Compute
- EC2 Spot with capacity-optimized allocation; test multiple instance types. EC2 Spot
- EKS + ARC for scale-to-zero runners; consider Karpenter for node right-sizing.
Networking
- Prefer Gateway Endpoints for S3 and DynamoDB to avoid NAT traversal. VPC endpoints
- Use Interface Endpoints for ECR API and ECR DKR (image pulls) to keep traffic private. ECR endpoints
- NAT choices: gateway (hourly + per-GB) vs NAT instance for low throughput; place one NAT per AZ to avoid cross-AZ data charges. NAT pricing
Storage/Registry
- S3 lifecycle policies and storage classes (IA/Glacier) for artifacts. S3 lifecycle
- ECR repos in the same region; replicate only if needed. ECR
Terraform examples
```hcl
resource "aws_vpc_endpoint" "s3" {
vpc_id = var.vpc_id
service_name = "com.amazonaws.${var.region}.s3"
vpc_endpoint_type = "Gateway"
route_table_ids = var.route_table_ids
}
```
```hcl
resource "aws_vpc_endpoint" "ecr_api" {
vpc_id = var.vpc_id
service_name = "com.amazonaws.${var.region}.ecr.api"
vpc_endpoint_type = "Interface"
subnet_ids = var.private_subnet_ids
security_group_ids = [aws_security_group.endpoints.id]
private_dns_enabled = true
}
resource "aws_vpc_endpoint" "ecr_dkr" {
vpc_id = var.vpc_id
service_name = "com.amazonaws.${var.region}.ecr.dkr"
vpc_endpoint_type = "Interface"
subnet_ids = var.private_subnet_ids
security_group_ids = [aws_security_group.endpoints.id]
private_dns_enabled = true
}
```
References: EC2 pricing, Spot, NAT pricing, VPC endpoints, S3 pricing
Compute
- Spot/Preemptible VMs in Managed Instance Groups with multiple machine types. docs
- GKE (Autopilot or Standard) with ARC; right-size node pools.
Networking
- Enable Private Google Access so private VMs reach GCS/Artifact Registry without public egress. docs
- Cloud NAT sized appropriately; avoid cross-region pulls. Cloud NAT pricing
Storage/Registry
- Artifact Registry regional repos in the same region as runners. docs
- GCS lifecycle rules for artifacts. docs
Examples
```hcl
resource "google_compute_subnetwork" "subnet" {
name = "ci-private"
ip_cidr_range = var.cidr
network = var.network
region = var.region
private_ip_google_access = true
}
```
```hcl
resource "google_compute_router" "router" {
name = "ci-router"
network = var.network
region = var.region
}
resource "google_compute_router_nat" "nat" {
name = "ci-nat"
router = google_compute_router.router.name
region = var.region
nat_ip_allocate_option = "AUTO_ONLY"
source_subnetwork_ip_ranges_to_nat = "LIST_OF_SUBNETWORKS"
subnetwork {
name = google_compute_subnetwork.subnet.name
source_ip_ranges_to_nat = ["ALL_IP_RANGES"]
}
}
```
References: Compute pricing, Spot/Preemptible, Private Google Access, Cloud NAT pricing, Artifact Registry
Compute
- Spot VMs in VM Scale Sets; consider capacity reservations for stability. docs
- AKS with ARC; autoscaling node pools and right-sized SKUs.
Networking
Storage/Registry
- ACR in-region with runners; enable geo-replication only if required. docs
- Blob Storage lifecycle rules for artifacts. docs
Examples
```hcl
resource "azurerm_subnet_service_endpoint_storage_policy" "storage" {
name = "allow-storage"
resource_group_name = var.rg
virtual_network_name = var.vnet
subnet_name = var.subnet
storage_accounts = [azurerm_storage_account.artifacts.id]
}
```
```hcl
resource "azurerm_private_endpoint" "acr" {
name = "acr-pe"
location = var.location
resource_group_name = var.rg
subnet_id = azurerm_subnet.private.id
private_service_connection {
name = "acr"
private_connection_resource_id = azurerm_container_registry.acr.id
is_manual_connection = false
subresource_names = ["registry"]
}
}
```
References: VM pricing, Spot, NAT pricing, Private Endpoints, ACR
---
## Industry-specific considerations
### Financial services
- SOC 2 and PCI-DSS drive stricter isolation and auditability. Prefer ephemeral runners for untrusted code; ensure logs are centralized (not as long-lived artifacts).
- Use OIDC and short-lived credentials for cloud access; scope IAM roles tightly.
- Keep sensitive builds in private subnets behind endpoints; avoid cross-region traffic.
References: