Back to skills
SKILL.md
2100 03 Des Cost Estimate 2b52cf45
ASecurity   <details open> <summary><strong>📑 Cost Estimate Overview</strong></summary> - [💵 Cost At-a-Glance](#-cost-at-a-glance) - [✅ Decision Summary](#-decision-summary) - [🔁 Requirements → Cost Mapping](#-requirements--cost-mapping) - [📊 Top 5 Cost Drivers](#-top-...
- 9 stars
- 0 votes
- 0 copies
- 1 view
- Added October 11, 2026
Works with
Security analysis
100/100npx -y skills add tools-only/X-Skills --skill 2100-03-des-cost-estimate_2b52cf45 --agent claude-codeAre you the author of 2100 03 Des Cost Estimate 2b52cf45?
Add the live security badge to your README. It updates with every re-scan.
[](https://www.skillsdirectory.com/skills/tools-only-2100-03-des-cost-estimate-2b52cf45)# 💵 Step 3: Cost Estimate - PCI DSS Gateway
<details open>
<summary><strong>📑 Cost Estimate Overview</strong></summary>
- [💵 Cost At-a-Glance](#-cost-at-a-glance)
- [✅ Decision Summary](#-decision-summary)
- [🔁 Requirements → Cost Mapping](#-requirements--cost-mapping)
- [📊 Top 5 Cost Drivers](#-top-5-cost-drivers)
- [🏛️ Architecture Overview](#️-architecture-overview)
- [🧾 What We Are Not Paying For (Yet)](#-what-we-are-not-paying-for-yet)
- [⚠️ Cost Risk Indicators](#️-cost-risk-indicators)
- [🎯 Quick Decision Matrix](#-quick-decision-matrix)
- [💰 Savings Opportunities](#-savings-opportunities)
- [🧾 Detailed Cost Breakdown](#-detailed-cost-breakdown)
- [References](#references)
</details>
> Generated by @architect agent | 2026-02-09
| ⬅️ Previous | 📑 Index | Next ➡️ |
| -------------------------------------------------------------- | ------------------- | ------------------------------------------------------------ |
| [02-architecture-assessment.md](02-architecture-assessment.md) | [README](README.md) | [04-governance-constraints.md](04-governance-constraints.md) |
---
## 💵 Cost At-a-Glance
| Metric | Value |
| ----------------------------------- | ------------------------------ |
| **Monthly Estimate (Typical Prod)** | $13,328 – $19,032 |
| **Monthly Estimate (Peak Scale)** | ~$27,800 |
| **Annual Estimate (Typical Prod)** | $159,936 – $228,384 |
| **Primary Region** | swedencentral |
| **Failover Region** | germanywestcentral |
| **Pricing Source** | Azure Pricing MCP (2026-02-09) |
| **Currency** | USD |
> [!IMPORTANT]
> All prices sourced from Azure Retail Pricing API via Azure Pricing MCP tools. Prices are pay-as-you-go rates for swedencentral region. Reserved Instance savings (35%) are documented separately.
---
## ✅ Decision Summary
| Decision | Cost Impact | Rationale |
| --------------------------- | -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| AKS over ACA | +$438/mo management fee (AKS Standard) | PCI CDE isolation requires dedicated node pools. ACA would save ~$438/mo but lacks node-level isolation. |
| DDoS Network Protection | +$2,944/mo fixed | Full VNet coverage for CDE. IP Protection ($199/IP) was cheaper but provides less coverage. User confirmed Network. |
| APIM Premium | +$2,795/mo fixed | VNet integration for CDE. Standard v2 ($700/mo) would save $2,100/mo but lacks VNet integration. User confirmed Premium. |
| Azure Firewall Premium | +$1,278/mo fixed | IDPS capability for PCI-DSS Req 1. Standard tier lacks IDPS — non-compliant for PCI. |
| Key Vault Premium (HSM) | +$22/mo over Standard | PCI-DSS requires HSM for cryptographic keys. Minimal cost delta. |
| PostgreSQL Memory Optimized | +$500/mo over General Purpose | Write-heavy payment transactions benefit from larger memory. Can start with General Purpose ($1,092/mo) to save. |
---
## 🔁 Requirements → Cost Mapping
| Requirement | Service(s) | Monthly Cost | Notes |
| ---------------------- | --------------------------------------------------- | ----------------------- | ------------------------------------------ |
| 10,000 TPS sustained | AKS + D8s_v5 nodes (6 avg) | $2,225 | KEDA autoscaling 3-20 nodes |
| PCI-DSS v4.0 Level 1 | Firewall Premium + Key Vault HSM + APIM VNet + DDoS | $7,039 | Compliance is the largest cost driver |
| 99.99% SLA | Zone-redundant AKS + PostgreSQL HA | Included in SKU pricing | Zone-redundancy built into SKU selections |
| ACID transactions | PostgreSQL Flexible Server E16s v5 | $1,501 | Zone-redundant HA enabled |
| Session/cache ≤ 10ms | Cosmos DB Autoscale | $876 – $4,380 | Variable based on autoscale RU usage |
| API management + OAuth | API Management Premium | $2,795 | VNet-integrated for CDE |
| Transaction queues | Service Bus Premium | $677 | Dedicated capacity, DLQ support |
| Container images | ACR Premium | $10+ | Geo-replicated to failover region |
| 1-year log retention | Log Analytics | $300 – $1,500 | Depends on ingestion volume (~2-10 GB/day) |
| Admin JIT access | Entra ID P2 + PIM | $200 – $500 | Per-user licensing |
---
## 📊 Top 5 Cost Drivers
| Rank | Service | Monthly Cost | % of Total | Optimization Available |
| ---- | ------------------------------ | ------------ | ---------- | ----------------------------------------------------------------- |
| 1 | **DDoS Network Protection** | $2,944 | ~18% | Consider IP Protection ($199/IP) if fewer public endpoints |
| 2 | **API Management Premium** | $2,795 | ~17% | Start with Standard v2 if VNet integration not required initially |
| 3 | **AKS Compute (nodes)** | $1,787 | ~11% | Reserved Instances save 35%. Spot for non-CDE. |
| 4 | **PostgreSQL Flexible Server** | $1,501 | ~9% | Start with General Purpose ($1,092/mo). RI saves 35%. |
| 5 | **Azure Firewall Premium** | $1,278 | ~8% | Fixed cost — required for PCI IDPS |
```mermaid
%%{init: {'theme':'base','themeVariables':{pie1:'#0078D4',pie2:'#107C10',pie3:'#5C2D91',pie4:'#D83B01',pie5:'#FFB900'}}}%%
pie showData
"DDoS Network Protection" : 2944
"API Management Premium" : 2795
"AKS Compute" : 1787
"PostgreSQL Flexible" : 1501
"Azure Firewall Premium" : 1278
```
> [!WARNING]
> PCI-DSS compliance costs (Firewall + DDoS + APIM + Key Vault HSM) account for **~43% of total spend** ($7,039/mo). These are non-negotiable for Level 1 compliance.
---
## 🏛️ Architecture Overview
```
Internet → Azure Front Door Premium (WAF + DDoS)
↓
Azure Firewall Premium (IDPS)
↓
API Management Premium (VNet)
↓
AKS (D8s_v5 × 3-20 nodes)
├── Payment Service → PostgreSQL Flex Server (E16s v5)
├── Session Service → Cosmos DB (Autoscale)
├── Queue Worker → Service Bus Premium
└── All Services → Key Vault Premium (HSM)
↓
Log Analytics (1-year retention)
Microsoft Defender for Cloud
```
---
## 🧾 What We Are Not Paying For (Yet)
| Service | Potential Cost | When Needed |
| -------------------------------------------------- | --------------------------- | --------------------------------------------------------------- |
| Azure Cache for Redis Enterprise | $500 – $1,500/mo | If Cosmos DB latency exceeds targets under 15k TPS peak load |
| Multi-region Active-Active (Cosmos DB multi-write) | +$876+ /mo | If Active-Passive DR doesn't meet RTO/RPO under real operations |
| Azure Load Testing | $10/virtual user hour | During performance validation (pre-production) |
| Penetration Testing (3rd party) | $5,000 – $20,000 one-time | Quarterly for PCI-DSS Req 11 |
| QSA Annual Audit | $30,000 – $100,000 one-time | PCI-DSS Level 1 annual compliance |
| Azure Bastion | $139/mo | For secure admin access to VNet (recommended for CDE) |
| PostgreSQL Read Replicas | ~$750/mo per replica | If reporting queries impact transaction throughput |
| GitHub Actions (CI/CD) | $0 – $1,000/mo | Depends on pipeline minutes and runner usage |
---
## ⚠️ Cost Risk Indicators
| Risk | Likelihood | Impact | Mitigation |
| -------------------------------------------- | ---------- | -------------------------------------- | ------------------------------------------------------------ |
| Cosmos DB RU consumption spikes during peak | Medium | $876 → $4,380/mo (+$3,504) | Set autoscale max at 50K RU/s. Monitor RU consumption daily. |
| AKS scales to 20 nodes during sustained peak | Medium | $1,787 → $5,960/mo (+$4,173) | KEDA thresholds tuned. Node count alerts at 15 nodes. |
| Log Analytics ingestion exceeds 10 GB/day | Medium | $300 → $1,500/mo (+$1,200) | Set daily cap. Use Commitment Tier at 100 GB/day. |
| Failover to germanywestcentral activated | Low | +$8,000 – $12,000/mo (duplicate infra) | Only activated during regional outage. Not sustained cost. |
| APIM Premium auto-scales to 2+ units | Low | $2,795 → $5,590+/mo | Monitor APIM capacity. Manual scaling only. |
---
## 🎯 Quick Decision Matrix
| If you want to... | Do this | Save | Trade-off |
| ------------------- | ------------------------------------- | ---------- | ---------------------------------------------- |
| Cut 18% of budget | Switch DDoS Network → IP Protection | ~$2,745/mo | Less coverage, fewer public IPs protected |
| Cut 13% of budget | Start with APIM Standard v2 | ~$2,095/mo | No VNet integration — APIM outside CDE |
| Cut 9% of compute | Use D4s_v5 instead of D8s_v5 nodes | ~$894/mo | Fewer resources per node — may need more nodes |
| Cut 3% of database | Start PostgreSQL with General Purpose | ~$409/mo | Less memory for write-heavy transactions |
| Save 35% on compute | Commit to 1-year Reserved Instances | ~$1,150/mo | 1-year commitment — less flexibility |
---
## 💰 Savings Opportunities
### Reserved Instances (Recommended)
| Resource | Pay-as-You-Go | 1-Year RI | Annual Savings |
| ---------------------- | ------------- | ---------- | --------------- |
| AKS Nodes (D8s_v5 × 6) | $1,787/mo | ~$1,162/mo | ~$7,500/yr |
| PostgreSQL E16s v5 | $1,501/mo | ~$976/mo | ~$6,300/yr |
| **Total RI Savings** | | | **~$13,800/yr** |
### Other Optimizations
| Opportunity | Savings | Effort |
| --------------------------------------------------- | ------------------------ | ------ |
| Spot nodes for non-CDE dev/test workloads | Up to 80% on dev compute | Medium |
| Cosmos DB autoscale floor tuning | 20-60% during off-peak | Low |
| Log Analytics Commitment Tier (100 GB/day) | ~30% on ingestion | Low |
| Shutdown dev/staging during nights/weekends | ~60% on non-prod compute | Medium |
| Azure Hybrid Benefit (if existing Windows licenses) | Up to 40% on Windows VMs | Low |
---
## 🧾 Detailed Cost Breakdown
### 💻 Compute
| Resource | SKU | Qty | Unit Price | Monthly Cost | Source |
| -------------------------- | --------------- | ------------ | ---------- | ------------ | ----------------------------- |
| AKS Management Fee | Standard | 1 | $0.60/hr | $438 | Azure Pricing MCP |
| AKS System Pool (D4s_v5) | Standard_D4s_v5 | 3 | ~$0.204/hr | $447 | Azure Pricing MCP (estimated) |
| AKS User CDE Pool (D8s_v5) | Standard_D8s_v5 | 3-20 (avg 6) | ~$0.408/hr | $1,787 | Azure Pricing MCP |
| **Subtotal** | | | | **$2,672** | |
### 💾 Data Services
| Resource | SKU | Qty | Unit Price | Monthly Cost | Source |
| ---------------------------- | ----------------------------- | --- | ---------------------- | ------------------- | -------------------- |
| PostgreSQL Flexible Server | Memory Opt E16s v5, 16 vCores | 1 | $2.056/hr | $1,501 | Azure Pricing MCP |
| PostgreSQL Storage | Premium SSD, 512 GB | 1 | ~$0.12/GB/mo | $61 | Azure retail pricing |
| Cosmos DB (NoSQL, Autoscale) | 10K-50K RU/s | 1 | $0.012/hr per 100 RU/s | $876 – $4,380 | Azure Pricing MCP |
| Cosmos DB Storage | 100 GB included + overage | 1 | $0.25/GB/mo | ~$25 | Azure retail pricing |
| **Subtotal** | | | | **$2,463 – $5,967** | |
### 🌐 Networking & Security
| Resource | SKU | Qty | Unit Price | Monthly Cost | Source |
| ------------------------------ | ----------------------- | ---------- | ------------- | ------------------- | -------------------- |
| Azure Firewall Premium | Premium | 1 | $1.75/hr | $1,278 | Azure Pricing MCP |
| Azure Firewall Data Processing | Per GB | ~500 GB/mo | $0.016/GB | $8 | Azure Pricing MCP |
| Azure Front Door Premium | Premium base + requests | 1 | ~$330 base | $500 – $1,200 | Azure retail pricing |
| DDoS Network Protection | Standard | 1 | Fixed monthly | $2,944 | Azure retail pricing |
| API Management Premium | Premium (1 unit) | 1 | $3.829/hr | $2,795 | Azure Pricing MCP |
| **Subtotal** | | | | **$7,525 – $8,225** | |
### 🔐 Security & Identity
| Resource | SKU | Qty | Unit Price | Monthly Cost | Source |
| ----------------- | ------------------ | ------------- | ------------- | --------------- | ------------------- |
| Key Vault Premium | HSM-backed | 1 | $0.03/10K ops | $22+ | Azure Pricing MCP |
| Entra ID P2 + PIM | Per-user licensing | ~10-20 admins | $9/user/mo | $90 – $180 | Microsoft licensing |
| **Subtotal** | | | | **$112 – $202** | |
### 📊 Monitoring & Operations
| Resource | SKU | Qty | Unit Price | Monthly Cost | Source |
| ---------------------------------------- | ---------------- | ------------- | --------------------------- | ----------------- | -------------------- |
| Log Analytics (ingestion) | Per-GB | 2-10 GB/day | $2.99/GB | $180 – $900 | Azure Pricing MCP |
| Log Analytics (retention beyond 31 days) | 1 year | Per GB stored | $0.10/GB/mo | $120 – $600 | Azure retail pricing |
| Application Insights | Connection-based | 1 | Included with Log Analytics | $0 | — |
| Defender for Cloud (Enhanced) | Per-resource | Multiple | Variable | $200 – $500 | Azure retail pricing |
| **Subtotal** | | | | **$500 – $2,000** | |
### 📨 Messaging & Registry
| Resource | SKU | Qty | Unit Price | Monthly Cost | Source |
| -------------------------- | ---------------- | --- | -------------------- | ------------ | ----------------- |
| Service Bus Premium | 1 Messaging Unit | 1 | $0.9275/hr | $677 | Azure Pricing MCP |
| Container Registry Premium | Premium | 1 | $0.333/day + storage | $10+ | Azure Pricing MCP |
| **Subtotal** | | | | **$687+** | |
### 📋 Total Summary
| Category | Min (Typical Prod) | Max (Peak Scale) |
| ------------------------ | ------------------ | ---------------- |
| 💻 Compute | $2,672 | $6,400 |
| 💾 Data Services | $2,463 | $5,967 |
| 🌐 Networking & Security | $7,525 | $8,225 |
| 🔐 Security & Identity | $112 | $202 |
| 📊 Monitoring | $500 | $2,000 |
| 📨 Messaging & Registry | $687 | $700 |
| **TOTAL** | **~$13,959** | **~$23,494** |
> [!NOTE]
> 💰 Production with full HA (20 user nodes, max Cosmos RU/s, high log volume) could reach ~$27,800/mo including failover region warm standby. Dev environment at ~$3,500/mo using reduced SKUs.
---
<div align="center">
_Generated by **Azure Agentic InfraOps** | [GitHub](https://github.com/jonathan-vella/azure-agentic-infraops)_
</div>
---
## References
> [!NOTE]
> 📚 The following resources provide additional pricing guidance.
| Topic | Link |
| ---------------------------------- | --------------------------------------------------------------------------------------------------------------------- |
| Azure Pricing Calculator | [Pricing calculator](https://azure.microsoft.com/pricing/calculator/) |
| AKS Pricing | [AKS pricing](https://azure.microsoft.com/pricing/details/kubernetes-service/) |
| PostgreSQL Flexible Server Pricing | [PostgreSQL pricing](https://azure.microsoft.com/pricing/details/postgresql/flexible-server/) |
| Cosmos DB Pricing | [Cosmos DB pricing](https://azure.microsoft.com/pricing/details/cosmos-db/autoscale-provisioned/) |
| Azure Firewall Pricing | [Firewall pricing](https://azure.microsoft.com/pricing/details/azure-firewall/) |
| Azure Front Door Pricing | [Front Door pricing](https://azure.microsoft.com/pricing/details/frontdoor/) |
| API Management Pricing | [APIM pricing](https://azure.microsoft.com/pricing/details/api-management/) |
| DDoS Protection Pricing | [DDoS pricing](https://azure.microsoft.com/pricing/details/ddos-protection/) |
| Azure Reserved Instances | [RI overview](https://learn.microsoft.com/azure/cost-management-billing/reservations/save-compute-costs-reservations) |
Attribution
Comments
Loading comments…
Newsletter
Get the weekly list of safe new skills, and the ones we pulled.