From 1 February 2024 a major cloud provider began billing every public IPv4 address at roughly $0.005 per address-hour. Your estate runs about 2000 instances plus managed databases, load balancers and per-branch preview environments. Roughly what did that add per year, and what should change because of it?

The assumptions, stated

The first move is to stop counting instances. The charge is per address, and addresses and instances are not the same population. In a well-built network most instances sit in private subnets with no public address at all, while several things that are not instances each hold one or several.

So the estimate needs four terms: instances that actually carry a public address, network appliances that carry one per zone, load balancers that carry one per zone they serve, and addresses that are allocated to nothing at all.

The arithmetic

The rate first: \(0.005 per hour times roughly 730 hours is about **\)3.65 per address per month, or about $44 per address per year**.

• Instances in public subnets, or in private subnets where the auto-assign default was never turned off: assume 15% of 2000, so 300
• Managed network address translation gateways, one per zone per network: 3 zones across 8 networks, so 24
• Load balancers with public listeners, at one address per zone: 60 balancers times 3, so 180
• Managed databases with public access mistakenly enabled: 20
• Allocated addresses attached to nothing, left behind by deleted instances and torn-down preview environments: 100

That is roughly 620 addresses, so about $27000 a year, with a defensible range of $10000 to $60000 depending on the network layout.

Which assumption dominates the error

The auto-assign default on subnets, which sets the 300, and the orphan count, which is the term nobody can guess. Both are measurable in an afternoon: list allocated addresses, join to attached resources, and the orphans fall out as the rows with no association. In an estate nobody has swept, orphaned addresses are routinely 10% to 20% of the total, because deleting the thing an address served does not release the address.

What the number rules in and out

It does not justify a network redesign. It does justify three cheap things, in this order: release every unattached address today, turn auto-assign off in the subnet defaults so the problem stops being created, and put a public address on the short list of things a preview environment must not allocate. A recurring cost created by a default is fixed by changing the default, not by a clean-up rota, because a clean-up rota decays and a default does not.

The charge also reprices two design habits: giving every node a public address for convenience, and treating ephemeral environments as free. It turns address-family choice into a cost argument as well as a scarcity one, since 2024 pricing means a private-only network is cheaper as well as safer.

When this is the wrong answer

On a fleet of 40 instances the whole line is about $2000 a year and the estimate is not worth a week. The sweep is still worth an hour. Also check what sits behind the gateways before celebrating: a managed address-translation gateway bills per gigabyte processed as well as per hour, and on a chatty estate that per-gigabyte term is usually the larger of the two, so the address charge can be the smaller half of the line you are looking at.

Common weak answers

• "2000 instances times $44, so $88000." Wrong denominator. It counts instances that have no public address and misses balancers, gateways and orphans, and it is wrong in both directions.
• "Move everything to the newer address family." Many third-party endpoints and partner networks were still v4-only in 2026, so a v6-only subnet needs a translation path that has its own per-gigabyte charge. Do it where the traffic is internal and you control both ends.
• "Set a budget alert." Billing data lags by a day or more and this cost arrives evenly all month, so an alert tells you about money already spent. The control here is preventive.