Cost Management

Control AWS costs for your redStack lab with billing alarms and resource cleanup.

redStack runs entirely on EC2 instances. Running instances accrue charges 24/7 — whether you are actively using the lab or not. This page covers estimated costs, how to minimize charges when the lab is idle, and how to set up a billing alarm so you are notified before a surprise bill accumulates.

The only way to eliminate all AWS charges from redStack is terraform destroy. Stopping instances pauses compute charges but EBS volumes and Elastic IPs continue to accrue costs even when instances are stopped.

Estimated costs

All estimates are for us-east-1 (N. Virginia) on-demand pricing. Prices vary by region.

Compute (EC2)

Instance	Type	Rate
Redirector	t3.micro	~$0.0104/hr
Sliver C2	t3.small	~$0.0208/hr
Guacamole	t3.small	~$0.0208/hr
Mythic C2	t3.medium	~$0.0416/hr
Havoc C2	t3.medium	~$0.0416/hr
Windows workstation	t3.medium	~$0.0416/hr

Instance types for Sliver and Havoc can be adjusted in terraform.tfvars (sliver_instance_type, havoc_instance_type).

Storage and networking

Resource	Rate
EBS gp3 storage	~$0.08/GB-month (total ~140 GB across all instances)
2× Elastic IPs (unattached to running instance)	~$0.005/hr each

Elastic IPs are allocated at deploy time — one for Guacamole, one for the redirector. AWS charges for EIPs that are allocated but not attached to a running instance. When instances are stopped, both EIPs continue to charge at the hourly rate.

Total rough estimate

A fully running redStack lab costs approximately $0.17–$0.19/hr for compute alone, or roughly $4–$5/day. Storage and networking add a small fixed amount regardless of instance state.

Set a billing alarm

A billing alarm is the most reliable safeguard against forgotten resources. Set one up before your first deployment.

1. Open the AWS Billing console

   Go to the AWS Billing Console and sign in with your IAM credentials.

2. Navigate to CloudWatch billing alarms

   In the left sidebar, click Billing preferences, then scroll to Alert preferences and ensure Receive CloudWatch Billing Alerts is enabled. Then open CloudWatch → Alarms → Create alarm.

3. Configure the alarm

   • Metric: Billing → Total Estimated Charge → USD
   • Threshold: Set a monthly dollar amount that would indicate something is wrong (e.g., $50)
   • Action: Add an SNS notification to your email address
4. Save and confirm the subscription

   Create the alarm and check your email for the SNS subscription confirmation. Click the confirmation link to activate notifications.

Quick cost control actions

Stop instances when idle

Stopping instances via the EC2 Dashboard pauses compute charges. Use this during breaks between sessions when you want to preserve state without rebuilding.

Destroy when done

terraform destroy terminates all instances, releases Elastic IPs, and removes all billable resources. Use this at the end of each training session.

Use a dedicated AWS account

Run redStack from a throwaway AWS account used solely for this lab. Billing alarms and IAM scope are simpler, and there is no risk to other workloads.

Verify after destroy

Check the EC2 Dashboard after every terraform destroy to confirm no instances or EIPs remain. Stray resources mean ongoing charges.

Stopping instances without destroying

When you want to pause the lab without losing state (installed tools, generated payloads, C2 configurations), stop all instances from the EC2 Dashboard:

1. Open the EC2 Instances view

   Go to EC2 → Instances → Instances in the AWS console.

2. Select all redStack instances

   Check the box next to each redStack instance. Use the Name column to identify them (all are tagged with the redStack project name).

3. Stop the instances

   Click Instance State → Stop. Confirm when prompted.

4. Restart when ready

   Select the same instances and click Instance State → Start. Wait 5-10 minutes for cloud-init and services to be ready.

EBS storage volumes and Elastic IPs continue to incur charges while instances are stopped. For a full redStack deployment the EBS storage cost is approximately **$11.20/month** (~140 GB at$0.08/GB-month). Two unattached EIPs add approximately $7.20/month combined. Stopping instances is not free — it only pauses the larger compute charges.

Verify clean teardown after terraform destroy

After running terraform destroy, confirm in the AWS console that no billable resources remain:

EC2 → Instances

All redStack instances should show status terminated. Terminated instances are not billed and disappear from the list after a short time.

EC2 → Elastic IPs

No redStack Elastic IPs should be listed. If any remain, release them manually to stop the hourly charge.

VPC → Your VPCs

Both redStack VPCs (team server and redirector) should be gone. Stray VPCs do not incur charges on their own, but may indicate the destroy did not complete cleanly.

EC2 → Key Pairs

rs-rsa-key will still be listed — the key pair is managed outside Terraform and is not deleted by terraform destroy. Delete it manually only if you are permanently done with the lab.

Make it a habit to open the EC2 Dashboard after every terraform destroy before closing your terminal. The five-second check can prevent a multi-day billing surprise.