Cost switches

In 1 minute

Some AWS resources cost money every hour they exist, used or not: the RDS database, the Valkey cache, running tasks and the load balancer. MiniTickets groups them behind three switches in the committed stack config. Turning the environment off is a commit: change the switch, push, approve the deploy. Everything that is free or billed only per request stays on, and a monthly budget emails a warning when spending grows.

Picture it

flowchart TB
  D["dataEnabled<br/>RDS, Valkey, their secrets"] --> C["computeEnabled<br/>cluster, services, Lambdas, logs"]
  C --> E["entryEnabled<br/>ALB, listeners, web service"]
  A["always on: network, queues, topics,<br/>tables, bucket, ECR, IAM, alarms, budget"]

How it works

1. Edit the committed file. infra/Pulumi.dev.yaml holds dataEnabled, computeEnabled, entryEnabled, cdnEnabled and domainName.
2. Commit, push, approve. CD’s deploy job reads the committed switches. With compute off it only applies the config: no migration, no image change.
3. Dependencies are enforced. Compute needs data; entry needs both. The infrastructure code stops with a clear error otherwise. So turn on data → compute → entry, and off in reverse (or all at once).
4. The deployed tag stays in SSM, so the next “on” starts the same version again.

In MiniTickets

Switch off	Removes	Keep in mind
entryEnabled	ALB, listeners, target groups, web service	No public URL; the smoke test is skipped
computeEnabled	cluster, task definitions, services, both Lambdas, log groups	Messages wait in the queues, for up to 4 days
dataEnabled	RDS Postgres, Valkey, their secrets	Deletes the data: dev keeps no final snapshot

Always on, because they are free or billed per request: the network and security groups, ECR, SSM, the CI/CD roles, SNS, SQS, both DynamoDB tables, the assets bucket, SES, the certificate, two alarms, the dashboard and the budget. Issued tickets survive an “off”, and waiting messages too, for the queue’s 4 days.

The budget minitickets-dev-monthly-cost has a limit of 20 USD per month. It emails at 25%, 50% and 100% of actual spend, and when the forecast passes 100%. includeCredit is false, so it shows the real cost even while credits pay the bill. It only warns; it never stops anything.

From → to	What happens	What allows it
Monthly cost budget → AWS account and region	watches the whole account's monthly cost	metric COST budget 20 USD per month; emails at 25%, 50%, 100% actual and 100% forecastcreateBudget

See stage 0 on the map: the account and its budget →

See it in AWS

Console

Billing and Cost Management → Budgets → minitickets-dev-monthly-cost; Cost Explorer, grouped by service.

CLI

aws budgets describe-budget --account-id <account-id> --budget-name minitickets-dev-monthly-cost

Code

infra/src/budget.ts → createBudget and the switches in infra/index.ts.

Break it

Symptom	Cause	Where to look
The 50% alert arrives in the first week	All switches stayed on: RDS, the ALB and tasks billed every hour	Cost Explorer by service
The bill passed 20 USD and nobody got an email	alertEmail is wrong, or the mail went to spam	Budgets → alerts
A switch change is undone	It was applied locally, not committed	git log -- infra/Pulumi.dev.yaml

Say it in an interview

Say it like this (20-30 seconds)

The billed layers sit behind three switches in the committed stack config: data for RDS and Valkey, compute for the services and Lambdas, entry for the load balancer. Turning the environment off is a commit that CD applies after approval, so config never drifts. Queues, tables, the bucket, IAM and the alarms stay on because they are free or per request. A 20 USD monthly budget warns by email; it never stops anything.

Follow-ups

Why delete the database instead of stopping it?

A stopped RDS instance still bills its storage, and AWS starts it again after seven days. Dev data is seed data, so deleting it is acceptable here; production would keep snapshots.

Why are the switches in git and not a script?

One committed source of truth: CD applies exactly what is reviewed, and the history shows who turned what on.

Why does a budget not stop spending?

AWS Budgets can run actions, but stopping resources automatically could break things at a bad moment. We chose a warning and a person.

Advanced: Details: cdnEnabled

cdnEnabled chooses CloudFront mode or ALB-only mode (today false: ALB-only). Change it only while entry is off; the listener and security group rules differ between the two modes.

Checkpoint

Answer these without scrolling up. If one feels hard, reread that section.

1. Which three switches turn billed layers off?
2. How do you turn the environment off, step by step?
3. What does switching data off delete?
4. Name four things that stay on, and why.
5. What does the budget do at 50%?

Redraw it from memory: dataEnabled → computeEnabled → entryEnabled (on in this order, off in reverse); always on: network, queues, tables, bucket, IAM, alarms, budget

Try this: on the map, move the stage slider to 0 and select the monthly cost budget

Mark this page as read