Short, sourced notes on cloud-exit economics and running boring, predictable infrastructure. These days I write occasionally at amiheines.com — you can reach me there.
Grab the free checklist — the one-page guide to stopping a surprise cloud bill →
The candy bar that's 10% smaller for the same price has a cloud cousin, and I got the email for it recently. Your Android device backups — SMS, call history, device and app settings — now count against your 15GB of free Google storage, the way photos already do. The price of 'free' didn't move. The 15GB didn't move. What fits inside it did. Google says the average hit is about 40MB, which is almost nothing — and that's exactly why it's worth watching. It's the mechanism, not the megabytes: one 'this now counts' at a time, the free tier quietly shrinks and the upgrade button quietly gets closer.
More than half of all web traffic is automated now, and your analytics can't see any of it — bots don't run JavaScript. The honest math: egress is a rounding error, but dynamic page renders, autoscaling, per-request WAF fees and log ingestion are not. Cloudflare measured Anthropic's crawler making about 70,900 page requests for every visitor it sent back. Here's how to read your logs and decide which bots to keep.
Tesco bought perpetual VMware licenses in 2021. In 2026 it is moving 40,000 workloads off VMware and suing Broadcom for over £100 million. It had the paperwork, the renewal options, and the lawyers — and it is still migrating until the end of 2027, because none of that was leverage. The 40,000 workloads were. Your exit cost is your real negotiating position, and unlike Tesco's, yours is small enough to keep that way.
Three times now — cloud, SaaS, and AI — the industry has treated how much you spend as proof you're serious. It's the vendor's favorite metric, and it's the wrong one. Here's why the pattern repeats, and the number to watch instead.
The most-upvoted answer in every 'on-prem vs cloud' thread is also the sharpest: you don't move to the cloud to save money — so for a steady, predictable workload, owning (or renting flat) almost always wins. Here's the honest math, when the cloud still wins, and why the real objection isn't the hardware.
Every 'add an AI feature' tutorial tells you to spin up a vector database on step one — a new managed service, a new monthly bill, a new thing to run and secure. For a job the Postgres you already have does just as well. Here's the proof: a tiny open-source demo doing retrieval over my own 50 posts, entirely on Postgres with pgvector — plus the honest line on when you'd actually need a dedicated one.
A small law firm kept getting the same nag from Google: your 100 GB is almost full — upgrade or free up space. Instead of paying more every year, we moved the cold half of their Drive and Gmail to a read-only archive on a disk in their own office, deleted the old stuff from Google, and stopped the creep. Here's the whole build — including the file-server migration detail that nearly forced a password reset on everyone, and the bcrypt trick that saved it.
The whole series was the playbook; this is how I run it against a real feature in a few hours. Seven questions asked most-dangerous-first — can I see the meter, is there a ceiling, is it on the request path, where's the key, who's calling, what can the model do, what happens when it trips — each with the red flag that means fail-open. The output is a one-page map, not a 40-page report.
Agents are being handed credentials, and the whole cost conversation is still about tokens. But an agent optimizing for an answer will scan the warehouse, re-read the bucket, and start the job again — every one of those is a meter your token cap can't see. The reasoning is billed in tokens; the consequences are billed in AWS. The brake doesn't go in the prompt. It goes in the credential.
Two weeks of posts described one thing: a gateway that meters every AI call, caps the spend, and cuts a runaway agent mid-run. Talk is cheap, so I built the minimal version in the open and put it in front of a deliberately broken agent. Watch it stop the exact 'looped-all-weekend' bill in three failed calls — while a legitimate long task next to it runs untouched. Live demo, open-source code, honest scope.
Every 'should I leave the cloud?' thread fills with the same objections: who patches it, the 2am disk swap, single point of failure, no redundancy, expensive staff. They're all correct — about self-hosting in a closet. But they assume a false binary. Here's each objection answered straight, and the third option they skip: flat-rate managed infrastructure.
The free trial credit, the cloud startup program, the promotional GenAI grant — they make AI feel almost free, right up until the day they don't. When the credit ends, the bill doesn't spike; the discount just disappears, and you meet the real number all at once. How to see it coming, model the real cost now, and not get caught.
For a decade, cloud got cheaper every year. That era is over. The same AI buildout running up your token bill is pushing up the price of all infrastructure — hardware has spiked, and the hyperscalers now have hundreds of billions in AI capex to recoup. Cloud prices are heading up, not down. That makes controlling the cloud meter and capping AI spend the same, newly-urgent job.
A developer woke up to a massive API bill: their LangGraph agent spent the weekend looping on a broken tool. Every reply reached for a static cap — recursion limit, token budget, turn budget — and every one of them just delays the same burn. The fix isn't a bigger number. It's a failure-aware breaker that can tell a stuck loop from a long, legitimate task, hashing the tool-call signature and cutting the one call that keeps failing.
When you run AI through a cloud provider instead of calling OpenAI directly, the cost hides differently — buried in the same bill as your servers, under its own line items, with cost drivers the direct APIs don't even have. If your Bedrock, Vertex, or Azure OpenAI spend just spiked, here's where to look and the traps unique to the cloud-hosted path.
The org problem behind every AI cost blowout: a team already too stretched to review its cloud spend just shipped an AI feature — a third unowned meter that moves faster and can be abused. The caps and gateways don't build themselves. Someone has to own it.
Day 15 of the AI cost + safety playbook — the capstone. Two weeks of controls assemble into one thing: a single gateway every LLM call passes through that is authed, metered, capped, rate-limited, cached, guarded, and defaults to closed. The reference architecture, how to build it without writing it all from scratch (LiteLLM/Portkey/Cloudflare + your own layers), and what 'fail closed' means as a whole system.
A folk tale about a miller who tied his livelihood to a spring that was billed by the drop — and the night a stranger ran the meter dry while he slept. It's the oldest lesson in the newest bill: 'managed' and 'solid ground' don't mean 'fixed price.' What a Denial-of-Wallet is in plain English, why a managed AI service doesn't cap your spend by default, and the one lock that makes the meter fail closed.
Day 13 of the AI cost + safety playbook. Every control in this series — caps, quotas, per-user rate limits, attribution — assumes you know who's calling. That's auth. An LLM route spends money and can be abused, yet teams ship it with less authentication than a CRUD endpoint. Treat it like a payment endpoint: authenticate the caller, key policy off identity, issue your own revocable tokens.
Not every AI cost problem is a dramatic runaway. Often the bill just crept up 3× this month and nobody can say why. Before you guess, read the meter. A 15-minute walkthrough to find the driver — by model, by key, by day, by the token dial nobody watches — and the one change that stops next month being another mystery.
Day 12 of the AI cost + safety playbook. You already rate-limit APIs by requests per minute. LLM routes need the same discipline on a different unit: tokens, not requests — because one request can cost 200 tokens or 200,000. The token-aware controls (TPM per user, per-call max_tokens, concurrency), why you meter after the fact, and the belt-and-braces that bounds the overshoot.
Day 11 of the AI cost + safety playbook, opening the security-base module. The fastest way to a five-figure AI bill isn't a clever attack — it's putting the API key somewhere a stranger can read it. Where LLM keys leak (client code, repos, git history, logs, prompts), and the handling discipline — server-side only, scoped, vaulted, rotated, one per app — from someone who's spent 20 years treating credentials as liabilities.
A leaked key, a looping agent, a free-trial credit that ran out mid-month — and now there's an AI bill with a comma in it you never meant to spend. Before you pay it: providers waive first-time accidental and abuse-driven overages more often than you'd think. Here's how to ask — OpenAI, Anthropic, Bedrock, Vertex, Gemini — and the framing that works.
Day 10 of the AI cost + safety playbook, closing the abuse module. The risk here isn't the bill — it's what your bot says. A dealership bot talked into a '$1, legally binding' car; an airline held liable for a refund its chatbot invented; a delivery bot swearing at customers. Why 'the AI said it, not us' doesn't hold, and the output guardrails that keep a jailbroken bot from committing you to anything.
AI cost is almost never spread evenly. A handful of users — sometimes one — drives most of the spend, and the monthly average hides them completely. Here's how to find the heavy users in 15 minutes, tell the difference between a power user, an abuser, and a bug, and cap each one without punishing everyone else.
Day 9 of the AI cost + safety playbook. Not every abuser wants to hijack your bot — some just want free inference. Put an LLM behind a lightly-guarded endpoint and you've published a free ChatGPT proxy on your bill. How people find it, why it's a cost AND an account-ban risk, and the auth + quota + topic-lock defenses that actually box it — with the honest note on which of those are real boundaries and which are just speed bumps.
Plenty of AI features are quietly unprofitable — the model call costs more than the user pays for what it does, and volume makes it worse, not better. Before you scale it, run the unit-economics check: what one use actually costs you, what it earns, and the three fixes when the number is upside down.
Day 8 of the AI cost + safety playbook. Direct injection needs the attacker to be your user. Indirect injection doesn't — the malicious instructions ride in on a web page, a PDF, a support ticket, or a RAG document your model reads for an innocent user. Why it's worse than Day 7's version, the real attack shapes, and the defenses (least agency, untrusted-content isolation, egress allowlists) that actually help.
Your agent is looping, or a key got abused, and the meter is running as you read this. Don't reach for a playbook — reach for the stop button. The exact order to kill the spend, trace what's calling, cap the account, and preserve the evidence you'll need to get it waived. Then the fix so it can't happen twice.
Day 7 of the AI cost + safety playbook. The #1 risk on the OWASP list, shown by breaking a demo I built. Why direct prompt injection works — the model has no boundary between your instructions and the user's text — why 'just tell it not to' isn't a fix, and the defense-in-depth that actually shrinks the blast radius. Learning in public: including that this one has no clean solution.
The scariest AI bill isn't a clever attack — it's a valid key someone found and used. A leaked key walks past every cap and gate you built, because to your system it looks like you. Here's a 10-minute self-check: the seven places AI keys leak, how to look in each, and exactly what to do the moment you find one.
Day 6 of the AI cost + safety playbook, and the start of the abuse module. The OWASP Top 10 for LLM Applications is the field's shared checklist — but it's written for security people. Here's each of the ten risks in plain language, the real incident that shows it, and the one control that helps — plus the four that actually bite a small team first.
Day 5 of the AI cost + safety playbook. The caps from Day 4 stop the runaway; now we lower the number you're capping. Four levers, all at the gateway: response caching, provider-side prompt caching, cheap-model routing, and batching — plus the honest caveats (cache invalidation, personalization leaks, quality drift) and the measurement discipline that lets you actually claim a number.
Everyone repeats that Infrastructure-as-Code makes you provider-agnostic. It doesn't — an AWS config isn't a Hetzner config with one variable flipped. Here's what Terraform actually buys a cloud-exit strategy, the layer above it that's genuinely portable, why I'm learning OpenTofu (not Terraform) and pairing it with Ansible, and where Pulumi fits. A developer-to-developer walkthrough.
Monthly budgets and rate limits miss the failure that actually empties the wallet: one agent run stuck in a loop, paying full price for the same broken call all weekend. Here is a per-run, failure-aware circuit breaker built as a LiteLLM plugin — it cuts a stuck run on the request path (identical call twice, error twice, or over its session budget), verified live against a local model.
The recurring wisdom in every self-hosting thread isn't ideological — it's 'I host everything myself, except email and DNS.' That carve-out is the whole framework. Here's the honest per-service decision: move the things whose cost scales with your success, keep managed the things that are cheap to rent and painful to run.
A local open model for the boring bulk, the frontier API only for the hard 20% — one Reddit user calls it the 'turbo model.' It can cut an AI bill by ~90%. But the cost doesn't vanish; it moves from a per-token meter to fixed hardware, power, and your own time. Here's the real hardware cost, the break-even, and the three hidden charges that decide whether it actually saves you money.
The highest-leverage AI cost lever isn't caching or a cheaper model — it's not making the call at all. A sharp point from a SaaS-founder thread: people lazily use an LLM to DO tasks they should use an LLM to WRITE CODE to do. Doing the task is recurring metered compute; writing the code once is a capital investment that then runs for free. Here's when to reach for which.
During the MVP the AI bill looks harmless. Then the product works, usage grows, and the same prompts run millions of times. A SaaS-founder thread named the exact culprit: routing deterministic, repeatable jobs — extraction, classification, normalization — through the biggest, priciest models. Here is the list of tasks that quietly detonate, and what to send instead.
The recurring complaint about every cloud cost platform, from the people who actually run them: they give you visibility without the power to execute the fix. A dashboard names the idle box, the untagged sprawl, the open IAM gate — and then leaves them running. The maturity marker isn't a nicer chart; it's remediation. The same lesson the AI per-run breaker teaches, on the cloud side.
A Google Cloud user watched a $50-a-month account bill almost $20,000 in a single day. The 'billing cap' didn't stop it — the threshold rose as the spend rose, the card was charged in chunks, and when the card finally failed the servers kept running. This is not a bug. Cloud billing has no hard cap by design, and here's what actually stops the meter.
A FinOps engineer's question cuts to the core of agent cost control: most of the money a runaway agent burns is spent after the failure signal already fired. A bill-anomaly alert catches it a day late. The fix is a breaker that lives on the request path — at the gateway, per run — not on the invoice.
A developer asks why their GCP $300 trial and a $1,000 GenAI credit won't spend on Claude — and nobody can quite say. That confusion is the real story: free credits and split billing agreements hide what an AI call actually costs, so you're building on a meter you can't read — subsidized by someone else, with the real number deferred to later.
The reason startups run resources 24/7 and eat six-figure bills isn't that engineers are dumb — it's that cloud cost has no owner. One overworked person owns infra, security, on-call, and cost for five teams, and cost is the thing that quietly loses. The fix isn't another dashboard; it's an owner.
Day 4 of an AI cost + safety playbook. The gateway from Day 3 gave us a door; now we bolt on the first control — a global hard spend cap plus per-user quotas. Two different things, and you need both to turn Day 2's fail-open bill into one that fails closed.
Day 3 of an AI cost + safety playbook. Every control in this series — spend caps, quotas, caching, key vaulting, a kill switch — needs one place to live. That place is a gateway: a single proxy every LLM call passes through. It's a pattern you already know, and often a one-line change.
Day 2 of an AI cost + safety playbook. One LLM call is cheap; you go broke when the number of calls — or tokens per call — goes unbounded. Five ways that happens in real systems, each a fail-open default that keeps charging until something breaks.
This site runs self-hosted, cookieless Matomo, not Google Analytics. The reasoning is the same as everything else here: own the thing that matters, and don't rent your independence. What Matomo is and how it's used, an honest comparison to Google Analytics, when "free" Google becomes a liability (EU law, forced migrations, sampling), and the privacy-and-independence philosophy underneath — with the honest caveats about when GA still wins.
Day 1 of an AI cost + safety playbook, in the open. LLM calls are billed per token — input and output priced separately, and output runs 3–5× higher. Here's why, the two dials on every call (how much it says, how much it reads), and the arithmetic worked on real prices.
An LLM API is metered per token, uncapped by default, and fails open — to your wallet. Worse than cloud in three ways: the meter runs faster, the endpoint is built to accept anything from strangers, and your AI can be turned against you. Here's what fail-closed looks like for AI.
Every 'surprise AWS bill' story shares one root cause nobody names: the account has no ceiling. Unlimited postpaid billing is the default, it fails open — to your wallet — and it scales from a student's $1,100 to a funded startup's six-figure weekend. Why the default is reckless, and the fail-closed alternative.
A surprise AWS bill — a resource left running, or a leaked key someone abused — is one of the most common panics in cloud. Here's how to ask AWS to waive a first-time accidental bill (it works more often than you'd think), and the six guardrails that stop it happening again.
The follow-up to the CloudWatch per-scan post: the exact self-hosted setup that replaces it — Grafana + Loki on a flat-rate box where queries are free — with the hardware, a docker-compose to copy, the migration path, and the real savings.
Amazon CloudWatch Logs Insights bills per gigabyte your queries scan, not per gigabyte you store — so an always-on dashboard on auto-refresh quietly becomes a metered query loop that can cost more than the rest of your logging combined. Here's the trap, how to spot it on your bill, and the fix.
Most SaaS teams go hunting for an extra $100k in revenue. At any real scale, that money is usually already in your AWS/Azure/GCP bill as pure waste — across four predictable line items. Here's where it hides and how to find yours in an afternoon.
A SaaS founder's Google Cloud bill jumped from ~$200/month to ~$55,000 in a single billing cycle — one public Firebase API key, abused against the Gemini API. Here's exactly how it happens, how to fight the charge, and the five settings that cap it for good.
Storage and compute have list prices you can shop on. Egress is the line that quietly scales with your success — and it's the one almost nobody budgets for. Here's how to find it on your own bill in five minutes.
I publish honest, sourced breakdowns of cloud-exit economics — egress, storage, monitoring, reliability — and the occasional announcement. Leave your email and I'll let you know when something new goes up.
Double opt-in — you'll get one email to confirm. No spam, unsubscribe anytime. Read by me, never shared.