Accounts, identity and cost
The AWS foundation.
My default
6 tools in this layer.
The easiest pick for small apps, internal tools and admin panels. Everything works out of the box and it's free below 10,000 monthly users. For serious apps on Postgres, Better Auth comes first.
Pricing: Lite and Essentials: 10,000 monthly active users free per account, then $0.015 per user on Essentials (Lite from $0.0055, without passkeys or email codes). Enterprise SSO users: 50 free, then $0.015 each.
Central backup policies for AWS resources. Neon branches cover the Neon side.
Pricing: Sydney: S3 and EFS backups $0.06/GB-month warm (EFS cold $0.012), DynamoDB $0.114/GB-month, EBS snapshots $0.055/GB-month; Aurora and RDS snapshots bill at their own backup storage rates. Copies out of Sydney $0.098/GB for most types ($0.16 for DynamoDB and EFS). Restore tests $1.80 per recovery point. Vault Lock is free.
Centralised accounts, billing and access. Every client gets this first.
Pricing: No extra charge. Control Tower is free too, but you pay for the AWS Config and CloudTrail it turns on. Replicating Identity Center to a second Region adds only the KMS key.
My first pick for serious apps on Postgres. Your users live in your own database, it does more than Cognito, and it costs nothing per user.
Pricing: Free (MIT), with no per-user fee. You pay only for the Lambda and the Postgres you already run. Optional hosted extras (Better Auth Infrastructure): Pro $20 a month with one self-serve SSO connection, then $50 a month per extra connection.
Where every cost investigation starts. I let Claude Code read it and find the culprit.
Pricing: The console is free. The API costs $0.01 per paginated request. Hourly data for the last 14 days is opt-in, at $0.01 per 1,000 usage records a month.
My main lever on AWS cost. AWS margins are high; commitments bring them down.
Pricing: Sydney, on-demand to committed: Aurora PostgreSQL db.r7g.large $0.333/h to $0.256/h (1-year Reserved Instance, no upfront) or about $0.176/h (3-year, all upfront). Fargate $0.0486 per vCPU-hour to $0.0413 (1-year Compute Savings Plan, no upfront) or $0.0257 (3-year, all upfront). Lambda duration only 12 to 17% off; requests not at all.
Where they're used
The jobs that pick or avoid a tool from this layer.
- 17 An AWS foundation for a client Accounts, access, backups and cost from day one. My picks: AWS Organizations + IAM Identity Center, Pulumi, AWS Backup, Savings Plans and Reserved Instances, Cost Explorer (with Claude Code)
- 18 Moving on-premises systems to AWS Lift databases and apps into AWS. My picks: Claude Code, AWS Database Migration Service, AWS Organizations + IAM Identity Center, Pulumi
- 20 Sign-in and identity How users sign in, reset passwords and use Google, Microsoft or their company login. My picks: Better Auth, Amazon Cognito, Resend, Cloudflare Workers
Want this stack in your AWS account?
Cloudless Labs is a Sydney consultancy. We migrate on-premises systems to AWS, build serverless apps on this stack, and coach teams to ship with Claude Code and Codex.