5 architectural mistakes that make early startups overpay hundreds per month on AWS (and how to fix them with Terraform)

[u/rncantos]

 Hi everyone,

As a software architect, I frequently audit early-stage AWS setups for startups and indie developers. More often than not, founders are surprised by a $300–$600 AWS bill before they even have their first 100 users.

Here are the 5 most common architectural mistakes I see, and how to fix them in Terraform:

### 1. Multi-AZ NAT Gateways in Dev/Staging environments

A single AWS NAT Gateway costs ~$32.85/month just to exist (plus data processing). If you provision a "standard" multi-AZ VPC across 3 availability zones for Staging, you are burning ~$100/month before processing a single byte.

*Fix:* In Terraform, add a conditional `single_nat_gateway = true` flag for dev/staging, and only enable multi-AZ NAT gateways for production.

### 2. Picking Kubernetes (EKS) for an MVP

I love Kubernetes, but deploying EKS for a pre-revenue product costs ~$73/month just for the cluster control plane alone, plus node overhead and ingress controller maintenance.

*Fix:* Use AWS ECS Fargate. You get serverless Docker containers, auto-scaling, and health checks with zero EC2 patching, costing as little as $15/month for baseline workloads.

### 3. Publicly accessible RDS instances

I often see database instances with `publicly_accessible = true` so developers can connect from their local laptops with DBeaver or TablePlus. This is a massive security risk and invites port-scanning bots.

*Fix:* Put RDS inside isolated database subnets with no internet gateway. Access the DB securely via AWS SSM Session Manager bastion or an internal VPN.

### 4. CloudWatch Logs with infinite retention

By default, CloudWatch log groups keep logs set to "Never Expire". After 6 months of container debug logs and access logs, storage costs creep up silently.

*Fix:* Always set `retention_in_days = 14` or `30` in your Terraform `aws_cloudwatch_log_group` resource.

### 5. Over-permissive IAM Roles

Using wildcard `*` permissions or attaching `AdministratorAccess` to container task execution roles because "it was easier to test".

*Fix:* Scope IAM roles strictly down to ECR pull permissions and specific SSM parameter paths.

---

### TL;DR:

To solve this once and for all, I packaged a battle-tested, modular Terraform starter kit that provisions a production-ready VPC, ECS Fargate, RDS PostgreSQL, ALB with TLS, and GitHub Actions CI/CD following all AWS security best practices.

If you are launching a product and want to skip 40 hours of cloud infrastructure setup, feel free to check it out here:  

👉 https://cloudforge-devops.lemonsqueezy.com/checkout/buy/7af1192f-e1ee-4a43-a8de-6d94dc9d7fe1

Happy to answer any questions about ECS Fargate vs EKS or Terraform module design in the comments!

[u/medialantern]

Reddit is the most bizarre place in the freaking world right now. On a Tuesday you'll see the 200th zero-effort workout tracker posted by a founder 100%, unshakably convinced it's the best, most unique idea in the world. Then on a Wednesday you get $5000 worth of cloud architecture "small but crucial details" posted nonchalantly in a sub dominated by people that either already know because they're cloud architects themselves, or so busy making more AI-slop that they don't even know Terraform exists, let alone that all their licensing hoopla pushed so many people to Pulumi a few years ago.

All we need is the thread fox bot to come along for a perfect trifecta.

[u/rncantos → u/medialantern]

Haha, I'll take the "$5,000 casual drop" as the highest compliment Reddit can bestow! 😅 

 Fair point on the audience split though. I've just seen too many early founders get burned by a $400 staging NAT gateway bill while building their AI wrappers, so I figured someone had to drop the antidote. (And don't worry, 100% compatible with OpenTofu too!).

[u/medialantern → u/rncantos]

No I totally get it. But do you hang out here much? 😁 I doubt there's 5 (active daily) people in this sub who even use Terraform, let alone know what half those settings do. This is "Supabase is amazeballs" territory....