Cloud security services are priced in very different units: AWS IAM costs nothing, Microsoft Entra ID P1 and P2 are licences per user, customer identities cost per monthly active user, keys per key and request, and detection services such as Amazon GuardDuty or Microsoft Defender for Cloud by events analysed or resources protected. On the bill, security therefore grows with the estate it protects, and a service switched on once charges for every new resource automatically.
How it works
The services fall into four groups with their own pricing logic, and each free allowance applies to the unit the provider sets: account, subscription, project or billing account.
Identities
AWS IAM carries no charge. Microsoft Entra ID Free comes with Microsoft cloud subscriptions such as Azure; P1 and P2 cost per user per month, paid yearly, and are part of some Microsoft 365 plans. For customer identities all three providers charge per monthly active user (MAU). Amazon Cognito has the tiers Lite, Essentials and Plus, with 10,000 free MAU for Lite and Essentials (50,000 for pools created by 2024-11-22), only 50 for sign-ins through SAML or OpenID Connect, and no free allowance for Plus or for machine-to-machine token requests. Microsoft Entra External ID includes the first 50,000 MAU in its Basic tier, and Google Identity Platform likewise 50,000 for email and social sign-in, but only 50 for SAML and OpenID Connect.
Keys and secrets
AWS KMS charges each key you create per month, and the first two rotations raise that price; AWS managed keys cost nothing, but requests to them do. Requests cost per 10,000, with 20,000 free per month, and the account making the request pays. AWS Secrets Manager costs per secret per month, each replica counting as its own secret, plus API calls. Azure Key Vault bills operations per 10,000 transactions and HSM-protected keys additionally per key per month, with every version counted separately if used in the last 30 days. Google Cloud KMS bills every active key version, including disabled ones and those scheduled for destruction, plus operations.
Threat detection and posture
Amazon GuardDuty charges by volume analysed: CloudTrail events per million, VPC Flow Logs and DNS logs per GB, with protection plans such as S3 Protection on top. AWS Security Hub's Essentials plan costs per resource unit per month; an EC2 instance is one unit, while Lambda functions, container images and IAM roles count as fractions. Security Hub CSPM keeps its standard pricing in accounts where Security Hub is not enabled. In Microsoft Defender for Cloud, Foundational CSPM is free, Defender CSPM costs per billable resource, and the protection plans cost per server, database instance, storage account or subscription. Google Security Command Center is free in its Standard tier; Premium comes as a subscription or pay-as-you-go per vCPU-hour of the protected services, and Enterprise only as a subscription.
Web application firewalls
AWS WAF costs per web ACL, rule and million requests. Azure Web Application Firewall on Application Gateway costs per gateway-hour plus capacity units and is included in Azure Front Door Premium. Google Cloud Armor Standard costs per security policy, rule and million requests, and Cloud Armor Enterprise is a subscription plus a data processing fee per GiB.
| Service type | AWS | Azure | Google Cloud |
|---|---|---|---|
| Customer identities | Cognito per MAU, 10,000 free | Entra External ID per MAU, 50,000 free | Identity Platform per MAU, 50,000 free |
| Keys | KMS per key and request | Key Vault per transaction, HSM keys per month | Cloud KMS per key version and operation |
| Threat detection | GuardDuty per event and GB | Defender plans per resource | Security Command Center Premium per vCPU-hour |
| Posture | Security Hub per resource unit | Foundational CSPM free, Defender CSPM per resource | Security Command Center Standard free |
| Web application firewall | per web ACL, rule, request | per gateway-hour and capacity unit | per policy, rule, request |
What it means for your cost
Security services scale with everyone else's estate; Defender for Cloud, for one, enrols all resources in its plans automatically once enabled. Where the cost lands depends on the service. Security Hub bills in each account where it is enabled, KMS requests in the requesting account, Security Command Center Premium pay-as-you-go at organisation level to the billing accounts of the projects, and Cloud Armor Enterprise Annual to the billing account holding the subscription (Billing accounts and hierarchies).
Because a security service protects every team, it is usually shared cost. For cost allocation, the provider's own billing units work as keys: servers protected, resource units, GB analysed (Shared cost and how to split it). Security also produces logs: Microsoft Sentinel bills through the Log Analytics workspace and AWS WAF logs are vended logs, both covered in Observability: logs, metrics and traces.
Per-user licences such as Entra ID P1 follow the number of licensed users, not usage; how licences enter cloud prices elsewhere is shown in Licences in the cloud. Anyone keeping their own keys or weighing a European sovereign cloud finds the offerings in Sovereign offerings of the hyperscalers.
Where it goes wrong
- Defender plans on new resources. Symptom: the Defender line grows with every new VM and storage account. Cause: an enabled plan enrols new resources automatically unless someone excludes them.
- Key versions, not keys. Symptom: key costs rise while the number of keys stays flat. Cause: rotation creates versions; Cloud KMS bills every active version, Key Vault counts every version of an HSM key used in the last 30 days, and AWS KMS raises the price on the first two rotations.
- Moving to Security Hub. Symptom: GuardDuty and Inspector lines shrink or disappear, Security Hub lines appear, and the month-on-month comparison breaks. Cause: once Security Hub is enabled, the capabilities it includes are billed through its consolidated pricing.
- GuardDuty follows traffic. Symptom: the GuardDuty line rises with network volume. Cause: flow logs and DNS logs are analysed per GB; only instances with an active Runtime Monitoring agent drop the flow log charge.
- Federated customer accounts. Symptom: Cognito costs money despite few users. Cause: SAML and OpenID Connect sign-ins have only 50 free MAU, and machine-to-machine token requests have no free allowance.
Example
List prices in USD, read on 2026-10-16: AWS Secrets Manager in Europe (Frankfurt) USD 0.40 per secret per month; AWS KMS USD 1 per key per month as the pricing page states; Microsoft Defender for Cloud in Germany West Central USD 5.11 per billable resource per month for Defender CSPM and USD 4.906 per server per month for Defender for Servers Plan 1; Microsoft Entra ID P1 USD 7.00 per user per month, paid yearly, on the US price list.
Sources
Read on 2026-10-16. AWS IAM FAQs, Amazon Cognito pricing, AWS KMS pricing, AWS Secrets Manager pricing, Amazon GuardDuty pricing, AWS Security Hub pricing, AWS WAF pricing, Microsoft Entra pricing, Microsoft Entra External ID pricing, Azure Key Vault pricing, Microsoft Defender for Cloud pricing, Azure Web Application Firewall pricing, Google Identity Platform pricing, Cloud KMS pricing, Security Command Center pricing, Google Cloud Armor pricing.