The August 2026 AWS bill for redir.rocks was $26.28. In September it ran at about $1.50 a day. Before the edge moved behind a load balancer in October, the whole estate ran at about $38 to $45 a month. The load balancer adds an hourly charge on top of that, and I explain below why I chose to pay it.
redir.rocks is a redirect service I run with my co-founder. He writes the application. I built and run the infrastructure, the edge, observability and operations. It is a small, bootstrapped product, so every fixed monthly cost has to earn its place. But it is also production: customers point their domains at it, and if the edge is down, their links are down.
These are the choices that keep the bill there.
The estate is an AWS Organization. The management account runs nothing. Each product gets its own account.
This costs nothing extra and saves a lot later. Billing is clean by default: no cost allocation tags to keep right, no shared lines to split. Permissions are simpler, because a role in one product's account cannot touch another's. And if a product is sold, shut down or handed to a client, the account goes with it.
Keeping the management account empty matters because it cannot be restricted by service control policies. Whatever runs there runs with the fewest guard rails.
A NAT gateway costs about $32 a month before it moves a single byte. For a product whose whole estate is about $40, that one resource would almost double the bill.
So the shared network module in Terragrunt does not have a NAT gateway option at all. It is not a default that someone can flip. If a future service needs one, adding it means changing the module, which means a review and a conversation about the cost.
This is a design choice with a trade-off. Without NAT, anything that needs outbound internet access has to get it another way, and that has to be planned per service. I think that is the right trade at this size. At a larger size, with private services that call many external APIs, I would make a different call.
Code lives on a self-hosted Gitea, and CI runs on spot instances that scale to zero when no pipeline is running. Most of the day nothing runs, so most of the day CI costs nothing.
Spot instances can be taken back by AWS. For CI that is fine: a pipeline that is interrupted runs again. I would not put the edge on spot. I would put almost all CI there.
At first the CI role had administrator access. That is common and it is a bad habit, because the CI system then holds the keys to everything.
Instead of guessing which permissions it needed, I let CloudTrail tell me. Over 212 CI runs, CloudTrail recorded 51 distinct actions. The role now allows those 51 and nothing else.
This approach has a catch: it only covers what the runs did during that window. A new kind of change (a new resource type, say) will fail with an access denied error the first time. I am fine with that. A clear failure that asks for a permission is better than a role that can do anything.
Human access to AWS goes through IAM Identity Center with Google as the identity provider.
One setting cost me time: Identity Center shows two ACS URLs, a default IPv4 one and a dual-stack one. Google has to be given the default IPv4 URL. With the dual-stack one, sign-in fails with "Responses must contain exactly one Assertion", which does not point at the URL at all. AWS documents this, but it is easy to miss.
The whole estate is described in 15 Terragrunt modules. That covers everything the product runs on, and it is few enough that I can hold all of it in my head.
Cheap is not the only goal. In October 2026 I put the edge behind a Network Load Balancer. An NLB charges every hour, which is exactly the kind of fixed cost this post is about avoiding.
I did it because the edge is the product. Before the NLB, a host-level rule pointed traffic at the right port after each deploy, re-checked every 20 seconds. The NLB replaces that with health checks. Paying a fixed amount for that is a better deal than saving it and keeping a rule I have to remember.
The same logic runs the other way. The proof of concept in March 2026 was one small ARM instance at about $24 a month. It proved the idea, but it was not built for real customers.
If you are setting up AWS for a small product and want it lean from the start, Nuno can help.
