What the platform costs
Every figure on this page is ex-VAT. The estate’s cost is quoted pre-tax because that is the right basis for comparing infrastructure decisions. The invoice adds 14% VAT — the one complete invoice on record reads $372.89 + $52.20 = $425.09 — so ≈$360/month pre-tax is ≈$410/month payable, and the $402.18/month of savings is worth $458/month in cash. Take tax from the invoice, never from Cost Explorer: CE attributes it differently and shows roughly eight times less.
The AWS estate for Orascom Portals costs roughly $360–375 per month pre-tax. This page explains that figure, the three ways it is easy to get wrong, and what is still available.
Read this before quoting any number
Section titled “Read this before quoting any number”What it costs now
Section titled “What it costs now”| Figure | Value | Use it for |
|---|---|---|
| Structural run-rate | $374.58 / month (Cost Explorer, 2026-08-25 → 08-31, full rate) | Reasoning about what the infrastructure genuinely costs |
| Expected invoice | ≈ $360 / month pre-tax | Predicting the usage line |
| Payable | ≈ $410 / month | What finance pays — the August invoice carries 14% VAT ($372.89 + $52.20 = $425.09) |
The gap between the two is the free-tier t4g.small allowance. The 2026-08-25 → 08-31 window is the
only clean steady-state period available: it sits after the August optimisations landed and before the
September free-tier reset.
What the 2026-08 programme removed
Section titled “What the 2026-08 programme removed”Total verified reduction: $402.18 / month (≈ $4,826 / year). Every item was re-verified against the live resource.
| Action | Date | $/month |
|---|---|---|
| RDS MySQL 8.0 Extended Support eliminated by upgrading to 8.4.11 | 2026-08-23 | 356.51 |
| Staging environment decommissioned | 2026-08-16 | 18.87 |
ODH-Prod-Backend-Template stopped (not terminated) |
2026-08-24 | 14.02 |
| Leaked green fleet from a stalled deploy, deleted (not a stray resource — see below) | 2026-08-24 | 10.82 |
Five portals/staging/* secrets scheduled for deletion |
2026-08-22 | 1.96 |
| CRM target-group health check relaxed to 10 s / 5 strikes | 2026-08-24 | 0.00 — a reliability fix, see below |
One action produced 89% of the saving, and nobody chose it
Section titled “One action produced 89% of the saving, and nobody chose it”The RDS item alone is $356.51/month — 89% of everything saved, and 95% of the entire remaining bill. Paying it nearly doubled the cost of the account. The mechanism is worth understanding because it will recur: MySQL 8.0 left standard support on 2026-07-31, and the production database was automatically enrolled into paid Extended Support on 08-01, billed per vCPU-hour with Multi-AZ billing the standby as well. (UAT had already opted out and billed $0.) No AWS warning reached Orascom — billing notifications go to the root address and registered billing contacts, which were the outgoing vendor’s. No one made a decision; it arrived on a calendar and nobody was told. The 08-23 upgrade to 8.4.11 ended it.
The most valuable finding saved no money
Section titled “The most valuable finding saved no money”The production CRM instance had been flapping — eight load-balancer health-check kills, each one a CRM outage — caused by a memory-tight instance combined with an aggressive health check (5 s timeout, 2 strikes) against an endpoint that takes ~2.6 s to answer. Relaxing the check to 10 s / 5 strikes on 2026-08-24 was ranked the single most important action, and there have been no kills since. Stated honestly: the last kill preceded the fix by about eight hours, so the fix is strongly consistent with the outcome rather than proven to be its sole cause.
What is still on the plan
Section titled “What is still on the plan”Nothing below has been executed.
| Item | $/month | Reversible? |
|---|---|---|
| S3 gateway VPC endpoint | up to 12.80 | Yes — the only free, low-risk, reversible item on the list. Still not created. Note the ceiling applies to the NAT bytes line only, and the S3-attributable share is unmeasured. Recommended. |
| WAF Bot Control | 10.00 | Yes, but read the caveat. In steady state it blocks 58 of ~143,000 requests over 14 days (0.04%) while a free rule ahead of it blocks ~90%, so the routine economics favour removal. But in the July 2026 traffic flood it blocked 95 million requests — more than every other rule group combined — and its per-request charge added roughly $385 to that one month. It is both the most expensive item under load and the only volumetric defence present. An owner call — and if it goes, a rate-based rule (about $1/month) should go in first. |
| EC2 Instance Savings Plan | 13.78 – 23.38 | ❌ No — 12-month commitment |
| RDS Reserved Instance | 16.80 – 19.52 | ❌ No — 12-month commitment |
| Idle Elastic IP | 3.65 | Keep. Stale DNS records still point at it, several in a zone Orascom does not control, so releasing it could hand a stranger live callback traffic. Cheap insurance. |
Rejected, with the arithmetic, so they are not re-proposed each quarter: dropping RDS Multi-AZ saves $39.95/month but removes database failover; RDS gp2 → gp3 is not a lever at all (unlike EBS, RDS prices them within a fraction of a cent, so gp3 is marginally more); cutting backups saves $0 because backups are already free; interface VPC endpoints cost more than the entire NAT bill they would offset; and a NAT instance saves $42/month at the price of a single point of failure on all production egress.
Housekeeping — correctness, not savings
Section titled “Housekeeping — correctness, not savings”Priced so nobody chases them for money: WAF logs are 99.4% of all CloudWatch Logs volume but currently free-tier absorbed, with only ~2× headroom; there is no lifecycle rule on any S3 bucket while versioning is on, so the deploy bucket accumulates every revision forever; and the ECR lifecycle rule can never fire because it targets untagged images and every image carries a tag. All are hygiene against unbounded growth.
The lesson worth keeping
Section titled “The lesson worth keeping”The largest cost item in this account appeared automatically, on a support calendar, without anyone making a decision — and was invisible until someone went looking. The estate itself is not wasteful: the orphan sweep is clean, storage is fully attached, UAT shares the production load balancer, and no half-decommissioned environment is quietly billing. The defence against the next surprise is a billing alarm and a maintenance calendar, not more scrutiny of the parts that are already tidy.