# AWS and Terraform Costs Versus a Sovereign AI Workstation

A 48-vCPU AWS workstation costs $1,340.28 a month before disks and traffic. Compare its full bill with our $125 dedicated server and keep an exit plan.

Author: J.A. Watte
Published: October 16, 2026
Source: https://jwatte.com/blog/aws-terraform-costs-vs-sovereign-ai/

---

Terraform makes a cloud build repeatable. It doesn't make the resources cheaper. For a small business owner renting a persistent AI workstation, the useful question is what remains on the bill after the configuration file has finished running.

[Sovereign AI Made Simple](/blog/sovereign-ai-made-simple/) introduces the setup, and [The Sovereign Advantage](/blog/sovereign-advantage-dedicated-ai-workstation/) already compares cloud VMs, office machines, local models and API billing. Here I'm pricing the capacity of our actual box on AWS, including the disk and network costs that an instance quote leaves out.

## What Terraform costs

HashiCorp [announced its move to Business Source License 1.1](https://www.hashicorp.com/en/blog/hashicorp-adopts-business-source-license) on August 10, 2023. Current Terraform CLI releases are source-available under that license; calling them open-source would blur a real distinction. The [license FAQ](https://www.hashicorp.com/en/license-faq) says internal or personal end users face "no change" and permits internal hosting. Running Terraform to manage your own infrastructure doesn't require buying HCP Terraform. Restrictions on competitive hosted offerings are a different question; read the terms for your use.

[HCP Terraform's pricing page](https://www.hashicorp.com/en/products/terraform/pricing), read October 16, lists Free for up to 500 managed resources, including basic team workflows, security features, SSO, policy as code, run tasks and agents. Paid plans start at $0.10 per resource-month for Essentials, $0.47 for Standard and $0.99 for Premium, rated hourly. Those are orchestration charges, separate from AWS. [IBM completed its HashiCorp acquisition](https://newsroom.ibm.com/2025-02-27-IBM-Completes-Acquisition-of-HashiCorp,-Creates-Comprehensive,-End-to-End-Hybrid-Cloud-Platform) on February 27, 2025.

[OpenTofu](https://opentofu.org/) is the alternative under Linux Foundation stewardship. Its [license commitment](https://opentofu.org/manifesto/) retains MPL, with [MPL 2.0 specified in its official license](https://github.com/opentofu/opentofu/blob/main/LICENSE). Either tool can describe infrastructure; neither includes the server rental.

A state file deserves the same care as a credential. HashiCorp says [local state is plaintext and can include secret values](https://developer.hashicorp.com/terraform/language/state/sensitive-data). Marking a value sensitive doesn't make the local file encrypted. Keep state and saved plans out of Git, restrict access, and use an encrypted private backend with recovery tested. The [leaked API keys guide](/blog/leaked-api-keys-found-in-minutes-gitignore-rotation-plan/) covers the rotation work if a secret escapes.

## Match the box before pricing the cloud

On October 16 at 20:24 UTC, this server reported 48 logical CPUs. Its two Xeon Silver 4214 processors each have 12 physical cores and two threads per core: 24 physical cores in total. Memory reported 94 GiB usable. Two NVMe drives each reported 894.3 GiB, while the root filesystem reported 877 GiB total and 386 GiB used. These are read-only observations, not a benchmark.

The [published playbook](/blog/sovereign-ai-playbook-remote-desktop-commander/) recorded the OVHcloud SYS-5 family at $125 a month plus $125 installation on October 4. The [US Eco catalog](https://eco.us.ovhcloud.com/), checked again October 16, still lists that starting price, 96 GB RAM and two 960 GB NVMe drives. Its listed processors are Silver 4214R; our installed processors report 4214. This is a current family price, not a claim that the exact installed configuration is available to order today.

The network interface negotiated 10,000 Mb/s locally, but the catalog starts public bandwidth at 1 Gbps. A port negotiation isn't a measured internet transfer rate or a contractual bandwidth upgrade.

For AWS I chose **c6a.12xlarge in us-east-1**, Linux, shared tenancy, on-demand: 48 vCPUs and 96 GiB RAM. AWS [represents each hardware thread as a vCPU](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-optimize-cpu.html), and its [CPU options table](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/cpu-options-supported-instances-values.html) gives this instance 24 cores with two threads each. That matches thread count and memory capacity, not CPU generation, disk latency or job completion time. The [regional price file](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEC2/current/us-east-1/index.csv) lists $1.836 per hour. If memory must grow, m6a.12xlarge keeps 48 vCPUs but doubles RAM to 192 GiB at $2.0736 per hour; that is extra capacity, not the baseline comparison.

There is no GPU in this bill. Our [small quantized model work](/blog/small-quantized-models-96gb-ai-server/) uses CPU inference. Hosted model subscriptions and API calls remain separate costs on either host; [provider spending controls](/blog/diversify-ai-api-spend-across-providers/) cover that lane.

## A small AWS configuration with no inbound ports

This sketch creates the instance, its encrypted 900 GiB gp3 root disk, a security group and a daily snapshot policy retaining seven snapshots. The disk rounds up from one measured 894.3 GiB drive's capacity. EBS is a different storage service from the box's mirrored drives; matching usable capacity doesn't establish equal performance or recovery behavior.

Supply an existing VPC and public subnet with an internet-gateway route, an approved x86-64 Linux AMI with SSM Agent installed, an instance profile granting AmazonSSMManagedInstanceCore permissions, and a DLM execution role with snapshot permissions. Those prerequisites aren't created below. AWS [Session Manager](https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager.html) supports shell access and port forwarding without inbound ports. An authorized operator can forward a separately installed desktop service; this configuration doesn't install one. Set operator IAM permissions and require MFA separately.

**Provider and inputs.** The five values you supply:

```hcl
terraform {
  required_version = ">= 1.5"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}
provider "aws" {
  region = "us-east-1"
}
variable "vpc_id" { type = string }
variable "public_subnet_id" { type = string }
variable "ami_id" { type = string }
variable "ssm_instance_profile" { type = string }
variable "dlm_role_arn" { type = string }
```

**Security group.** No inbound rules at all; SSM Agent only needs outbound HTTPS:

```hcl
resource "aws_security_group" "workstation" {
  name_prefix = "ai-workstation-"
  vpc_id      = var.vpc_id
  # No inbound rules. SSM Agent connects outward over HTTPS.
  egress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
}
```

**The instance and its disk.** Metadata tokens required, the disk encrypted and tagged for backup:

```hcl
resource "aws_instance" "workstation" {
  ami                         = var.ami_id
  instance_type               = "c6a.12xlarge"
  subnet_id                   = var.public_subnet_id
  associate_public_ip_address = true
  vpc_security_group_ids      = [aws_security_group.workstation.id]
  iam_instance_profile        = var.ssm_instance_profile
  metadata_options {
    http_tokens = "required"
  }
  root_block_device {
    volume_type           = "gp3"
    volume_size           = 900
    encrypted             = true
    delete_on_termination = true
  }
  volume_tags = { Backup = "ai-workstation" }
  tags        = { Name = "ai-workstation" }
}
```

**Daily snapshots, seven kept.**

```hcl
resource "aws_dlm_lifecycle_policy" "daily" {
  description        = "Daily workstation EBS snapshots"
  execution_role_arn = var.dlm_role_arn
  state              = "ENABLED"
  policy_details {
    resource_types = ["VOLUME"]
    target_tags    = { Backup = "ai-workstation" }
    schedule {
      name = "daily-seven"
      create_rule {
        interval      = 24
        interval_unit = "HOURS"
        times         = ["03:00"]
      }
      retain_rule { count = 7 }
      copy_tags = true
    }
  }
}
```

The four pieces go in one file. I ran Terraform formatting and validation against them together successfully. I didn't apply it or create AWS resources. Validation checks configuration structure, not whether your AMI, IAM roles or network work together. The [from-scratch guide](/blog/self-hosted-ai-server-from-scratch/) covers the application layers; the [Windows desktop post](/blog/sovereign-windows-desktop-drive-backups/) and [container comparison](/blog/kubernetes-docker-podman-windows-vm-containers/) cover a different desktop and licensing setup. This is a Linux capacity bill, not a priced reproduction of Windows 11 inside a VM.

## The monthly bill, line by line

All amounts are USD, before tax, using **730 hours per month** and prices read October 16, 2026. Disk allocation is 900 GiB. Snapshot storage is an explicit **400 GB-month what-if**, not a measurement: seven retained incremental snapshots don't mean seven full disk copies, and changed blocks can make retained storage exceed this allowance. No extra gp3 performance is assumed beyond the included 3,000 IOPS and 125 MB/s.

The earlier desktop posts don't publish monthly traffic totals. The three egress volumes below are what-if cases for desktop video, exported files and downloads leaving AWS, not usage estimates. They assume the account's shared 100 GB monthly free internet-egress allowance is otherwise unused.

| Line item | Price | Per month |
|---|---|---|
| c6a.12xlarge, 730 h | [$1.836 an hour](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEC2/current/us-east-1/index.csv) | $1,340.28 |
| gp3 disk, 900 GB | [$0.08 per GB-month](https://aws.amazon.com/ebs/pricing/) | $72.00 |
| Snapshots, 400 GB what-if | [$0.05 per GB-month](https://aws.amazon.com/ebs/pricing/) | $20.00 |
| Public IPv4, 730 h | [$0.005 an hour](https://aws.amazon.com/vpc/pricing/) | $3.65 |
| Egress, first 100 GB out | [Free, then $0.09 per GB](https://aws.amazon.com/ec2/pricing/on-demand/) | $0.00 |
| **AWS total, 100 GB out** | | **$1,435.93** |
| **500 GB out** | +$36.00 egress | **$1,471.93** |
| **1,000 GB out** | +$81.00 egress | **$1,516.93** |

The base arithmetic is $1.836 × 730 + $0.08 × 900 + $0.05 × 400 + $0.005 × 730 = **$1,435.93**. At 500 GB out, (500 minus 100) × $0.09 adds $36. At 1,000 GB, the same calculation adds $81. That makes the three totals **$1,435.93, $1,471.93 and $1,516.93** a month. No extra gp3 performance or NAT gateway is included; both are explained in this section. AWS uses GB-month billing labels for EBS; the configured volume size is in GiB.

Against the published $125 monthly dedicated-server starting price, those AWS scenarios cost **$1,310.93, $1,346.93 or $1,391.93 more per month**. OVHcloud's listed $125 installation fee is additional in the first month. Independent backups, operator time, model subscriptions and API usage still need a budget on both sides; the AWS snapshot allowance isn't an independent backup plan for the sovereign box. Optional support, paid HCP plans, additional logging and cross-region copies aren't included. Neither figure is an all-in business operating cost.

The public IPv4 address provides outbound connectivity without a NAT gateway. No inbound security-group rule allows a stranger to use it. A private-subnet design could instead need paid endpoints or NAT, so it would require a different bill.

## Where AWS and Terraform earn their cost

For a temporary job, hours change the answer. Ten instance-hours at the same rate cost $18.36 before disk, snapshots and traffic. That can be a sensible way to rent a large worker for one task without carrying it all month. Stopping compute isn't a complete teardown: [EBS storage remains billable](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/how-ec2-instance-stop-start-works.html).

AWS also earns consideration when work needs managed services, deployment in several regions, or a particular regulated service offering. Check the service's actual regional availability and requirements. A single EC2 instance doesn't acquire availability across regions just because the provider has them.

Keep persistent work on the dedicated box and rent a GPU worker only for jobs that need one. Price its exact GPU, disk and runtime separately. This CPU comparison gives no basis for promising GPU savings. For workloads that can shut down fully between runs, rebuildable workers and scale-to-zero services change the economics; a desktop holding active sessions can't casually scale to zero. The [serverless cost comparison](/blog/serverless-hosting-cost-comparison-2026/) addresses those other hosting patterns.

## Where the sovereign box earns its rent

The $125 box is attractive when the work keeps needing large RAM, persistent files and desktop access throughout the month. Egress-heavy work also makes a metered network bill worth examining. The [best practices review](/blog/sovereign-ai-workstation-best-practices/) already covers the OVH and AWS desktop experience; the [operating guide](/blog/sovereign-ai-workstation-operating-system/) covers the maintenance work that predictable rent doesn't remove.

That operating responsibility includes recovery drills and safe updates. Use the [staged update procedure](/blog/safe-update-command-self-hosted-ai-server/) rather than treating a fixed server bill as permission to stop maintaining it.

## Keep the exit open

Infrastructure as code isn't an AWS feature. The [OVHcloud Terraform provider](https://registry.terraform.io/providers/ovh/ovh/latest/docs/resources/dedicated_server) has a dedicated-server resource. Its [official documentation](https://github.com/ovh/terraform-provider-ovh/blob/master/docs/resources/dedicated_server.md) covers ordering, referring to an existing server by service name, installation settings, monitoring and rescue configuration. That doesn't automatically describe every application or file on the machine. Review installation and import controls before bringing an existing workstation under management; a reinstall is a serious operation.

Terraform or OpenTofu can therefore record the provider layer while versioned configuration and backups preserve the working environment. Portability means retaining those layers, not expecting one provider's resource names to work unchanged on another. The [IaC deploy generator article](/blog/blog-tool-iac-deploy-generator/) introduces the habit for web hosting; its web-server starter isn't this workstation's access policy.

Before the first apply, review an [Infracost estimate](https://www.infracost.io/docs/) from its open-source CLI and set an [AWS budget alert](https://aws.amazon.com/aws-cost-management/aws-budgets/). Add [Cost Anomaly Detection](https://aws.amazon.com/aws-cost-management/aws-cost-anomaly-detection/) for unusual spending. Estimates and alerts need explicit usage assumptions; they aren't hard spending caps.

In week one, write the capacity and traffic assumptions beside the configuration, run validation, and review the plan before authorizing a small test. Test restoration and a teardown with `terraform destroy` on disposable infrastructure before trusting an hourly rental workflow. Check the plan for retained disks, snapshots and addresses, and keep recovery copies outside the teardown's reach.

In month one, compare the actual invoice with that first estimate and decide whether the worker should stay hourly, shrink, or move back to the persistent box. Don't commit state. Don't leave an idle GPU instance running. Don't price only the instance.

## Related reading

- [Sovereign AI Made Simple](/blog/sovereign-ai-made-simple/) for the series map.
- [The Sovereign Advantage](/blog/sovereign-advantage-dedicated-ai-workstation/) for the broader workstation comparison.
- [Small Quantized Models on a 96 GB Server](/blog/small-quantized-models-96gb-ai-server/) for the CPU model work behind this capacity choice.

## Fact-check notes and sources

Sources read October 16, 2026, approximately 20:24 to 20:30 UTC. Prices can change; all arithmetic above uses the stated region, quantities and on-demand Linux rates, without promotional credits or long-term commitments.

- **Dedicated server:** [OVHcloud US Eco catalog](https://eco.us.ovhcloud.com/), $125 monthly starting price and $125 installation for SYS-5. The [October 4 playbook](/blog/sovereign-ai-playbook-remote-desktop-commander/) supplies the earlier published baseline. Host capacity measured October 16 at 20:24 UTC; no performance benchmark or internet throughput test was run.
- **License and plans:** [HashiCorp's August 2023 announcement](https://www.hashicorp.com/en/blog/hashicorp-adopts-business-source-license), [license FAQ](https://www.hashicorp.com/en/license-faq), [current HCP plans](https://www.hashicorp.com/en/products/terraform/pricing), [IBM acquisition completion](https://newsroom.ibm.com/2025-02-27-IBM-Completes-Acquisition-of-HashiCorp,-Creates-Comprehensive,-End-to-End-Hybrid-Cloud-Platform), [OpenTofu](https://opentofu.org/) and [its MPL commitment](https://opentofu.org/manifesto/).
- **AWS prices:** [EC2 and EBS regional price list](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEC2/current/us-east-1/index.csv), [data-transfer regional price list](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSDataTransfer/current/us-east-1/index.csv), [EBS pricing and baseline performance](https://aws.amazon.com/ebs/pricing/), [public IPv4 pricing](https://aws.amazon.com/vpc/pricing/), and [on-demand pricing and shared free egress allowance](https://aws.amazon.com/ec2/pricing/on-demand/). c6a.12xlarge is $1.836/hour; m6a.12xlarge is $2.0736/hour. No Savings Plan, Reserved Instance or Spot discount is assumed.
- **Implementation:** [AWS vCPU definition](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-optimize-cpu.html), [CPU options](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/cpu-options-supported-instances-values.html), [Session Manager](https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager.html), [stopped instances](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/how-ec2-instance-stop-start-works.html), [snapshot lifecycle policies](https://docs.aws.amazon.com/ebs/latest/userguide/snapshot-lifecycle.html), and [state sensitivity](https://developer.hashicorp.com/terraform/language/state/sensitive-data).
- **Portability and cost checks:** [OVH provider resource](https://registry.terraform.io/providers/ovh/ovh/latest/docs/resources/dedicated_server), [official provider documentation](https://github.com/ovh/terraform-provider-ovh/blob/master/docs/resources/dedicated_server.md), [Infracost documentation](https://www.infracost.io/docs/), [AWS Budgets](https://aws.amazon.com/aws-cost-management/aws-budgets/) and [Cost Anomaly Detection](https://aws.amazon.com/aws-cost-management/aws-cost-anomaly-detection/).

*This post is informational, not legal, licensing or financial advice. Product references are nominative fair use. No affiliation is implied.*


---

Canonical HTML: https://jwatte.com/blog/aws-terraform-costs-vs-sovereign-ai/
RSS: https://jwatte.com/feed.xml
JSON Feed: https://jwatte.com/feed.json
Hero image: https://jwatte.com/images/aws-terraform-costs-vs-sovereign-ai.webp