Security And Identity — small scale stack.
For each requirement below, pick the option that fits your build — recommended first, then free and cheaper alternatives — or skip what your project doesn't need. Tap the info icon next to any requirement to see why it matters.
Identity Provider (IdP) / SSO & Directory
How users sign up, log in, and are authorized. Getting roles and access control right early prevents painful rewrites.Pricing & free-tier limitsAuth0 Free: 7,500 MAU, 2 social IdPs, unlimited logins. Essentials $35/mo incl 1k MAU + $0.15/MAU overage, B2B SSO $0.25/MAU. Azure AD Free: 50k dir objects free, P1 $6/user/mo, P2 $9/user/mo incl Identity Protection + PIM. Okta: SSO $2/user/mo min 100 users, Adaptive MFA $4/user/mo, Lifecycle $4/user/mo. Overage $2.50/user/mo. WorkOS: Free 1M MAU dev, prod $99/mo per SSO bundle + $0.10/MAU after. Keycloak VM cost $5-20/mo.
Multi-Factor Authentication (MFA) Enforcement
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsAuth0 MFA: TOTP/WebAuthn free, 1k SMS free/yr then $0.05/SMS. Duo Free: 10 users free, Essentials $3/user/mo, Advantage $6/user/mo (risk-based). Okta MFA $4/user/mo incl push + risk engine. Azure MFA free with P1 ($6) / P2 ($9). SMS overage $0.05-0.08/msg, Voice $0.10/verify. Push free unlimited.
Secrets Management (Vault / Parameter Store)
Stores API keys and credentials safely, separate from your code. Leaking secrets is one of the most common breaches.Pricing & free-tier limitsVault OSS: free + VM $10-50/mo. HCP Vault Standard $0.03/hr ~$22/mo + $0.08/secret/mo, Plus $0.10/hr. AWS Secrets: $0.40/secret/mo, $0.05 per 10k API calls, free rotation Lambda (1M invocs free). SSM Standard free 10k, Advanced $0.05/param/mo. Doppler: Free 5 users, Pro $10/user/mo 500 secrets $0.30/secret over. Infisical Free 2 projects, Pro $20/mo 10k secrets.
Key Management Service (KMS) - Encryption Key Lifecycle
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsAWS KMS: $1/mo per customer key, $0.03 per 10k symmetric requests, $0.15 per 10k asymmetric/RSA, free 20k requests for AWS-managed keys. GCP KMS: $1/key version/mo, $0.03/10k ops, $0.12/10k HSM ops. Azure Key Vault: $1/key/mo Standard $0.03/10k ops, Premium $5/key/mo $0.15/10k ops. Overage: $0.03/10k ops. Auto-rotation free.
Hardware Security Module (HSM) / Dedicated Key Protection
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsAWS CloudHSM: $1.88/hr per HSM ~$1,373/mo, HA 2-HSM cluster ~$2,746/mo + $0.50/hr backup + $0.20/GB snapshot. Min 1. No free tier. GCP Cloud HSM: $5/key version/mo HSM-protected + $1/hr HSM provisioning $0.15/10k ops. Azure Managed HSM: $1.45/hr $1,055/mo per HSM pool min 3 HSMs ~$3,165/mo. Thales Luna Cloud: $2.5/hr $1,825/mo + $0.50/GB backup. YubiHSM 2 hardware $650 one-time.
Encryption at Rest (S3/EBS/SSE-KMS)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsS3 SSE-S3 free, 0% overhead. SSE-KMS: $1/key/mo + $0.03/10k KMS requests, adds ~$0.01 per 1k PUT GET overhead. S3 Bucket Keys $1/mo per bucket key reduces calls 99%. EBS encryption free switch, snapshot copy free + KMS cost if customer key $1/mo. GCS default free. No free tier limit as feature free; overage only KMS API $0.03/10k.
Encryption in Transit / TLS Certificate Management
Encrypts traffic between your users and your servers. Without it browsers flag your site as insecure and you lose trust and search ranking.Pricing & free-tier limitsACM Public: free unlimited, auto-renew 13mo. Let's Encrypt free 90d, 50 certs/week/domain, 300 pending auth. Cloudflare Free 15-yr origin cert free. ACM Private CA $400/mo per CA + $0.75 per cert first 1k then $0.35, $0.001 per OCSP. Smallstep $10/mo 100 certs $0.10/cert over. DigiCert OV $250/yr ~$21/mo, EV $600/yr. Private cert overage $0.75 each.
Web Application Firewall (WAF) / Edge Protection
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsCloudflare Free: 1 rule free. Pro $20/mo 20 rules + $5/10k managed req after 10M, $0.50/1k R2? Business $200/mo 100 rules free 10M req. Enterprise $5k/mo custom unlimited + $0.50/M over 100M. AWS WAF: $6/mo WebACL + $1/mo per rule, $1 per 1M requests, Bot Control $10/mo $1 per 1k bot req after 1M, Fraud $10/mo $1/10k fraud eval. Overages $1/1M req.
Threat Detection (GuardDuty / Cloud-native)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsGuardDuty: 30d free, then CloudTrail Mgmt $1.20/1M events (100M-500M $1.00, 500M+ $0.90), VPC Flow $0.30/GB first TB then $0.15, DNS $3.50/GB, S3 $0.20/GB, EKS Audit $1.20/1M. Security Hub CSPM $0.0010/check first 100k $0.0008 after 100k. Defender: Servers $15/server/mo. GCP SCC Premium $10-15/vCPU/mo. Overage $0.30/GB flow, $1.20/M events.
Vulnerability / CSPM / CNAPP (Wiz, Prisma, Orca)
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsWiz: Free 30d POC, then $2,500/mo base for 100 VMs/containers + $0.10/serverless hr overage + $5 per storage bucket extra. Prisma Cloud: $50k/yr base 500 resources ~$4,167/mo + $0.15/resource/mo overage + Compute $10/host/mo over. Orca $2,083/mo 250 assets $8/asset over. Prowler self-host $10/mo VM free scanning unlimited. Commercial overage $5-10/resource/mo.
SIEM / Security Log Lake & Data Lake
Tells you when things break and why. You cannot fix what you cannot see — this is how you keep downtime short.Pricing & free-tier limitsPanther Free 500GB/mo ingest + 90d retention, then $0.10/GB up to 10TB $0.08/GB over 10TB + $500/mo platform base after 1TB. Splunk Cloud $150/GB/mo ingest min $750/mo, Enterprise $6k/yr per 1GB/day $0.50k. Sentinel PayGo $2.46/GB ingest, $0.12/GB archive, reservations $1.23/GB commitment 100GB/day $0.10/GB over. Security Lake storage $0.023/GB Standard $0.0125 S3 IA. OpenSearch self-host $50-200/mo VM.
Identity Governance / RBAC & Least Privilege (IAM Analyzer)
How users sign up, log in, and are authorized. Getting roles and access control right early prevents painful rewrites.Pricing & free-tier limitsAccess Analyzer free first 1k active findings + 100k archive rules free, then $0.0010/archive rule check. IAM free unlimited roles. Okta LCM $4/user/mo min 100 users + $3/user gov, $2 overtime. SailPoint SaaS $10/user/mo min $1000/mo + $5/1k entitlements over. Azure Access Reviews incl P2 $9/user/mo.
Service-to-Service Auth (mTLS / SPIFFE / Workload Identity)
How users sign up, log in, and are authorized. Getting roles and access control right early prevents painful rewrites.Pricing & free-tier limitsSPIFFE/SPIRE free self-host VM $10/mo. Consul HCP $0.03/hr per service instance ~$22/mo + $0.50/1M service discovery over. App Mesh $0.03/hr mesh + $0.10/1M req. GCP Workload Identity Federation free. mTLS certs via SPIRE free 1hr rotation. Overage $0.03/hr/client.
Certificate Management / PKI Automation (cert-manager)
Encrypts traffic between your users and your servers. Without it browsers flag your site as insecure and you lose trust and search ranking.Pricing & free-tier limitscert-manager free $5/mo VM helm. Let's Encrypt free 50/week. Smallstep $10/mo 100 certs $0.10/cert overage, $30/mo 1k certs. Venafi $2,500/mo base 1k certs $2/cert over. ACM Private CA $400/mo per CA + $0.75 per cert first 1k $0.35 after 10k, $0.001 OCSP. DigiCert $250/yr OV ~$21/mo per cert $0.50 renewal overage.
Audit Logging & Immutable Trail (CloudTrail / Audit Logs)
Controls who can do what inside your admin tooling. Limits blast radius if an account is compromised.Pricing & free-tier limitsCloudTrail: First trail Mgmt events free, data events S3/Lambda $0.10/100k events, Insights $0.35/100k write events. Lake $2.50/GB ingest first TB $2 after $0.50, storage $0.25/GB-mo 1yr $0.05/GB archive. S3 Object Lock free feature + $0.023/GB Standard + $0.0125/1k lock requests. GCP Audit free 30d 400GB then $0.50/GB. Azure free 90d then $2.30/GB Log Analytics.
Security Posture & Compliance Checks (Security Hub / CIS)
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsSecurity Hub: 30d free then $0.0010/check <100k $0.0008 100k-1M $0.0005 1M+. Foundational Best Practices same pricing. AWS Config $0.003 per eval 100k free $0.0012 after + $0.0125 per rule eval over. Prowler free self-host $10/mo VM infinite checks. ScoutSuite free. Overage $0.001/check ~$1 per 1k failing.
DDoS Protection (L3/L4/L7)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsShield Standard free unlimited. Shield Advanced $3,000/mo per org + 10k protected resources free $0.05/GB mitigated over 10TB + $50/hr SRT. Cloudflare Free unlimited DDoS free, Pro $20/mo, Business $200/mo, Magic Transit $5k/mo includes 10TB then $0.10/GB. Cloud Armor Standard $5/mo per backend policy + $1/rule + $1/M req Advanced $10k/mo base. Overages $0.05/GB DRT.
Secrets Rotation Automation & Dynamic Secrets
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsVault OSS rotation free VM $10/mo, Lease TTL free. AWS Secrets $0.40/secret/mo + Rotation Lambda $0.20/1M req + $0.0000167/GB-s, free 30d rotation. Doppler Pro $10/user/mo incl auto-rotation 1d min for 20 integrations $0.30/rotated secret over 100. CyberArk $8/user/mo + $0.10/rotated secret. Overage Lambda $0.20/M.
Network Segmentation / Security Groups & Firewall Management
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsSG/NACL free. Firewall Manager $100/mo per org + $10 per WAF/Firewall/Network Firewall policy after 5 free + $6/rule. Tailscale Free 100 devices, Personal Pro $6/user/mo 1 user, Teams $6/user/mo 3+ min $18/mo. Aviatrix $0.50/hr $365/mo. Network Firewall $0.395/hr ~$288/mo per AZ + $0.065/GB processed, overage $0.065/GB. Illumio $15/workload/mo $1500 min + $3/workload over 100.
How this small scale security and identity checklist works.
Each requirement below is something a small scale security and identity build typically needs. Pick one of the four researched options — recommended, free, cheaper or paid — add your own with "Other", or skip the requirement if your project doesn't need it. Nothing is mandatory; the plan on the right tracks what you've decided so nothing gets forgotten.
Your picks are saved in this browser automatically, so you can come back anytime. Options are researched per build level and refreshed as vendors change their plans — always verify details on the provider's page before committing.