# 2475 03 Des Cost Estimate Ce8c94fb > Azure Cost Estimate: aks-platform - Skill: `tools-only/2475-03-des-cost-estimate-ce8c94fb` (Agent Skill, multi-file: 3 files) - Install (CLI): `npx skillmds@latest add tools-only/2475-03-des-cost-estimate-ce8c94fb` - Raw SKILL.md: https://api.skillmd.com/api/skills/tools-only/2475-03-des-cost-estimate-ce8c94fb/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: DevOps & Infra - Author: tools-only (https://skillmd.com/u/tools-only) - Updated: 2026-09-22 - Page: https://skillmd.com/skills/tools-only/2475-03-des-cost-estimate-ce8c94fb --- # Azure Cost Estimate: aks-platform ![Step](https://img.shields.io/badge/Step-3-blue) ![Status](https://img.shields.io/badge/Status-Draft-orange) ![Agent](https://img.shields.io/badge/Agent-Architect-purple) ![Date](https://img.shields.io/badge/Generated-2026--02--15-grey)
๐Ÿ“‘ Table of Contents - [๐Ÿ’ฐ Cost At-a-Glance](#-cost-at-a-glance) - [โœ… Decision Summary](#-decision-summary) - [๐Ÿ” Requirements โ†’ Cost Mapping](#-requirements--cost-mapping) - [๐Ÿ“Š Top 5 Cost Drivers](#-top-5-cost-drivers) - [Architecture Overview](#architecture-overview) - [๐Ÿงพ What We Are Not Paying For (Yet)](#-what-we-are-not-paying-for-yet) - [โš ๏ธ Cost Risk Indicators](#-cost-risk-indicators) - [๐ŸŽฏ Quick Decision Matrix](#-quick-decision-matrix) - [๐Ÿ’ฐ Savings Opportunities](#-savings-opportunities) - [Detailed Cost Breakdown](#detailed-cost-breakdown) - [References](#references)
> Generated by architect agent | 2026-02-15 | โฌ…๏ธ Previous | ๐Ÿ“‘ Index | Next โžก๏ธ | | -------------------------------------------------------------- | ------------------- | ------------------------------------------------------------ | | [02-architecture-assessment.md](02-architecture-assessment.md) | [README](README.md) | [04-governance-constraints.md](04-governance-constraints.md) | **Generated**: 2026-02-15 **Region**: swedencentral **Environment**: Production **MCP Tools Used**: azure_price_search, azure_cost_estimate, azure_ri_pricing, azure_discover_skus **Architecture Reference**: [02-architecture-assessment.md](02-architecture-assessment.md) ## ๐Ÿ’ฐ Cost At-a-Glance > **Monthly Total: ~$1,880** | Annual: ~$22,560 > > ``` > Budget: $3,000โ€“5,000/month (soft) | Utilization: 38โ€“63% ($1,880 of $3,000โ€“$5,000) > ``` > > | Status | Indicator | > | ----------------- | ----------------------------------------------------- | > | Cost Trend | โžก๏ธ Stable (fixed provisioned compute) | > | Savings Available | ๐Ÿ’ฐ ~$2,200/year with 1-year Reserved Instances | > | Compliance | โœ… SOC 2 / GDPR / ISO 27001 aligned (no cost premium) | ## โœ… Decision Summary - โœ… Approved: AKS Standard tier, WAF v2 ingress, GP 4 vCore SQL (ZR), Premium ACR, NAT Gateway, full observability stack - โณ Deferred: Redis Cache, DDoS Standard, multi-region DR, Azure Front Door, premium monitoring (Sentinel) - ๐Ÿ” Redesign Trigger: If concurrent users exceed 5,000 or p95 latency cannot meet < 200 ms with current SQL vCore count, scale SQL to 8 vCores (+~$490/mo) and evaluate Redis Cache (+~$55/mo) **Confidence**: High | **Expected Variance**: ยฑ15% (Log Analytics ingestion volume is the main variable; node autoscaling adds $149โ€“745/mo at 3โ€“8 nodes) ## ๐Ÿ” Requirements โ†’ Cost Mapping | Requirement | Architecture Decision | Cost Impact | Mandatory | | -------------------------------- | ------------------------------------------ | ------------------------- | --------- | | 99.95% SLA (AKS) | AKS Standard tier (Uptime SLA) | +$73/month | Yes | | WAF in Prevention mode | Application Gateway WAF v2 | +$290/month | Yes | | Private endpoints (SQL, ACR, KV) | Premium ACR + PE subnet + Private DNS | +$170/month (ACR) | Yes | | Zone-redundant SQL | GP 4 vCore ZR addon | +$122/month | Yes | | Deterministic outbound IPs | NAT Gateway on AKS subnet | +$37/month | Yes | | SOC 2 / GDPR compliance | Encryption at rest, audit logging, EU data | $0 incremental | Yes | | Container observability | Container Insights + Log Analytics | +$60/month (~20 GB) | Yes | | Autoscaling (3โ†’8 user nodes) | AKS cluster autoscaler | +$0โ€“$745/month (variable) | No | ## ๐Ÿ“Š Top 5 Cost Drivers | Rank | Resource | Monthly Cost | % of Total | Trend | Optimization | | ---- | --------------------------- | -----------: | ---------: | ----- | ------------------------------------ | | 1๏ธโƒฃ | SQL DB GP 4 vCore (ZR) | $622.65 | 33.1% | โžก๏ธ | 1-yr RI if workload stable | | 2๏ธโƒฃ | AKS user pool (3ร— D4s_v5) | $446.76 | 23.8% | ๐Ÿ“ˆ | 1-yr RI saves 41%; spot for dev/test | | 3๏ธโƒฃ | Application Gateway WAF v2 | $289.80 | 15.4% | โžก๏ธ | Fixed cost; optimize CU utilization | | 4๏ธโƒฃ | ACR Premium | $170.00 | 9.0% | โžก๏ธ | Lifecycle policy to prune old images | | 5๏ธโƒฃ | AKS system pool (2ร— D2s_v5) | $148.92 | 7.9% | โžก๏ธ | 1-yr RI saves 41% | > ๐Ÿ’ก **Quick Win**: Enable ACR image retention policy to auto-delete untagged manifests older than 30 days โ€” keeps storage costs flat as images accumulate.
Cost Driver Details #### 1๏ธโƒฃ Azure SQL Database | Aspect | Detail | | ----------------- | ------------------------------------------------------------- | | Current SKU | GP Gen5 4 vCore (zone-redundant) | | Monthly Cost | $622.65 | | Cost Breakdown | Compute: $488.92, ZR addon: $122.23, Storage (100 GB): $11.50 | | Optimization | 1-year reserved capacity | | Potential Savings | ~$200/month with 1-yr RI (~41% on compute) | #### 2๏ธโƒฃ AKS User Node Pool | Aspect | Detail | | ----------------- | ------------------------------------------------------ | | Current SKU | 3ร— Standard_D4s_v5 (min autoscale) | | Monthly Cost | $446.76 (at 3 nodes) โ†’ $1,190 at 8 nodes | | Optimization | 1-year RI for baseline 3 nodes; spot pool for dev/test | | Potential Savings | ~$183/month with 1-yr RI on 3 nodes (41% savings) | #### 3๏ธโƒฃ Application Gateway WAF v2 | Aspect | Detail | | ----------------- | ----------------------------------------- | | Current SKU | WAF v2 (autoscale 2โ€“10) | | Monthly Cost | ~$290 (fixed $190 + ~$100 capacity units) | | Optimization | Right-size min capacity; monitor CU usage | | Potential Savings | Marginal โ€” fixed cost dominates |
## Architecture Overview ### Cost Distribution | Category | Monthly Cost (USD) | Share | | ---------------- | -----------------: | ----: | | ๐Ÿ’ป Compute | $1,115.44 | 59% | | ๐Ÿ’พ Data Services | $627.65 | 33% | | ๐ŸŒ Networking | $133.60 | 7% | | ๐Ÿ”ง Monitoring | $59.80 | 3% | ### Month-over-Month Projection ```mermaid %%{init: {"theme": "base", "themeVariables": {"primaryColor": "#0078D4"}}}%% xychart-beta title "6-Month Cost Projection ($)" x-axis ["Month 1", "Month 2", "Month 3", "Month 4", "Month 5", "Month 6"] y-axis "Monthly Cost ($)" 0 --> 3000 bar [1880, 1880, 1950, 2050, 2150, 2300] ``` > Growth driven by: Log Analytics ingestion scaling with workload count, SQL storage auto-grow, and user node pool autoscaling as traffic increases. ### Key Design Decisions Affecting Cost | Decision | Cost Impact | Business Rationale | Status | | -------------------------- | -------------- | ----------------------------------------------------------- | -------- | | Premium ACR (not Standard) | +$100/month ๐Ÿ“ˆ | Required for private endpoint support | Required | | Zone-redundant SQL | +$122/month ๐Ÿ“ˆ | 99.995% SLA across AZs per reliability requirements | Required | | AKS Standard (not Free) | +$73/month ๐Ÿ“ˆ | 99.95% API server SLA for production | Required | | Linux-only nodes | -$284/month ๐Ÿ“‰ | No Windows licensing; AKS workloads are containerized Linux | Required | | NAT Gateway (vs LB SNAT) | +$37/month ๐Ÿ“ˆ | Deterministic egress IPs; eliminates SNAT exhaustion risk | Required | ## ๐Ÿงพ What We Are Not Paying For (Yet) - **Azure Cache for Redis** (~$55โ€“250/mo): Add if caching patterns emerge from load testing - **Azure DDoS Protection Standard** (~$2,944/mo): Current risk accepted with WAF + Basic DDoS - **Multi-region DR** (~$1,500+/mo): Single-region with SQL geo-restore; full DR adds second AKS cluster - **Azure Front Door** (~$350+/mo): Not needed โ€” App Gateway handles single-region ingress - **Azure Sentinel** (~$2.46/GB): Log Analytics sufficient for now; Sentinel adds SIEM/SOAR capabilities - **Azure Bastion** (~$140/mo): SSH via `az aks command invoke`; add Bastion if persistent debug access needed - **Azure Firewall** (~$900/mo): NAT Gateway provides egress; add Firewall if egress filtering required ### Assumptions & Uncertainty - Log Analytics ingestion estimated at ~20 GB/mo based on typical AKS clusters with 3โ€“5 user nodes; higher workload density increases log volume - SQL storage set at 100 GB with auto-grow; growth rate depends on application data patterns - Application Gateway capacity unit estimate (~$100/mo) based on moderate traffic; high-throughput workloads may increase CU consumption - Node autoscaling costs ($149โ€“$745/mo range) depend on actual pod scaling behavior ## โš ๏ธ Cost Risk Indicators | Resource | Risk Level | Issue | Mitigation | | -------------------------- | ---------- | -------------------------------------------------------------- | -------------------------------------------------------- | | AKS user pool autoscaling | ๐ŸŸก Medium | 3โ†’8 nodes could add up to $745/mo at peak | Set pod resource limits; tune HPA thresholds carefully | | Log Analytics ingestion | ๐ŸŸก Medium | Container Insights can generate 50+ GB/mo with verbose logging | Configure diagnostic settings selectively; set daily cap | | SQL storage auto-grow | ๐ŸŸข Low | 100 GB baseline; unclear growth rate | Monitor storage metrics; consider data retention policy | | App Gateway capacity units | ๐ŸŸข Low | Variable cost based on connections and throughput | Monitor CU metrics; right-size min autoscale instances | > **โš ๏ธ Watch Item**: AKS user pool autoscaling is the largest cost variable. At steady state with 3 nodes: $447/mo. At full scale with 8 nodes: $1,190/mo โ€” a $743/mo delta. Set autoscaler carefully and monitor. ## ๐ŸŽฏ Quick Decision Matrix _"If you need X, expect to pay Y more"_ | Requirement | Additional Cost | SKU Change | Verdict | Notes | | ------------------------- | --------------- | ---------------------------- | -------------- | -------------------------------------------------- | | Scale SQL to 8 vCores | +$490/month | GP Gen5 8 vCore (ZR) | ๐ŸŸก Monitor | Profile workload first; scale if p95 > 200 ms | | Add Redis Cache | +$55โ€“250/month | Standard C0โ€“C1 | ๐ŸŸก Monitor | Add after load testing identifies caching needs | | Private AKS cluster | +$0 | Config change | ๐Ÿ”ด Investigate | Breaks AGIC addon; requires standalone Helm chart | | Azure DDoS Standard | +$2,944/month | DDoS Plan | ๐Ÿ”ด Investigate | Cost-prohibitive unless regulatory mandate | | Multi-region AKS DR | +$1,500+/month | Duplicate infra | ๐ŸŸก Monitor | Evaluate after 6 months based on availability data | | Spot node pool (dev/test) | -$250/month | Spot pricing (~60% discount) | ๐ŸŸข Go | Create spot pool for non-production workloads | ## ๐Ÿ’ฐ Savings Opportunities > ### Total Potential Savings: ~$5,120/year (1-yr RI on VMs + SQL) > > | Strategy | Commitment | Monthly Savings | Annual Savings | % Reduction | > | ------------------------------- | ---------- | --------------: | -------------: | ----------: | > | VM Reserved Instances (1-yr) | 1-year | $183.54 | $2,202.48 | ~31% | > | VM Reserved Instances (3-yr) | 3-year | $281.39 | $3,376.68 | ~47% | > | VM Savings Plan (1-yr) | 1-year | $148.82 | $1,785.84 | ~25% | > | SQL Reserved Capacity (1-yr) | 1-year | $200.46 | $2,405.52 | ~41% | > | Spot instances (dev/test pool) | N/A | ~$250.00 | ~$3,000.00 | ~60%ยน | > | Dev/Test pricing (non-prod sub) | N/A | ~$140.00 | ~$1,680.00 | ~24%ยฒ | > > ยน Savings on dev/test node pool only (if using spot nodes instead of on-demand) > ยฒ Savings on dev subscription VM licensing (Linux only โ€” already no Windows cost) ### RI Pricing Detail (from Azure Pricing MCP) | VM SKU | PAYG $/hr | 1-yr RI $/hr | 1-yr Savings | Break-even | 3-yr RI $/hr | 3-yr Savings | | --------------- | --------: | -----------: | -----------: | ---------: | -----------: | -----------: | | Standard_D2s_v5 | $0.102 | $0.060 | 41.0% | 7.1 months | $0.038 | 63.0% | | Standard_D4s_v5 | $0.204 | $0.120 | 41.0% | 7.1 months | $0.075 | 63.0% | **Recommended**: 1-year RIs for baseline AKS nodes (2ร— D2s_v5 system + 3ร— D4s_v5 user) โ€” total annual savings of ~$2,200 with a 7.1-month break-even. ## Detailed Cost Breakdown ### Assumptions - Hours: 730 hours/month (24/7 production workload) - Network egress: < 100 GB/mo (moderate API traffic via NAT Gateway) - Storage growth: ~5 GB/month SQL, container images < 50 GB total - Log ingestion: ~20 GB/mo across AKS + resource diagnostics ### Line Items | Category | Service | SKU / Meter | Quantity / Units | Est. Monthly | | ---------------- | -------------------------- | ----------------------------- | --------------------------- | ------------: | | ๐Ÿ’ป Compute | AKS system pool | Standard_D2s_v5 (Linux) | 2 nodes ร— 730 hrs | $148.92 | | ๐Ÿ’ป Compute | AKS user pool | Standard_D4s_v5 (Linux) | 3 nodes ร— 730 hrs | $446.76 | | ๐Ÿ’ป Compute | AKS Standard tier | Uptime SLA | 1 cluster ร— 730 hrs | $73.00 | | ๐Ÿ’ป Compute | Application Gateway WAF v2 | Fixed cost | 1 instance ร— 730 hrs | $189.80 | | ๐Ÿ’ป Compute | Application Gateway WAF v2 | Capacity units | ~10 CU avg | ~$100.00 | | ๐Ÿ’ป Compute | Application Gateway WAF v2 | WAF policy | Included in fixed cost | $0.00 | | ๐Ÿ’พ Data Services | SQL DB compute | GP Gen5 4 vCore | 4 vCores ร— 730 hrs | $488.92 | | ๐Ÿ’พ Data Services | SQL DB zone redundancy | ZR addon | ~25% of compute | $122.23 | | ๐Ÿ’พ Data Services | SQL DB storage | GP Storage (LRS) | 100 GB | $11.50 | | ๐Ÿ’พ Data Services | Key Vault | Standard | ~1,000 operations/mo | $5.00 | | ๐ŸŒ Networking | NAT Gateway | Standard (fixed + processing) | 1 instance ร— 730 hrs | $36.50 | | ๐ŸŒ Networking | Container Registry | Premium (daily + storage) | 30 days + 20 GB | $170.00 | | ๐ŸŒ Networking | Public IP addresses | Standard Static | 2 IPs ร— 730 hrs | $7.30 | | ๐ŸŒ Networking | Virtual Network / NSGs | โ€” | 1 VNet + 3 subnets + 3 NSGs | $0.00 | | ๐ŸŒ Networking | Private Endpoints | โ€” | 3 endpoints | $0.00 | | ๐ŸŒ Networking | Private DNS Zones | โ€” | 3 zones | $0.00 | | ๐Ÿ”ง Monitoring | Log Analytics | Per-GB ingestion | ~20 GB/month | $59.80 | | ๐Ÿ”ง Monitoring | Application Insights | Per-GB (first 5 GB free) | ~3 GB/month | $0.00 | | | | | **Total (PAYG)** | **$1,859.73** | ### Notes - AKS node VMs eligible for 1-year or 3-year Reserved Instances (41โ€“63% savings) - SQL Database compute eligible for reserved capacity (similar RI discounts) - ACR classified under Networking as it provides container image distribution โ€” could alternatively be classified under Compute - Log Analytics first 5 GB/mo is free; Container Insights generates the majority of ingestion volume - Private Endpoints and Private DNS Zones have no additional cost beyond the resources they connect to - Consider Dev/Test subscription pricing for non-production environments --- ## References | Topic | Link | | ------------------------ | ---------------------------------------------------------------------------------------------------------------------- | | Azure Pricing Calculator | [Calculator](https://azure.microsoft.com/pricing/calculator/) | | Cost Management | [Overview](https://learn.microsoft.com/azure/cost-management-billing/costs/overview-cost-management) | | Reserved Instances | [Reservations](https://learn.microsoft.com/azure/cost-management-billing/reservations/save-compute-costs-reservations) | | WAF Cost Optimization | [Checklist](https://learn.microsoft.com/azure/well-architected/cost-optimization/checklist) | | AKS Pricing | [Pricing](https://azure.microsoft.com/pricing/details/kubernetes-service/) | | SQL Database Pricing | [Pricing](https://azure.microsoft.com/pricing/details/azure-sql-database/single/) | | VM Pricing (Dsv5) | [Pricing](https://azure.microsoft.com/pricing/details/virtual-machines/linux/) | --- | โฌ…๏ธ [02-architecture-assessment.md](02-architecture-assessment.md) | ๐Ÿ  [Project Index](README.md) | โžก๏ธ [04-governance-constraints.md](04-governance-constraints.md) | | ----------------------------------------------------------------- | ----------------------------- | --------------------------------------------------------------- |