Alert Logic Reduces Cloud Costs 28% by Leveraging AWS Financial Management Strategies

With offices spanning three continents, Alert Logic provides a managed detection and response platform to protect businesses across the globe from cybersecurity threats. To improve scalability and deliver high-performance security services to customers, Alert Logic has begun the process of migrating its platform from six colocation data centers to Amazon Web Services (AWS).

Alert Logic’s AWS environment currently consists of over 3,400 virtual servers, 5,400 containers, and three petabytes of storage across more than 100 AWS accounts, which support production, development, and integration purposes. As the company continues to migrate workloads to AWS, it has also launched an organization-wide effort to manage and optimize cloud costs.

Leading the way is a team headed by Jamie Parker, manager of cloud operations at Alert Logic. A key objective already achieved by Parker’s team was assigning cost ownership for each AWS account to internal software engineering teams. In addition to helping internal AWS account owners prioritize their cost management efforts, Parker’s team facilitates collaboration among application development, cloud operations, and finance teams to establish a company culture that strives to lower cloud costs.

“Connecting finance with engineering to understand cloud costs produced an amazing relationship between the two departments,” Parker says. “Engineering has a better understanding of the costs, and finance has a better understanding of how engineering justifies the costs.”

To drive the cost measurement and accountability initiative and to improve visibility into the cost of all AWS accounts, Alert Logic tapped into Cloud Financial Management with AWS. Parker consults with AWS experts to understand the best practices and AWS tools available to achieve their business outcomes at the lowest possible cost point. To make sure their AWS accounts are organized into logical groups and can apply policies to enforce compliance of resource usage, her team uses AWS Organizations.

Alert Logic also defined key cost metrics and allocated costs across AWS accounts for shared service usage. Alert Logic did this by increasing resource tagging coverage, which helps trace the cloud resource costs to each engineering group and assign the cost ownership of each account to internal teams. This level of cost visibility and accountability provided cost-saving insights.

“By collaborating with AWS, we were able to identify and understand our cloud resource optimization opportunities,” says Parker. “This allowed us to prioritize our cost-saving initiatives and improve the utilization of our provisioned resources.”

One of the key strategies AWS recommended for Alert Logic was to reduce the steady state spend by using Savings Plans. This approach provides more spending flexibility by making it possible to commit to a consistent amount of usage measured in dollars per hour rather than committing to a certain amount of usage for specific instances.

Savings Plans now covers nearly 80 percent of the Alert Logic compute capacity and Reserved Instances covers 16 percent. When factoring in the current usage, Alert Logic has reduced compute costs on 52 percent of its Amazon Elastic Compute Cloud (Amazon EC2) resources.

One of the tools Alert Logic uses to project cloud resource requirements is AWS Cost Explorer. It lets Alert Logic visualize, understand, and forecast AWS costs and usage for the next 12 months on a monthly basis, and the next three months on a daily basis. “This helps make sure we don’t overcommit and waste money on instances we end up not using,” Parker points out.

In addition to increasing Savings Plans coverage, Parker’s team is providing guidance to internal engineering teams to redesign platform applications to function more efficiently on the cloud. The team also identified several optimization measures. These include checking the AWS Cost Management resources recommendations, rightsizing Amazon EC2 instances, and parking resources when not in use so Alert Logic pays only for consumed CPU and memory resources. To further optimize resource consumption, Alert Logic resized its Amazon Elastic Container Service (Amazon ECS) clusters.

On the network side, Alert Logic reconfigured routing to avoid the public internet, and instead used AWS Transit Gateway to create direct connections among Amazon Virtual Private Clouds (Amazon VPCs) that transfer data to each other. And for storage, Alert Logic increased its use of file compression, which reduces the required storage resources.

“Altogether, these optimization measures combined to generate a 28 percent savings in our AWS spend,” Parker reveals. “Optimizing our server instances and network data flows were the biggest contributors to the reduced costs.”

For other companies planning to optimize their cloud spend, Parker emphasizes the importance of closely following the AWS Cloud Financial Management framework and the guidance that AWS financial management experts provide. “We also recommend leveraging the AWS Well-Architected Framework,” Parker adds. “It provides valuable guidance on how to configure AWS environments to reduce resource costs as much as possible while still delivering the required application performance.”

Looking ahead, Parker plans to continue strategizing and implementing policies based on key learnings to manage cloud costs. These policies include modernizing Alert Logic applications by using cloud-native technologies such as serverless application coding and container orchestration services.

Alert Logic also recently incorporated AWS Cost Anomaly Detection to help identify large cost increases caused by spikes in platform activity. “Using tools like this is important because cost optimization is an ongoing endeavor,” Parker points out. “As our AWS environment changes, we will continue to analyze our costs and look for new cost-savings tools from AWS to keep our costs under control. With AWS alongside us, we can continue to improve the profitability of our services while ensuring we deliver the cybersecurity protection our customers demand.”