Infrastructure IaaS — professional stack.
For each requirement below, pick the option that fits your build — recommended first, then free and cheaper alternatives — or skip what your project doesn't need. Tap the info icon next to any requirement to see why it matters.
Compute VM Platform (Hypervisor / VM Provider)
Where your code actually runs and serves requests. Picking the right host affects speed, scaling, and how much ops work you do.Pricing & free-tier limitsAWS Free Tier: 750 hrs t2/t3.micro 12 months. After: t3.micro $0.0104/hr (~$7.60/mo), t3.small $0.0208/hr (~$15.18/mo), t3.medium $0.0416/hr (~$30.36/mo), m6i.large $0.096/hr (~$70/mo). GCP e2-micro: 1 VM always-free (0.25 vCPU avg) + 30GB disk + 1GB egress, after e2-micro $0.00705/hr (~$5.15/mo). Hetzner CX11 $4.15/mo (20GB disk, 20TB traffic), CX22 $7.25/mo, CCX33 $0.11/hr. Oracle Always Free: 2x AMD micro + 4x Ampere A1. Overage: AWS egress 100GB free then $0.09/GB, Hetzner 20TB included $1.19/TB over.
Block Storage / VM Disks (EBS/Persistent Disk equivalent)
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsAWS gp3 $0.08/GB-mo + 3000 IOPS & 125MB/s free baseline, addtl IOPS $0.005/prov IOPS-mo over 3000, throughput $0.04/MBps-mo over 125. Snapshot $0.05/GB-mo std / $0.0125 archive. Free 30GB 12mo + 1M snapshots. GCP Std $0.04/GB-mo, Balanced $0.10/GB-mo, Extreme $0.125/GB-mo. Snapshot $0.05/GB-mo std. Hetzner Volume $0.0432/GB-mo (3600 IOPS). Over: 500GB gp3 = $40/mo + IOPS.
Object Storage for VM Images, ISOs & Backup Artifacts
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsS3: $0.023/GB-mo first 50TB, $0.022 50-500TB. PUT $0.005/1k, GET $0.0004/1k. Egress $0.09/GB first 10TB. Free: 5GB std 12mo + 20k GET, 2k PUT. R2 Free: 10GB storage, 10M Class A, 10M Class B, zero egress fees. After: $0.015/GB-mo storage, $4.50/M Class A, $0.36/M Class B. B2: Free 10GB storage + 1GB egress/day + 2500 Class B/day, after $0.006/GB-mo storage + $0.01/GB egress + $0.005/1k Class B. Wasabi 1TB min $6.99 no egress.
VPC Networking / Software-Defined Network (SDN)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsVPC creation $0 free. Limits: 5 VPCs/region soft default (up to 1000 on request), 500 subnets, 1000 routes. Flow Logs to S3 $0 free enable + storage $0.023/GB; to CloudWatch $0.50/GB ingested. VPC Peering $0.01/GB intra-region inter-AZ both directions, $0.02/GB cross-region US. GCP: ingress free, inter-zone $0.01/GB, internet egress $0.12/GB first TB. Overage: NAT, LB separate costs.
Load Balancer (L4 TCP/UDP + L7 HTTP/HTTPS for VM Pools)
Encrypts traffic between your users and your servers. Without it browsers flag your site as insecure and you lose trust and search ranking.Pricing & free-tier limitsAWS ALB Free: 750hrs + 15 LCU-hrs + 750 new connections 12mo. After: $0.0225/hr (~$16.43/mo per ALB) + LCU $0.008/hr (LCU = 25 new conn/s, 3000 active, 1GB/hr processed, 1000 rule eval/s). NLB: $0.0225/hr + $0.006/NLCU-hr (800 new flows, 100k active, 1GB). 1TB processed ALB ~ $24. Cloudflare LB Free 1 LB, $5/mo per addtl LB, 500k queries included then $5/500k. Hetzner LB $5.83/mo includes 20TB? Actually 2TB LB traffic $1.19/TB over.
SSH Bastion / Privileged Access Management (PAM)
Controls who can do what inside your admin tooling. Limits blast radius if an account is compromised.Pricing & free-tier limitsTeleport Community Free self-host cost ~$10/mo VM. Cloud Team $12/user/mo minimum 5 users $720/yr, includes Device Trust. Enterprise $21/user/mo + $2 per 10k session events. Tailscale Free: 3 users, 100 devices, unlimited data, 1 subnet router. Premium $6/user/mo after. AWS SSM Session Manager Free, logs to S3 $0.023/GB + CloudWatch $0.50/GB ingested. Boundary OSS free self-host ~$15/mo.
Infrastructure Monitoring & Host Metrics (CPU/Mem/Disk/Net)
Tells you when things break and why. You cannot fix what you cannot see — this is how you keep downtime short.Pricing & free-tier limitsGrafana Free: 10k series, 50GB logs, 50GB traces, 14d retention, 3 users. After Pro $8/user/mo + $8/1k series over 10k + $0.50/GB logs over 50GB, $0.50/GB traces over. Prometheus self-host EBS $0.08/GB-mo storage ~$8/mo per 100GB retention. Datadog: 14-day free trial, then Pro $15/host/mo includes 35d metrics, 150 custom metrics/host free then $0.05/metric/mo. Enterprise $23/host/mo. 100 hosts = $1500/mo.
Secrets Management for Infrastructure (Keys, Certs, API tokens)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsVault OSS free unlimited secrets, host $5-10/mo. HCP Vault Dedicated: $0.035/hr dev (~$25/mo), $0.065/hr small, $0.15/hr med. Storage $0.10/GB-mo. AWS Secrets: $0.40/secret/mo + $0.05/10k calls. Free 30-day? None. Example: 100 secrets, 1M calls/mo = $40 + $5 = $45/mo. GCP Secret Manager: Free 6 secrets active, then $0.06/secret/mo + $0.03/10k accesses. Over: 10k additional ops ~$0.03.
Backup for VMs / Disk Snapshots & Lifecycle Policies
Copies of your data so a bug, hack, or outage doesn’t become permanent loss. Cheap insurance every serious project needs.Pricing & free-tier limitsAWS Backup: Warm $0.05/GB-mo, cold $0.01/GB-mo, restore $0.02/GB. EBS Snapshots std $0.05/GB-mo, archive $0.0125/GB-mo. Free: 10GB backup storage free first month. Hetzner Auto Backup 20% of VM price (CX11 $0.83/mo backup). Snapshot $0.011/GB-mo (100GB = $1.10/mo). Veeam Community Free 10 instances unlimited repos. After VUL license $15/VM/mo billed annually min 10 pack $150/mo. Restores free.
Autoscaling / Managed Instance Groups (MIG/VMSS)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsASG management $0 free. Cost is underlying compute: e.g., 10x t3.medium on-demand $0.0416/hr = $303/mo, spot $0.0124/hr = $90/mo (70% save). GCP MIG autoscaler free. Azure VMSS free. Spot.io charges 20% of spot savings: if you save $210/mo, they charge $42. AWS Auto Scaling Plans free. No overage beyond compute. Predictive scaling free. Scheduled scaling free.
DNS Management for Infrastructure (Internal + External Zones)
Your human-readable address on the web plus the DNS records that point it at your servers. Skipping this is not an option — users need a domain to reach you.Pricing & free-tier limitsCloudflare Free unlimited DNS queries, no charge, 1 sec propagation. Route53: $0.50 per hosted zone/mo first 25, $0.10/25 after? Actually $0.50 first 25, $0.10/1k extra? No: $0.50 up to 25, then $0.10? Standard says $0.50/zone/mo. Queries $0.40/M std (first 1B), $0.20/M after 1B. Latency/Geo $0.70/M. Health checks $0.50/check/mo first 50 free. Free tier: 1 hosted zone + 1M queries/mo 12mo. Resolver endpoints: $0.125/hr (~$91/mo per 2 endpoints per AZ) + $0.45/M queries.
Firewall / Security Groups & Network ACLs
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsSecurity Groups free, 60 inbound + 60 outbound rules per ENI default. Network ACLs free. AWS Network Firewall: Endpoint $0.395/hr per AZ = $288/mo per AZ, data $0.065/GB processed, rules: stateless $0.03/hr per rule group. Free tier none. Example: 2 AZ $576/mo + 1TB $65 = $641/mo. Palo Alto BYOL $4000/yr license + instance cost. pfSense CE free self-host $5/mo VM.
NAT Gateway / Egress Gateway for Private Subnets
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsAWS NAT Gateway: No free tier. $0.045/hr per gateway per AZ = $32.85/mo, data processing $0.045/GB. Example 2 AZ HA = $65.70/mo + 500GB egress = $22.50 = $88.20/mo. Self-host NAT: t3.nano $0.0052/hr (~$3.80/mo) + EC2 data transfer $0.09/GB + AZ data $0.01/GB. 500GB = $45 + $3.80 = $48.80/mo saving 45%. GCP Cloud NAT: $0.045/hr + $0.045/GB + $0.044/hr for 32-64 VMs. 500GB = $32.85 + $22.50 = $55.35/mo.
VPN Gateway / Private Network Access (Site-to-Site & Client)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsWireGuard self-host free, host CX11 $4.15/mo. Tailscale Free 3 users, 100 devices, 1 subnet, 10M exit node bandwidth. Personal Pro $6/user/mo billed monthly (5 users $30/mo) + 5x subnets. AWS Client VPN: $0.10/hr assoc = $72/mo per AZ + $0.05/hr per connection (24/7 user $36/mo). 10 concurrent users = $360/mo + $72 = $432/mo. GCP HA VPN $0.0625/hr (IPSec 2 tunnels) = $45.62/mo + $0.01/GB egress. Over: Data transfer $0.01-0.09/GB.
Golden Image Builder / VM Template Factory (Packer)
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsPacker OSS free unlimited builds. HCP Packer Free: 1 registry, 5 buckets, 15 image versions retention, 500 channel requests/day. Plus $0.10/image version/mo storage + $1/1000 channel requests + base $0? Example 100 images = $10/mo. AWS Image Builder: $0.01 per build minute (60 min build = $0.60) + t3.medium $0.0416/hr build + AMI storage $0.05/GB-mo. Example 10 builds/mo 30 min each = $3 + $2 EC2 + $5 storage = $10/mo. Over: AMI storage $0.05/GB-mo per region.
Configuration Management / Drift Control (Ansible/Puppet)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsAnsible OSS free unlimited nodes. AWX free self-host needs 2vCPU/4GB ~$15/mo VM + PostgreSQL. Red Hat AAP: Starter $10k/yr 100 nodes (~$8.33/node/mo), Standard $50k/yr includes 100 nodes + support ($41.66/node/mo). Puppet Enterprise 100 nodes $12k/yr ($10/node/mo) + $2500/yr support. Over: Control plane cost free OSS, enterprise support per node. Semaphore self-host free.
Centralized Log Aggregation for Hosts (syslog/journald)
Tells you when things break and why. You cannot fix what you cannot see — this is how you keep downtime short.Pricing & free-tier limitsGrafana Cloud Free 50GB logs/mo, 14d retention, 3 users. After Pro $0.50/GB ingested beyond 50GB + $0.50/GB? Actually $0.50/GB logs ingested + retention $0.10/GB-mo for 30d. Loki self-host S3 storage $0.023/GB-mo (500GB = $11.50/mo) + compute 2x t3.small ~$30/mo for ingesters/queriers. Datadog Logs: $0.10/GB ingested after 200GB included in infra host, retention 15d included, 30d $0.02/GB extra. Example 500GB/day Ingest = 15TB/mo = $1500/mo Datadog.
Container Runtime on VMs (For IaaS Add-ons & Agents)
Where your code actually runs and serves requests. Picking the right host affects speed, scaling, and how much ops work you do.Pricing & free-tier limitscontainerd+Docker CE free unlimited. Docker Hub Free: 1 private repo, 200 pulls per 6hrs per IP, retention? After Pro $5/user/mo 5000 pulls/day + 5k private repos. Business $21/user/mo. Mirantis Runtime $150/node/yr. K3s free K8s distro no control plane fee, compute t3.medium $30/mo per node. Managed K8s control plane: EKS $0.10/hr = $72/mo/cluster + EC2 nodes. Overage none for runtime.
Bare Metal Server Provisioning API (Ironic/MAAS)
Where your code actually runs and serves requests. Picking the right host affects speed, scaling, and how much ops work you do.Pricing & free-tier limitsMAAS free self-host needs 2vCPU/8GB $20/mo VM + Postgres. Hetzner Dedicated API free calls, servers AX41 64GB/1TB NVMe ~$70/mo includes 20TB traffic. Equinix c3.small 24c/64GB/2x480GB $0.50/hr = $365/mo 24/7 + $0.05/GB egress over 2TB free. AWS i3en-metal 96c/768GB $6.80/hr = $4968/mo. Free tier: API free, no free hardware. KVM over IP? included free on Hetzner.
Infrastructure as Code Orchestration Platform (IaC Runner)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsOpenTofu free unlimited. Terraform Cloud Free: 500 managed resources, 5 users, 500 runs/mo, 1 concurrent. Team $20/user/mo billed annual min $70/mo includes 1000 resources + $0.50 per extra 100 resources/mo + concurrency $0.05/run-min over. Business $70/user/mo includes SSO, 2 concurrent, 5000 resources, then $0.10/resource over. Self-hosted Atlantis free + t3.small $15/mo + S3 $1/mo.
IP Address Management (IPAM) & Subnet Planning
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsphpIPAM OSS free unlimited IPs, host $5/mo. NetBox self-host free 0-100k IPs, cloud starter $0/100 devices then $500/mo 1k devices. AWS IPAM: Free for inactive? Actually charge for active IPs managed: $0.00027/IP/hr = $0.20/IP/mo. 1000 active IPs = $200/mo. BYOIP $0.000135 = $0.10/IP/mo. VPC auto-assign? Free. Infoblox DDI SaaS $2.5/IP/mo + platform $500/mo. Over: 10k IPs = $2000/mo AWS.
DDoS Protection & Edge Shield for IaaS Front
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsCloudflare Free unlimited unmetered DDoS L3/L4/L7 mitigation, no charge for attack bandwidth. Pro $20/mo zone includes WAF. Shield Standard Free for EIP/ALB/CloudFront. Shield Advanced $3000/mo/org + $0.025/GB CloudFront, $0.05/GB ALB, $0.05/GB EIP over 1TB, plus DRT $50/hr. Magic Transit: Self-Serve $2320/mo 1G clean + $500/Gb over commit, includes 10 prefixes. No free tier beyond. Over: Attack traffic not billed on Cloudflare Free.
Metrics Long-Term Storage & TSDB (Thanos/Mimir)
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsProm OSS self-host storage local EBS $0.08/GB-mo (100GB ~$8/mo). Thanos sidecar free S3 $0.023/GB-mo long-term e.g., 1TB = $23/mo + compute 3x t3.small $45/mo. Mimir OSS free host 3 nodes $45/mo. AMP Managed: Free tier? 5M samples free first 6mo? Then $0.07 per million ingested. Example 100M samples/day = 3B/mo = $210/mo ingestion. Query $0.0007/M samples scanned $10/mo. Grafana Cloud Free 10k series, after Pro $8/1k series ($0.008/series) $800/mo for 100k series.
Identity & IAM for Infrastructure Access (SSO for servers)
How users sign up, log in, and are authorized. Getting roles and access control right early prevents painful rewrites.Pricing & free-tier limitsAWS IAM free no charge for users, groups, policies, roles (5000 IAM users free). Identity Center free first SSO org no charge. Keycloak free self-host $5-15/mo VM. Okta Starter $2/user/mo min $500/mo base includes 1000 MAU? After $2 per extra. JumpCloud Free 10 users 10 devices includes MDM, after Team $11/user/mo ($110/mo for 10). Azure AD Free included with Azure subscription, P1 $6/user/mo adds Conditional Access.
BMC / IPMI / Out-of-Band Hardware Management
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsIPMI/BMC included free with most dedicated servers (Hetzner, OVH, Supermicro). iDRAC Enterprise license $399 one-time per server lifetime, unlocks virtual media + vConsole. iLO Advanced $349 one-time + $80/yr support. OpenBMC free flashing hardware ~$0. PiKVM Raspberry Pi build: Pi Zero $30 + HDMI capture $35 + hardware $60 total one-time. No monthly fee beyond power. Hetzner KVM console free 3hrs/session, over 3hrs? $15/hr technician? Actually LARA free.
Placement Groups / Capacity Reservations / Anti-Affinity
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsPlacement Group management $0. Capacity Reservation billing: pay On-Demand rate for reserved capacity regardless of use. Example t3.small $0.0208/hr = $15.18/mo reserved even if idle. 10x t3.large reservation = $0.094/hr x10 = $0.94/hr = $686/mo capacity cost. Sole-tenant: n2-standard-32 host $1.20/hr ($876/mo) + VM cost $0.80/hr = $2/hr. RI discount: 1yr No Upfront 30% off OD, 3yr 60% off. No free tier for reserved capacity.
Cross-Region Replication for Block/Object Storage
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsS3 CRR: Request $0.005/1k PUT dest (actually $0.02 per 1k replication requests?), transfer US-East to US-West $0.02/GB, storage dest $0.023/GB-mo standard. Example 1TB replication = $20 transfer + $23 storage/mo + $0.40 request cost. No free tier. rclone free software cost only egress: AWS $0.09/GB, Cloudflare R2 $0 egress, B2 $0.01/GB. Litestream free only B2 storage $0.006/GB-mo. GCP inter-region egress $0.01-0.08/GB.
Serial Console / Emergency Shell & Rescue System
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsAll hyperscaler serial consoles $0 free. Enable free. Bandwidth free. Rescue system boot free PXE. Hardware console servers: Opengear $1500-3500 one-time per 48-port, power $5/mo, support $200/yr. Hetzner LARA/KVM over IP free 3hrs/session. No monthly data cost. Over: Physical KVM cost amortized: $3000/36mo = $83/mo.
Network Observability / Flow Logs & Packet Analysis (Basic)
Tells you when things break and why. You cannot fix what you cannot see — this is how you keep downtime short.Pricing & free-tier limitsFlow Logs enable free. Delivery to S3 $0.023/GB-mo (500GB = $11.50/mo) + PUT $0.005/1k. To CloudWatch Logs $0.50/GB ingested = 300GB/mo = $150/mo + storage $0.03/GB-mo ($9). Zeek self-host $15/mo VM can handle 1Gbps. ElastiFlow Free up to 4k fps (approx 2Gbps), Pro $5000/yr $416/mo includes 12k fps. Kentik Free 1B flow records/mo (~500GB NetFlow/mo), after $0.001 per 1k records = $1/M = 10B = $10k/mo.
Cost Allocation, Showback & FinOps for IaaS Budgets
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsCost Explorer free dashboard, CUR to S3 free + storage $0.023/GB (~$1/mo). OpenCost self-host free needs 2vCPU 4GB $20/mo VM. Kubecost Free 1 cluster unlimited nodes, Team $500/mo up to 50 nodes ($10/node/mo), Enterprise $2500/mo. Vantage: Free if <$2.5k cloud spend, then Growth $25/mo base + 0.5% over $5k? Actually $20 per $1k over threshold. Example $50k/mo spend = $1000/mo Vantage? Actually $50k - $5k =45k/1k *20= $900 + base = $925/mo. AWS Budgets free 2 budgets, after $0.02/day/budget.
How this professional infrastructure iaas checklist works.
Each requirement below is something a professional infrastructure iaas build typically needs. Pick one of the four researched options — recommended, free, cheaper or paid — add your own with "Other", or skip the requirement if your project doesn't need it. Nothing is mandatory; the plan on the right tracks what you've decided so nothing gets forgotten.
Your picks are saved in this browser automatically, so you can come back anytime. Options are researched per build level and refreshed as vendors change their plans — always verify details on the provider's page before committing.