Cost & Sizing
Prices in USD/month, AWS on-demand, us-east-1 (2026 pricing). No Reserved Instances or Savings Plans applied — you can reduce every number by 30–50% with commitment discounts (see § Optimization playbook). Non-AWS clouds vary ±20% (see § Cross-cloud comparison).
1. Workload assumptions
To make costs concrete, we sized each tier against a specific workload profile. Match your expected load to the closest tier.
| Metric | PoC / Dev | Small prod | Medium prod | Enterprise |
|---|---|---|---|---|
| Concurrent active agents | < 10 | < 100 | ~500 | > 1,000 |
| HTTP requests/sec (peak) | < 1 | ~20 | ~100 | > 500 |
| Temporal workflows started / day | < 100 | ~10k | ~100k | > 500k |
| Guardrails scans / day | < 500 | ~50k | ~500k | > 2M |
| Audit records / day | < 1k | ~50k | ~500k | > 2M |
| Data retention (default) | 7 days | 30 days | 90 days | 1 year+ |
| Peak-to-average ratio | flat | 3× | 5× | 10× |
Concurrent agent = an OpenBox-registered AI agent actively making requests. A single human user may drive multiple concurrent agents (e.g., a research crew of 5 CrewAI agents = 5 concurrent).
Peak-to-average ratio matters because HPA maxReplicas must handle peak — most of the day you're paying for capacity you don't use. Enterprise tier assumes bursty traffic; use spot / autoscale-off-hours for savings.
2. Min cost — bare minimum
Absolute floor to run OpenBox stably on AWS. Below these numbers you're either running PoC (unsupported for real traffic) or you'll fail HA.
Small prod baseline — Temporal Cloud variant (recommended for low-medium volume):
| Component | Sizing | $/month |
|---|---|---|
| EC2 · CPU pool | 1× r7i.xlarge (4 vCPU / 32 GiB) — bin-pack of ~3 vCPU / 12 GiB at min replicas | $193 |
| EC2 · Guardrails NG | 2× c7i.xlarge (4 vCPU / 8 GiB) — HPA min = 2 for HA | $261 |
| EC2 · LLM pool | 1× g5.xlarge (A10G GPU) for LlamaFirewall (optional — save $734/mo by disabling) | $734 |
| EC2 · DB pool | 3× m7a.xlarge — 2 postgres clusters (app + identity) + pack | $348 |
| EKS control plane | 1 cluster | $73 |
| ALB | Internal, ~1 LCU/hr | $22 |
| EBS gp3 | ~180 GiB (100 app + 50 identity + 5 redis + 20 misc) @ $0.08/GiB | $15 |
| NAT Gateway | 1× single-AZ | $98 |
| KMS + S3 | 2 keys + ~1 GiB bundles | $5 |
| Temporal Cloud subscription | Low-tier, ~10k workflows/day | ~$50-100 |
| Total (with GPU) | ≈ $1,800/mo | |
| Total (no GPU — LlamaFirewall disabled) | ≈ $1,050/mo |
What "stable" means at Min:
- HPA
min = 2on hot-path services (guardrails-api, keycloak) — survives single-pod restart - Single-AZ (no multi-AZ redundancy — accept ~99.5% uptime)
- Backup retention 7 days, no cross-region DR
- No CDN / WAF / managed observability
What you're giving up vs Recommended:
- Single-AZ = downtime during AWS AZ outages (rare but real)
- No spot / RI discounts baked in — pure on-demand
- Guardrails NG static (no cluster autoscaler) — pay for 2 nodes 24/7 regardless of load
3. Recommended cost — Openbox baseline
Openbox recommends this tier for any real deployment serving customers. Balances cost, stability, and ops burden.
Small-Medium prod — Temporal Cloud variant, multi-AZ, with RI baseline:
| Component | Sizing | $/month |
|---|---|---|
| EC2 · CPU pool | 2× r7i.xlarge (RI 1-yr no upfront: ~30% off) — spread across 2 AZ | $270 (was $386) |
| EC2 · Guardrails NG | 2× c7i.xlarge (RI) + spot burst up to 4× on demand | $180 + spot burst |
| EC2 · LLM pool | 1× g5.xlarge (RI 1-yr) | $514 (was $734) |
| EC2 · DB pool | RDS Aurora PostgreSQL — db.r6g.large × 2 (writer + reader across AZ) | $370 |
| RDS backups | 7-day PITR + weekly snapshot | $30 |
| ElastiCache Redis | cache.t4g.small (RI) | $40 |
| EKS control plane | 1 cluster | $73 |
| ALB | Multi-AZ, ~2 LCU/hr | $30 |
| EBS gp3 | ~250 GiB total | $20 |
| NAT Gateway | Single-AZ (still cheaper than multi-AZ NAT) OR VPC endpoints for S3/KMS/ECR | $80 |
| KMS + S3 | 3 keys + ~2 GiB bundles + CRR | $10 |
| Temporal Cloud subscription | Standard tier, ~10k-30k workflows/day | ~$100-200 |
| Total | ≈ $1,720/mo |
Why this is Openbox's recommendation:
- Multi-AZ Aurora + read replica = survives single-AZ outage
- RI 1-yr no upfront on baseline EC2 = 30% savings with zero cash upfront
- Managed RDS Aurora = zero DB ops burden vs in-cluster Bitnami PG
- ElastiCache Redis = zero cache ops burden
- VPC endpoints for S3/KMS = kill ~$50/mo NAT data-transfer surprise bills
- Spot for burst on guardrails NG = 60-70% off HPA scale-out costs (accept 2-min interruption tolerance)
4. Max cost — enterprise scale
Full HPA scale-out under sustained peak, multi-region DR, Enterprise-tier support.
Medium-Enterprise — self-hosted Temporal, multi-region, no cost commits:
| Component | Sizing | $/month |
|---|---|---|
| EC2 · CPU pool (primary + DR) | 3× r7i.xlarge primary + 1× DR standby | $772 |
| EC2 · Memory pool (Temporal + ES) | 2× m7i.xlarge primary + 1× DR | $441 |
| EC2 · Guardrails NG | 8× c7i.xlarge (peak HPA) | $1,042 |
| EC2 · LLM pool | 2× g5.xlarge (primary + burst) | $1,468 |
| EC2 · DB pool | RDS Aurora Global DB — 3× db.r6i.2xlarge writer + 2× reader + cross-region replica | $2,800 |
| ElastiCache | Cluster mode + Global Datastore | $250 |
| EKS control plane | 2 clusters (primary + DR) | $146 |
| ALB (× 2 regions) | Multi-AZ, high LCU | $80 |
| EBS gp3 | ~500 GiB primary + 500 GiB DR | $80 |
| NAT Gateway | Multi-AZ (2 primary + 2 DR) | $360 |
| KMS + S3 | Multi-region CMK + S3 CRR | $50 |
| Data transfer | Cross-AZ + cross-region under peak load | $200-500 |
| Total | ||
| + Openbox Enterprise support | 24/7 SLA (TBD by biz) | $20k+ |
At this tier, cost stops being the constraint. Multi-region + Enterprise support drive the bill.
5. Optimization playbook
Applied in order of ROI (highest savings first). Every item has been validated on the Openbox prod reference.
5.1 Commit discounts (30–50% savings)
| Technique | Savings | Trade-off |
|---|---|---|
| Reserved Instances 1-yr no-upfront | 30% off | 1-yr commitment |
| Reserved Instances 3-yr all-upfront | 60% off | 3-yr + cash upfront |
| Savings Plans (Compute) | 30-50% off | Flexible across instance families |
| Reserved Instances for RDS/ElastiCache | 40-60% off | Per-instance commitment |
Recommendation: Apply 1-yr RI to baseline HPA minReplicas — never RI the burst capacity, that defeats the point of HPA.
5.2 Right-size, don't over-provision (10-30% savings)
- Measure real p95 CPU/RAM after 2 weeks of production traffic
- Reduce
resources.requeststo observed p95, keeplimitsat burst headroom (2×) - Do NOT set requests = limits ("Guaranteed" QoS) unless the workload is latency-critical
- Use
vertical-pod-autoscaler(recommendation mode only) to detect over-provisioning
5.3 Graviton (ARM) for CPU-bound services (10-20% savings)
- Switch EC2 instance families:
r7i→r8g,c7i→c8g,m7a→m8g - Requires multi-arch container images — all OpenBox images ship
linux/amd64+linux/arm64(verify withdocker manifest inspect ghcr.io/openbox-ai/openbox-backend:X.Y.Z) - Not applicable to
vllm— requires NVIDIA CUDA, no ARM GPU
5.4 Spot for interruptible workloads (60-70% off)
Safe for spot:
guardrails-api(HPA-managed, tolerates pod eviction; downstream retries)model-host-*(stateless CPU classifiers)- Batch job pods
Never on spot:
identity-service(Keycloak) — session loss on eviction- PostgreSQL / Redis (StatefulSet) — data at risk
openbox-core(Temporal workers — task requeue on eviction OK, but adds latency)
Configure via Karpenter NodePool with karpenter.sh/capacity-type: spot.
5.5 Choose Temporal variant carefully (up to $640/mo delta)
At workload < 100k workflows/day, Temporal Cloud is cheaper. See break-even math in Architecture → Temporal variants. Rule of thumb:
- < 100k workflows/day → Temporal Cloud
- > 500k workflows/day → Self-hosted starts to win
- Between → run both scenarios in a spreadsheet, pick the cheaper
5.6 VPC endpoints for AWS services ($30-100/mo saved)
Configure VPC endpoints (Gateway or Interface) for S3, KMS, ECR, Secrets Manager. Data flowing to these services then bypasses NAT Gateway — saves NAT data-processing fees ($0.045/GB).
For a Small prod, this is typically $30-50/mo saved. At Enterprise, $100-300/mo saved.
5.7 EBS gp3 IOPS tuning (avoid provisioned IOPS surprises)
- gp3 default: 3000 IOPS + 125 MB/s — free with baseline storage
- If Postgres needs > 3000 IOPS: provisioned IOPS $0.005/IOPS/mo — a 6000-IOPS DB adds $15/mo
- Measure with CloudWatch
VolumeReadOps+VolumeWriteOps; only provision extra when latency actually hurts
5.8 CloudWatch retention (avoid the silent bill)
Default log retention is "never expire" in CloudWatch. This is the #1 hidden AWS cost.
- Set retention to 7-14 days for app logs
- Ship long-term logs to S3 (
$0.023/GB/mo) vs CloudWatch ($0.03/GB ingested + $0.03/GB scanned) - Use S3 lifecycle → Glacier for 90+ day archives
5.9 HPA minReplicas tuning
- Non-critical services:
minReplicas: 1(accept cold-start on scale-up) - Critical hot-path (guardrails-api, backend): keep
minReplicas: 2(HA) - Never
minReplicas: 0— Kubernetes HPA doesn't support scale-to-zero for standard Deployments (use KEDA if you need this)
5.10 Off-hours scale-down (~30% savings if you have off-hours)
If your workload is business-hours only (internal enterprise apps):
- Configure Karpenter
NodePool.disruption.consolidateAfter: 5m— nodes go away when unused - Set HPA
minReplicas: 1for non-critical services during nights/weekends - Use
k8s-cron-hpaOR a scheduled CronJob to patch HPA overnight
Not applicable for customer-facing 24/7 services.
6. Cost per scenario
| Scenario | Min (no GPU) | Recommended | Enterprise |
|---|---|---|---|
| S1 Turnkey | ~$1,000 (Openbox absorbs ops) + support fee | ~$1,700 + support | ~$8,000 + Enterprise support |
| S2 Fresh AWS | ~$1,050 (no GPU) or ~$1,800 (with GPU) | ~$1,720 | ~$7,700 |
| S3 BYOC | +$500-1,500 incremental (existing cluster amortized) | Same | Same |
| S8 Local PoC | $0 (laptop) | $0 | Not applicable |
S1 vs S2 cost: infrastructure cost is nearly identical (Openbox provisions the same resources in your account). Difference is who pays for ops burden — S1 factors ~$5-15k/mo Openbox managed-service fee into the total.
7. Cross-cloud comparison
Approximate spread for the Recommended tier (~$1,720/mo on AWS us-east-1):
| Cloud | Equivalent monthly | Notes |
|---|---|---|
| AWS us-east-1 (baseline) | $1,720 | Cheapest AWS region |
| AWS eu-west-1 | +8% (~$1,860) | Europe premium |
| AWS ap-southeast-1 | +12% (~$1,930) | Singapore |
| Azure East US | +10-15% (~$1,900-2,000) | Comparable but Azure DB slightly pricier |
| Google Cloud us-central1 | -8% (~$1,580) | Sustained-use discount lowers baseline |
| On-prem | $30-60k CapEx one-time + $1,500-3,000/mo colo+power | Depreciate hardware over 3-5 yr |
Non-AWS cloud mappings for OpenBox services: Architecture → AWS integration surface → Non-AWS cloud mappings.
8. Openbox-recommended baseline for stable operation
The most-cost-effective config that Openbox recommends for any production customer:
- Tier: Recommended (§3) — ~$1,720/mo
- Temporal variant: Cloud (unless workflow volume > 500k/day)
- Discounts applied: 1-yr RI no-upfront on baseline EC2 + RDS
- Multi-AZ: enabled for Aurora + EKS node group
- Spot: yes, on guardrails-api + model-host-* only
- GPU: enabled (LlamaFirewall on) — full guardrails safety
- VPC endpoints: S3, KMS, ECR (kill NAT bill surprises)
- CloudWatch retention: 14 days app logs, S3 for archives
- HPA minReplicas: 2 on hot-path (guardrails-api, backend, keycloak); 1 elsewhere
- Backup retention: 30 days PITR on Aurora
Result: ~$1,720/mo steady state, scales to ~$3,500/mo under 5× peak via HPA burst. Full 5-nines uptime not guaranteed at this tier — recommend Enterprise (§4) for hard SLA.
9. Hidden costs to warn about
| Cost | Typical range | Mitigation |
|---|---|---|
| Cross-AZ data transfer | $50-500/mo under load | Bin-pack to same AZ where safe |
| NAT Gateway data processing | $50-300/mo | VPC endpoints (§5.6) |
| CloudWatch metrics/logs | $50-500/mo | Retention limits + S3 archive |
| EBS snapshots (daily × 6 volumes) | $30-100/mo | Consolidate to weekly for non-critical |
| ECR storage + pulls | $10-50/mo | Lifecycle policy — prune old tags |
| KMS API calls beyond free tier | $0.03 / 10k requests over 20k/mo | Envelope encryption (DEK cache) |
| Route 53 queries | Usually < $5/mo | Negligible |
| Third-party scanner subs | $500-3k/mo | Trivy OSS free tier for most needs |
10. Not-a-cost list
Openbox does not charge for:
- The Helm chart (Apache 2.0 licensed)
- The Terraform / CloudFormation reference snippets
- Community support via GitHub issues
- llms.txt / product docs
Openbox commercial pricing (SLA support, S1 Turnkey management fee, enterprise license) is out of scope of this docs site — contact sales@openbox.ai.
Read next
- System requirements — sizing details behind the cost numbers
- Customization → Resource limits & HPA — how to tune the values to match your chosen tier
- Choose your scenario — pick the deployment path that fits