Internal tools behind VPN architecture
Admin and back-office apps reachable only over the VPN, on a single instance with a small database.
Every resource, and what it costs.
Projections from August 2026 list prices for always-on resources. Connect an account and these become the figures your provider actually bills.
| Node | Type | What it is | Projected |
|---|---|---|---|
| Site-to-site VPN | Network | 1 tunnel | $36/mo |
| Tools host | Compute | 2 vCPU · 4 GB | $30/mo |
| Tools database | Database | db.t4g.large · single-AZ · 100 GB | $105/mo |
| Backups | Storage | 100 GB standard | $6.00/mo |
| CloudWatch logs | External | 30 GB ingested | $9.00/mo |
Agent steps are priced from provider-reported token usage once the agent runs, not estimated. Guardrails cost nothing and are the reason a runaway agent cannot.
Similar templates.
Three-tier web application
The default shape: load balancer, containerised app tier, managed Postgres, cache and asset storage.
Serverless API
HTTP API with function compute and a key-value store. Scales to zero; the floor is the gateway.
Static site on CDN
Marketing site or SPA served from object storage behind a CDN, with DNS and a WAF in front.
Open Internal tools behind VPN on the canvas.
It loads as an editable graph. Connect an account or instrument an agent and the projected figures above become measured ones.