Subtitle: Security and frugality are usually framed as a tradeoff. Designed well, they align.

---

A persistent myth in cloud engineering is that security costs money — that the secure architecture is always the expensive one. In my experience the opposite is often true: the well-designed secure architecture is frequently the cheaper one, because good security design is fundamentally about removing things — removing standing credentials, removing always-on components, removing redundant resources.

Here are the decisions from a recent client engagement where security and cost optimization pointed the same direction.

1. Eliminating credentials eliminates credential infrastructure

Workload identity federation (OIDC) doesn’t just remove the risk of stored credentials — it removes the infrastructure around them: rotation systems, secret-management overhead, the operational cost of auditing who has which key. The most secure option here was also the one with the least to run and maintain.

2. On-demand over provisioned, where load is bursty

The state-locking layer uses DynamoDB. State locking is extremely low-volume — a few operations per deployment. I billed it on-demand (pay-per-request) rather than provisioning capacity. For a workload that’s idle most of the time, on-demand is dramatically cheaper than reserved throughput, with no security tradeoff whatsoever. Match the billing model to the actual access pattern.

3. Native features over bolt-on tooling

For state-bucket integrity I used S3’s built-in versioning and native encryption rather than a third-party backup or encryption layer. Built-in features carry no additional licensing or compute cost and are maintained by the platform. The secure default was the free default.

4. Account-level keys before per-resource sprawl

Encryption keys cost money per key. I started with one well-governed account-level customer-managed key with rotation enabled, rather than minting keys per resource prematurely. You scale to finer-grained keys (per-tenant, per-service) when the isolation requirement justifies the cost — not by default. Right-sizing the key strategy to the actual isolation need keeps both the security posture and the bill sensible.

5. Retention policies that prevent expensive mistakes

The state buckets and lock tables carry a Retain deletion policy. This costs nothing and prevents the single most expensive failure mode in infrastructure-as-code: accidentally destroying the state that describes your entire environment. Cheap insurance against catastrophic, hard-to-recover loss.

The principle

Good security design removes attack surface. Removing attack surface usually means removing components. Fewer components cost less. The framing of “security vs cost” assumes security means adding protective layers — but the strongest security moves are often subtractive, and subtraction is cheap.

The expensive security architecture is usually the badly-designed one, where every risk got a new tool bolted on. The cheap one is where the risks were designed out.

---

---

---