI analysis is pay-when-it-matters.

How flow-log cost stays flat
AI SIEM captures logs cheaply to S3 and runs scheduled Athena sweeps, so detection cost tracks query cadence — not traffic. AI playbooks/reports use Bedrock on demand.

VPC Flow Logs are the usual SIEM cost bomb — AI SIEM's flat-cost guardrail keeps full ALL-traffic capture cheap: analysis is a fixed set of partition-pruned sweeps, so a traffic spike can't cause a surprise bill.
Estimated AWS infrastructure
$0
$0 / day
🛡️
Your security perimeter, priced in. The $0/mo of VPC interface endpoints keeps 100% of traffic on the AWS private backbone — nothing leaves your account, and calls to AWS services (S3, OpenSearch, Bedrock, Athena…) never traverse the public internet. That's zero exfiltration by design — no data to a vendor, no service traffic over the internet — and it replaces the per-GB data-transfer and SaaS ingestion fees a hosted SIEM would charge.
Perfware software subscription $0
Flat monthly fee per tier, billed via AWS Marketplace — separate from the AWS cost above.
Estimated all-in / month$0
Running all three products? Special suite pricing can be negotiated for larger or multi-account deployments — annual terms via an AWS Marketplace Private Offer. Contact us to discuss.

Enterprise tiers include a guided onboarding call and quarterly reviews.

Need more? Professional services are available for custom integrations and data-source onboarding, and to help optimize your deployment and AWS cost. Get in touch.

Estimates only — your actual AWS bill depends on real log/metric volume, retention, number of accounts, and AWS pricing in your region. AWS bills you directly at cost; Perfware has no control over your AWS charges. GuardDuty, Security Hub, CloudTrail, and VPC Flow Logs incur their own AWS charges independent of Perfware. Figures use US East (N. Virginia) list pricing.