Audit Log Service  ·  View 33 of 40  ·  6 · Operations

Cost

Where the money actually goes, and an honest statement that the stated target is not reachable.

Editable source SVG draw.io All views
Capture AKS Ingest $5.0 k / month Kafka + Tiering $7.5 k / month Custody Segments, Primary $4.1 k · 257 TB Replication + DR $4.0 k / month Managed HSM × 2 $4.6 k · fixed Confidential Ledger $2.0 k · fixed Index — the dominant marginal cost ClickHouse · 90 days $5.5 k / month Extend to 13 months + $6.5 k / month Serve and prove Trino Archive $1.5 k · on demand Verify + Export $1.5 k / month Shared Services $3.0 k / month Per million events retained 13 months Achieved $0.65 per million Fixed Floor $0.24 per million Target $0.09 7× short — see cards Cost — Where the Money Goes, and Where the Target Does Not Reach Application we own Queue / topic Data store Security / platform Opportunity Decision point Risk / gap 66 billion events a month at $42.7 k gives $0.65 per million. The stated $0.09 target implies $5.9 k a month, which the segment store alone consumes before a single core is switched on. The number to renegotiate is the target, and the cards say what could move it. v 1.0 · owner Data & AI Global Practice · date 2026-09

The finding

  • The requirement's target of $0.09 per million events, all-in for 13 months, implies a total spend of about $5.9 k a month at 66 billion events a month. The segment store alone consumes roughly $4.1 k of that before a single core is switched on, and the cross-region replication the same requirement mandates consumes the rest.
  • The defensible figure for this design is about $0.65 per million with a 90-day index and about $0.75 with a full 13-month index — roughly seven to eight times the target.
  • Recommendation: renegotiate the target rather than the architecture. Every property that could be dropped to approach $0.09 — DR, HSM-backed signing, the separately administered ledger — is a property the requirement asks for by name elsewhere.

The arithmetic

  • Capture $12.5 k · Custody $14.7 k · Index $5.5 k (90 d) · Serve and prove $6.0 k ≈ $42.7 k a month, over 66,000 million events.
  • A fixed floor of about $15.6 k a month — Managed HSM in two regions, the Confidential Ledger, PostgreSQL, observability and a minimum broker and cluster footprint — does not scale down with volume. At this volume that floor alone is $0.24 per million.
  • The index is the dominant marginal cost, which is why its window is tunable per tenant independently of retention. Moving the default from 13 months to 90 days saves about $6.5 k a month for a query-path change most tenants will never notice.

Levers, in order of value

  • Per-tenant index window, defaulting to 90 days (largest single saving).
  • Chain-preserving compaction of small segments, which cuts both storage transactions and the small-object tail.
  • Charging query cost to the querying tenant with a per-role budget, which stops the unbounded 13-month scan being someone else's problem.
  • Archive tiering from 13 months, worth roughly $2 per TB-month against $10 in cool storage.
◀  Observability All views The Operator's Loop  ▶
Solution Architecture v1.0 · Data & AI Global Practice · 2026-09 · 40 views · Microsoft Azure and open source33-cost-model