The $5K AWS Credit
AWS gave us $5,000 in credits. This is a full look at what we run there today, what it costs, where the weak spots are, and how the credit can buy real speed, safety, and SOC 2 readiness. Proposed — pending Fede's picks. All numbers pulled live from the AWS account on Aug 14, 2026.
One check first
The credit isn't visible in the billing account yet — every month through today shows only paid usage plus tax, no credit line. The only related email is the generic AWS-for-Startups welcome from Aug 12. Worth confirming in the billing console that the $5,000 actually landed before counting on it.
What we run on AWS today
- 25 small serverless functions (Lambda) do the background work: processing inbound emails, running Clara's agent jobs, syncing with AppFolio, watching for concessions, taking metric snapshots.
- 18 message queues (SQS) feed those functions. Every "dead letter" queue — where failed messages land — is currently empty. Nothing is stuck.
- 11 database tables (DynamoDB). The main production table holds ~704,000 records (~1.5 GB).
- 1 always-on container (Fargate) runs the renewal worker — a single copy, no spare.
- Everything lives in one AWS region (N. Virginia). The web app itself is on Vercel, not AWS.
In plain terms
There are no big servers to upgrade. Almost everything scales itself automatically and is healthy — no backlogs, no errors piling up. The one exception: the renewal worker runs as a single copy, so if it crashes there's a gap until it restarts.
What it costs
| Month | Total AWS bill | Of which the database |
|---|
| May | $307 | $234 |
| June | $453 | $353 |
| July | $602 | $489 |
| Aug 1–14 | $109 | $73 |
The database was the whole story of the rising bill — almost entirely reads ($368 of July's $489). Then in August it dropped sharply. That drop wasn't luck: it's the deliberate cost-cut work shipped Aug 2 (written up at docs.propflowai.co/a/infra-spend-cuts-2026-08), which stopped background jobs from re-reading the whole table. At the August pace, the total bill runs roughly $230–250/month.
In plain terms
The bill nearly doubled from May to July because some background jobs were re-reading the database far too often. That was found and fixed on Aug 2. The $5K credit at today's pace would last well over a year doing nothing — which means we can afford to turn on things we've been skipping.
Health check: what's strong, what's weak
| Area | Status | Detail |
|---|
| Queues & alarms | Strong | 89 alarms configured; one non-customer alarm firing (a stage-environment replicator check); failed-message queues empty |
| Audit trail (CloudTrail) | On | All-region logging with tamper-proof validation — a SOC 2 must-have, already done |
| Threat detection (GuardDuty) | On | Watches for suspicious account activity (~$5/mo) |
| Database throttling | Bursty | Reads occasionally throttle in short bursts (worst day in the last two weeks: ~5,400 events on Aug 13); most days near zero; writes never throttle |
| Point-in-time restore | Partial | On for the main, auth, and consent tables; off for agent-jobs, traffic, and status-cache |
| Backup plans | None | No scheduled backups, no copies outside the one region |
| Config change recorder | Off | AWS Config — records every infrastructure change; auditors ask for it |
| Security posture checks | Off | Security Hub — continuous automated checks against security benchmarks |
| AppFolio sync job | Strained | Ran 77,349 times in two weeks with 147 errors, and at least one run hit its hard 15-minute kill switch — that run died mid-sync |
| Inbound email processing | Slow-ish | Averages ~16 seconds per email; worst case just over 3 minutes |
SOC 2: where the credit genuinely helps
You asked about SOC 2 specifically. The good news: the two expensive-feeling foundations — the tamper-proof audit trail and threat detection — are already on. What's missing is exactly the stuff teams skip on cost grounds:
- AWS Config — keeps a timestamped history of every change to our infrastructure and flags drift from the rules we set. Compliance platforms like Vanta and Drata plug straight into it; auditors treat it as table stakes. Estimate: $30–100/mo, scales with how often we change things.
- Security Hub — runs continuous automated checks ("is anything public that shouldn't be?", "does every user have MFA?") against standard security benchmarks and gives one score to show an auditor. Estimate: $10–40/mo.
- IAM Access Analyzer — flags anything in the account reachable from outside. Free at the basic tier.
- Scheduled backups with an off-site copy (AWS Backup) — auditors ask "show me your backup policy and prove a restore works." Today the honest answer is "we have live-restore on the main tables and nothing else." Estimate: $1–5/mo — the main table is only ~1.5 GB, so cross-region copies are cheap.
In plain terms
A SOC 2 auditor asks three things about your cloud: can you prove who changed what (we can), are you watching for break-ins (we are), and can you recover if data is lost or a setting is quietly changed (right now, only partly). The credit closes that third gap for roughly the cost of one dinner a month.
Speed & resilience: the real knobs
"Bigger servers" isn't the lever here — there are no servers. The levers that exist:
- Give the busy functions more muscle. The email processor and agent runtime run on small settings (512 MB / 1 GB). On Lambda, memory and CPU come together — doubling memory roughly doubles compute and often halves the runtime, so the cost increase is small. Worth doing on the ~16-second email processor. Estimate: $1–3/mo — its compute costs under $1/mo today, so even doubling is pocket change.
- Keep a warm copy of the customer-facing functions (provisioned concurrency), so a tenant's email or an agent job never waits on a cold start. Estimate: $10–30/mo.
- Run a second renewal worker, so a crash doesn't pause renewals until the restart. Estimate: $15–30/mo.
- An outside heartbeat on propflowai.co (a "canary" that loads the site every few minutes from outside and alarms if it's down or slow) — today our outside-in checks run once nightly in CI; nothing watches the customer-facing site continuously. Estimate: ~$10/mo at a 5-minute pulse.
- Per-request tracing (X-Ray / Lambda Insights) — when something is slow, see exactly which step ate the time instead of digging through logs. Estimate: $10–30/mo.
One thing money can't fix: the AppFolio sync hitting its 15-minute ceiling is a code problem (the job needs to split its work into smaller pieces), and it's already at the maximum time AWS allows. Flagging it here so it gets a ticket, not a credit.
What not to spend it on
- A database cache (DAX) — read costs just fell and throttling is limited to rare short bursts (the database retries through them); a cache is a standing monthly cost for a problem we barely have. If the Aug 13-style bursts start recurring, revisit.
- Reserved capacity / savings plans — those lower the bill, and once the credit is applied it makes the bill $0 anyway. Revisit when credits run out.
- Multi-region everything — with one property live, full active-active disaster recovery is over-engineering. Off-site backup copies give most of the safety for a small fraction of the effort.
The decision
Everything above, turned on together, adds roughly $90–250/month (estimates) on top of today's ~$230–250/month pace. The $5K credit covers the whole AWS stack — everything on this page — for roughly 10–15 months. (AWS only: our other infra, like the AI APIs and Vercel, isn't touched by this credit.) Note: credits don't cover the sales-tax line (a few dollars a month).