Cloud firewall logging costs tradeoff

Overview

Flow logs, threat intel, and full PCAP-style retention can dwarf compute spend if you turn every dial to “max.” Design logging for detectability and compliance, not hoarding.

Cost drivers

• Retention length and hot vs archive tier in Log Analytics / S3 + Athena.
• Ingest volume: verbose DNS logging, allowed traffic included “for completeness.”
• Duplicate pipelines (sent to SIEM and to cheap storage without dedup strategy).

Pragmatic approach

• Log denies, RFC1918 anomalies, and admin ports by default; sample or summarize allow rules with high volume.
• Use Azure Firewall Premium / GWLB features only where threat models justify cost; SMB may start with Network Watcher NSG flow plus perimeter firewall.

Client conversation

Show a monthly log GB × retention spreadsheet; tie reductions to SIEM use cases (“we need X for insurance attestation”). Review quarterly as traffic grows.