Update information on cost of the solution: Highlight AWS KMS cost

[Jeanne-G]

Update of cost breakdown of the solution: Highlight AWS KMS cost

The cost of the solution is heavily driven on the KMS Key usage. If solution is deployed cross accounts and multiple regions, the cost can increase drastically. Moreover with the pricing of AWS KMS Managed Key with 2 rotations, the price is increasing even more on the rotations period.

Proposed update: share cost breakdown for KMS Key usage and impact on solution cost

[bios6]

Hi, thanks for creating this issue, we will take a look into this

[jrgaray27]

Hello,
Our Implementation Guide currently provides a cost breakdown with examples of deployments at various scales (up to 1,000 accounts). Each example includes a table breaking down cost by service - the row titled "AWS Key Management Service" specifies the costs related to KMS Keys.

These examples don't include rotation pricing, so we will add that in the upcoming v2.3.0 release. Thank you.

[Jeanne-G]

Hello,
The documentation does show examples on the cost of the solution for 10 accounts and up to 1000 accounts. However, in all scenarios, it is only for one AWS Region. The number of AWS Region does have a very meaningful impact on the cost of the solution.
Moreover, in the section "Sample cost table" there is a paragraph saying:
"The total cost to run this solution depends on the following factors:

• The number of AWS Security Hub member accounts
• The number of active automatically-invoked remediations
• The frequency of remediation"
  This should be change or updated with the amount of AWS Region used and the fact that the rotation of keys creates a consequent change in cost. In my case, the cost for the solution being in 50 accounts and 17 AWS Regions makes the cost being about 850$/month just for KMS.
  Finally, in the same section AWS KMS service is not showing. It is only showing in the section "Pricing examples (monthly)"

Would it be possible to do the updates and had a variation of the pricing examples?

[julian-price]

Hi @Jeanne-G, the cost of this solution was prohibitive for us to implement it, so I made an enhancement (#204) to have a single KMS key per region shared to the organization. This means that the KMS costs are drastically reduced and costs are predictable.

@jrgaray27, I notice that #204 has been closed, but it is not available in the latest 2.2.1 release. I have now repatched my code up to that latest release, but I would think that the current per-account, per-region KMS costs might be a factor is putting people off installing the solution in the first place, as it was for me.

[jrgaray27]

Hi @julian-price - I reopened #204 since it is currently in our backlog. It is not slated for our upcoming release (v2.3.0), but we will continue evaluating it for future releases.

@Jeanne-G, regarding pricing in the Implementation Guide:

• We are planning on updating the Cost page with examples that include multiple regions as well as the costs of KMS Key rotation. This change should be published along with the v2.3.0 release.
• For now, if you'd like to calculate the Cost with X number of regions, you can extrapolate that from any of the 3 examples shown on this Cost page by re-calculating the cost of the "AWS Key Management Service" row by multiplying X number of regions instead of the 1 region used in the example. Then, add this value with the costs of all other services to get the total monthly cost using X regions.