Your continuous controls monitoring evaluates 60 rules against an estate of about 180,000 cloud resources, re-running everything every 15 minutes through the provider's managed config-rule service. Finance asks what it costs and whether it could run every minute instead. Roughly what are you spending, and what does the number rule in or out?

The assumptions, stated

• 180,000 resources, 60 rules, full re-evaluation every 15 minutes: 96 cycles a day.
• A major cloud provider's managed config service, priced in 2026 at roughly \(0.001 per rule evaluation** for the first 100,000 per region per month and falling to about **\)0.0005 at volume.
• Resources change rarely: assume 0.5% to 2% of the estate changes per day.
• Of 60 rules, roughly 6 apply to any given resource type.

The arithmetic

Full sweep: 180,000 × 60 = 10.8 million evaluations per cycle. At 96 cycles that is about 1 billion evaluations a day, or roughly $520,000 a day at $0.0005 each. The number is absurd, which is the useful part of the estimate: per-resource polling of a whole estate is not a design, it is an accident waiting for an invoice.

Event-driven: 900 to 3,600 resources change per day, times about 6 applicable rules, is 5,000 to 22,000 evaluations a day - on the order of $5 to $20 a day. Four to five orders of magnitude cheaper, for better detection latency, because evaluation happens when the thing changes.

The gap that events do not close is drift with no change event: a resource created through a path that does not emit one, a trail someone disabled, state that the provider does not model. Cover it with one bulk sweep a day done in your own compute - list each resource type once, evaluate in-process. At a few hundred bytes per resource, 180,000 resources is tens of megabytes and minutes of compute, a few dollars.

Which assumption dominates the error

The daily change rate, by an order of magnitude, and it is the one you can measure in an afternoon from the change event stream. The price tier matters less than whether you are paying per resource or per change.

What the number rules out, and the per-minute question

It rules out the architecture, not the control. Keep the managed per-evaluation service for the small set of rules where you want an independent system's record that the evaluation happened, and move the rest to events plus a daily sweep.

Per-minute polling buys nothing on its own, because detection latency only matters against the exposure window. If remediation is automated and takes three minutes, moving from 15-minute to 1-minute evaluation cuts median exposure from about 7.5 minutes to about half a minute. That is worth paying for on the handful of rules where minutes are dangerous - a storage bucket made public, a database port opened to the internet - and worth nothing on tagging compliance.

When this is the wrong answer

When the monitoring costs more than the risk it covers, the lighter control wins. For a rule whose violation is embarrassing rather than harmful, a daily sweep and a weekly report is the right answer, and the right threshold for auto-remediation is a separate question from the right cadence. A 400-rule estate-wide monitor that nobody tunes also fails in a second way: it reports thousands of findings, the owners stop reading, and the organisation has bought evidence that it knew about every violation it ignored.