obriensystems
commented
1 year ago Examples
- N2d-standard-48 with Sustained use 3y, Confidential computing enabled, Premium networking at 100Gbps egress, Ubuntu pro OS required by CC GCP Cost Calculator (ol.dev) https://cloud.google.com/products/calculator#id=f0adf734-5a7c-4e09-9364-e8625ab437d8
example 48vCPU to bring in confidential computing and 50 Gbps egress
In the minimum VM size below to bring in >25 Gpbs - the CC cost is about $337/month or $0.47/hr
48 vCPU + 192 GB memory | $1,629.71 | Confidential Computing | $294.89 | Premium image usage fee* | Unknown | (calculated at 0.058/hr = 42/mo) Per VM Tier_1 networking performance | $360.87 | 1000 GB balanced persistent disk | $110.00 | Use discount | -$325.94 | Total | $2,069.53 |
Pricing scenarios for LZ options with/without the following services around L4 to L7 packet inspection
Cloud IDS
Cloud Armor (use Traffic Generator example app)
Cloud Firewall (use Traffic Generator example app)
PII (as part of VPC-SC)
Premium Networking (32 Gbps - outbound, VM to public IP 7Gbps) = VM Tier_1 - requires minimum vCPUs of
48 vCPU = 50Gbps/25Gbps (outbound/publicIP), CC = 295/mo, per VM Tier_1 361/mo
64 vCPU - same as above but CC/393/mo and Tier_1 361/mo
96 vCPU = 100Gbps/25Gbps (outbound/publicIP), CC = 590/mo, per VM Tier_1 722/mo
higher to 224 vCPUs no change in 100Gpbs Confidential Computing (requires N2D AMD EPYC CPU platform and Ubuntu 20.04 LTS Pro FIPS server min OS - a premium image at flat 0.000127 GB/hr $0.034/hr for 18-48 vCPUs - does not participate in spot/preemptible pricing - for N2d-standard-48 / 192Gb the premium image usage fee is = .034/hr/48vCPU + 0.000127 GB/hr (for 192Gb = .025/hr) = total of .058/hr = 42/mo for confidential computing in general PAYG not 3 year reserved = 0.269/hr) - not required for PBMM - may be for PBHH TBD -
PBMM via SI-7 https://github.com/GoogleCloudPlatform/pbmm-on-gcp-onboarding/blob/main/docs/google-cloud-security-controls.md#6780si-7software-firmware-and-information-integrity requires only that Shielded VMs (no additional cost) are enabled https://github.com/GoogleCloudPlatform/pbmm-on-gcp-onboarding/blob/main/docs/google-cloud-security-controls.md#compute---shielded-vms for example even though the GKE cluster running the infrastructure has the following organization policy set to false https://github.com/GoogleCloudPlatform/pubsec-declarative-toolkit/issues/132 - we set it to true for all workloads involving IaaS GCE and PaaS GKE constraints/compute.requireShieldedVm = true
N2-32 VMs (Active-Passive and Active-Active NGFWs) - https://cloud.google.com/compute/docs/machine-resource#recommendations_for_machine_types
Assured workloads
In terms of