cost-estimation-gcp.pdf

August 13, 2024 Version 1

Google Cloud Cost Estimation

Introduction

The objective of this document is to provide Mission System Owners with a basic understanding of how to leverage the Google Cloud Platform (GCP) pricing calculator to accurately project cloud hosting costs. Topics that will be covered include:

● Understanding Assured Workloads for implementing control packages

● How to access the GCP pricing calculator tool, and some basic usage ‘best practices’ for estimating costs in GCP for DOD

● Baseline costs: Managed services that are required for all GCP-hosted DOD systems

● Predicting and optimizing annual operational cost

● Other resources & relevant information (Invoicing and billing in GCP)

Google Cloud Cost Calculator:

Assured Workloads

Assured Workloads provides Google Cloud users with the ability to apply controls to a folder in support of regulatory, regional, or sovereign requirements. It offers data residency, encryption, and assured support to help organizations meet these requirements. It also offers monitoring to identify and fix compliance issues. Some of the compliance programs supported include FedRAMP, IL2, IL4, IL5, and HIPAA.

On top of core compliance support with NIST 800-53 and FIPS-140 encryption by default, Google Cloud’s Assured Workloads supports additional commitments that customer data will remain within the continental United States (CONUS) and will only be supported by authorized U.S. persons when using the appropriate control packages.

Assured Workloads supports a wide range of compliance standards while offering data residency in more regions than other government cloud solutions. For example, when using the Impact Levels 2-5 control packages, Google Cloud supports all US regions:

us-central1 Iowa, US us-east1 South Carolina, US us-east4 Northern Virginia, US us-east5 Ohio, US us-south1 Texas, US us-west1 Oregon, US us-west2 Los Angeles, US us-west3 Salt Lake City, US us-west4 Las Vegas, US

You can use Assured Workloads to achieve compliance-based outcomes on Google Cloud, using the following controls to support your requirements:

● Data residency: Ensures Google Cloud customer data is stored in a customer-selected Google Cloud region. If a customer's developer attempts to store data at rest in a region outside of the selection, the action will be blocked.

Learn more about Data residency.

● Data sovereignty: Ensures Google Cloud customers have mechanisms to exercise independent control over service provider's access to their data, approving access only for specific provider behaviors that are deemed appropriate and necessary by the customer.

● Personnel data access controls based on attributes: Ensures that only Google personnel who are able to satisfy certain physical location and background check requirements are able to access Google Cloud customer data when fulfilling support obligations. For example, Impact Level 4 (IL4) requires anyone accessing data be a US Person who has completed an ADP-1 Single Scope Background Investigation (SSBI).

Learn more about Personnel data access controls based on attributes.

● Personnel support case ownership controls based on attributes: Ensures that only Google support personnel who satisfy certain requirements are able to provide support to Assured Workloads customers.

Learn more about Personnel support case ownership controls based on attributes.

● Encryption: Google-owned and Google-managed keys, provided by default, are FIPS-140-2 compliant and support FedRAMP Moderate compliance. Customer-managed encryption keys (CMEK) represent an added layer of control and separation of duties. For example, IL4 requires FIPS 140-2 validated modules.

https://cloud.google.com/assured-workloads/docs/data-residency https://cloud.google.com/assured-workloads/docs/personnel-access-data-controls https://cloud.google.com/assured-workloads/docs/getting-support

Google Cloud’s approach of a “Software-defined Community Cloud” brings multiple benefits in addition to meeting security and compliance requirements:

● Users can take advantage of GCP’s scale of infrastructure, without needing to manage and maintain individual infrastructure instances

● New hardware, new services, and improvements to existing services can be made available faster than in traditional community clouds

● Faster onboarding of new cloud technology

● Overall efficiency is improved due to the scale of infrastructure available to the community

● Improved availability and performance

● Security enhancements can be scaled and implemented more quickly

The GCP Pricing Calculator does not currently provide estimations for using Assured Workloads. At the time of this guide’s publication, Premium control packages (E.g. Impact Levels) carry an additional 20% charge (see Assure Workloads Pricing for the most up-to-date information.

Assured Workloads pricing is calculated based on the billable Google Cloud usage running within the Assured Workloads folder. To calculate the amount you pay for Assured Workloads, add up the total Google Cloud services expenditure within the folder and multiply that number by 20% for Premium tier control packages.

For example, assume that you have previously configured the following two Assured Workloads folders:

● One FedRAMP Moderate folder (Free tier) with a monthly service expenditure of $500 across Compute Engine and BigQuery.

● One IL4 folder (Premium tier) with a monthly service spend of $1,500 across Compute Engine, Cloud Storage, and Pub/Sub.

Based on the preceding Google Cloud usage and expenditure, the monthly charge for Assured Workloads usage would be calculated as follows:

● FedRAMP Moderate folder (Free tier): $0

● IL4 folder (Premium tier): $1,500 x 20% = $300

● Total additional cost for the month: $300

For information about Assured Workloads folders, see Create a new Assured Workloads folder.

https://cloud.google.com/assured-workloads/pricing#premium https://cloud.google.com/assured-workloads/docs/create-folder

More information about Assured Workloads is available at the following resources:

● Overview of Assured Workloads | Google Cloud

● Assured Workloads | Google Cloud

● Software-Defined community cloud - a new way to “Government Cloud”

● Introducing Google Cloud support for Impact Level 5 (IL5) workloads

● Introduction to Assured Workloads https://cloud.google.com/assured-workloads/docs/overview https://cloud.google.com/security/products/assured-workloads?hl=en https://cloud.google.com/blog/products/identity-security/software-defined-community-cloud-new-way-government-cloud https://cloud.google.com/blog/products/identity-security/introducing-google-cloud-support-for-impact-level-5-workloads https://www.youtube.com/watch?v=pv1E8Shrbvg http://www.youtube.com/watch?v=pv1E8Shrbvg http://www.youtube.com/watch?v=pv1E8Shrbvg

The Basics

GCP Pricing Calculator: The Basics

The GCP pricing calculator is a tool that provides the following:

● Web-based UI for estimating monthly costs and extrapolating to annual cost estimates

● Up-to-date pricing rates for GCP services and their various cost models

● Allows for estimating temporary usage of resources – estimating autoscaling and/or other resources that are not provisioned 100% of the time

● Saving, exporting, and sharing cost profiles - providing the capability to save progress, collaborate with other team members, and objectively evaluate the cost impact associated with changes to architecture or service consumption

Key points to remember when using the Pricing Calculator tool for a GCP-hosted DOD Mission System

● The GCP Pricing Calculator is located at: https://cloud.google.com/products/calculator

● Costs vary between regions. Ensure the appropriate region is selected.

● Ensure services being utilized or estimated are approved at the system’s Impact Level. GCP provides this information at:

https://cloud.google.com/assured-workloads/docs/supported-products

● The GCP Pricing Calculator does not currently provide estimations for using Assured Workloads https://cloud.google.com/products/calculator https://cloud.google.com/assured-workloads/docs/supported-products

“Open detailed view”, download, duplicate, and share are powerful GCP cost calculator capabilities that allow a Mission System team to pre-configure a baseline configuration and share it with others. These features are useful for collaborating, sharing, and saving progress/estimates in the tool.

● “Open detailed view” generates a unique URL that provides an in-depth summary of all costs added to the calendar.

● “Download CSV” downloads a Comma Separated Values file that can be used to backup, share, and re-import the estimate.

● “New from duplicate” creates a copy of the original estimation for immediate customization.

● “Share” provides a “Copy Link” and “Download .csv” button for easy sharing of the estimation

At present, the Google Cloud Pricing Calculator doesn't have the capability to estimate the costs associated with utilizing Assured Workloads.

When using the GCP Pricing Calculator to estimate projects with Assured Workloads, be sure to limit the estimation to only include the products supported by the specific control package.

To estimate costs, navigate to the Supported Products by Control Package documentation and choose the required control package (for example, Impact Level 5). Then, navigate to the Google Cloud Pricing Calculator. Be sure to limit the scope of the Pricing Calculator estimation to only include the products as supported by the control package in use. Once completed, be sure to also account for the applicable Assured Workloads control package’s premium pricing.

https://cloud.google.com/assured-workloads/docs/supported-products https://cloud.google.com/assured-workloads/pricing#premium

Mission System Costs

Mission System Costs

Mission System Owners (MSOs) need to account for the costs of the components that are specific to their system. The GCP Pricing Calculator can help MSOs accurately estimate their annual costs.

The following are some of the key cost factors in GCP, categorized based on their potential impact* on your overall costs:

*The cost implications of these services are significantly influenced by their specific usage patterns and configurations.

Major Cost Drivers:

● Compute Engine

● Persistent Disk

● Cloud Storage

● BigQuery

● Cloud SQL

● Kubernetes Engine (GKE)

● Cloud Functions

Minor Cost Drivers:

● Cloud DNS

● Cloud Monitoring

● Cloud Pub/Sub

● Cloud Dataflow

● Cloud VPN

● Cloud IAM

No Cost Services:

The Google Cloud Free Program offers a 90-day free trial with $300 in credit to explore and evaluate Google Cloud products and services. It also has a Free Tier with select products that you can use for free, within specified monthly usage limits.

Find more information about the Google Cloud Free Program here:

https://cloud.google.com/free/docs/free-cloud-features https://cloud.google.com/free/docs/free-cloud-features https://cloud.google.com/free/docs/free-cloud-features

Predict and Optimize

Predict and Optimize

Tips for Cost Management in GCP:

● Use the Pricing Calculator: Estimate your costs before deploying resources.

● Set Budgets and Alerts: Receive notifications when your spending approaches or exceeds your limits.

● Utilize Cost Management Tools: GCP provides tools for tracking and analyzing your costs.

● Right-size your resources: Choose the appropriate instance types and storage classes for your needs.

● Take advantage of discounts: GCP offers sustained use discounts and committed use discounts.

Remember, effective cost management requires continuous monitoring and optimization.

https://cloud.google.com/compute/docs/sustained-use-discounts https://cloud.google.com/compute/docs/instances/committed-use-discounts-overview

Other Resources & Information

Service Accreditation

Assured Workloads is a service by Google Cloud that helps organizations meet regional, regulatory, and sovereign compliance requirements.

It offers a set of pre-configured controls that simplify the process for achieving compliance with specific regulations. Assured Workloads supports a variety of Google Cloud services, and helps organizations restrict unauthorized access to customer data.

Find more information about Google Cloud products by control package here:

Supported products by control package | Assured Workloads | Google Cloud https://cloud.google.com/assured-workloads/docs/supported-products

GCP Pricing Calculator Video Walkthrough

To see a demonstration of how to use the GCP pricing calculator, please watch the following video:

http://www.youtube.com/watch?v=raEbnlIohLE http://www.youtube.com/watch?v=raEbnlIohLE

More Information

For any inquiries or suggestions related to the GCP Pricing Calculator or this guide document, feel free to reach out to the Cloud One team or your designated GCP account representative.

Helpful links:

● Google Cloud console

● Google Cloud Pricing Calculator

● Google Cloud - YouTube

● Getting started – Google Cloud console

● Cloud Forums

● Google Cloud Customer Care https://console.cloud.google.com/ https://www.youtube.com/googlecloud https://console.cloud.google.com/getting-started https://www.googlecloudcommunity.com/gc/Cloud-Forums/ct-p/cloud-forums https://cloud.google.com/support