# Your Terraform IaC Module Should Say No Before Your Cloud Bill Does: Cloud High Availability for $0 (Part 1 - Architecture & Trade Offs)

What if your next MVP could run on two servers behind a load balancer, with nothing but your website exposed to the internet, and your infrastructure code refused any change that would turn your free project into a monthly bill?

You can do that with this open-source Terraform module on Oracle Cloud's Always Free tier.

- **Terraform Registry**: [devsahamerlin/alwaysfree-and-flexible-ha-compute-service/oci](https://registry.terraform.io/modules/devsahamerlin/alwaysfree-and-flexible-ha-compute-service/oci)
- **Ready-to-run example**: [examples/example-1](https://registry.terraform.io/modules/devsahamerlin/alwaysfree-and-flexible-ha-compute-service/oci/latest/examples/example-1)
- **GitHub**: [devsahamerlin/terraform-oci-alwaysfree-and-flexible-ha-compute-service](https://github.com/devsahamerlin/terraform-oci-alwaysfree-and-flexible-ha-compute-service)

![](https://cdn.hashnode.com/uploads/covers/663da93590b852c029e026ff/08a5e85d-bc3c-4060-a8b2-abbb58e998bc.png align="center")

---

## The hidden cost of the free shortcut

Your side project, student lab, internal tool or startup MVP reaches the same point sooner or later. You need what production has: more than one server, a single controlled entry point, private networking, and administrator access that isn't open to everyone. You rarely have a budget for it.

The usual shortcuts each carry a cost that shows up later:

- **One public server.** One failure takes your service down, and an administration port open to the internet is one of the first things automated scanners look for.
- **A free setup built by hand.** It works until someone on your team adds one more server, a second load balancer or daily backups. Then your "**free**" project starts billing, and you only find out when the invoice arrives.
- **Starting over when your project succeeds.** Infrastructure built for a demo rarely survives your first real customers, so you pay for it twice.

![](https://cdn.hashnode.com/uploads/covers/663da93590b852c029e026ff/d92b9a4f-d719-49a6-a8fa-9e66a7b0b876.png align="center")

## Why this matters for you ?

Oracle halved the compute part of its Always Free tier: 2 processor units (OCPUs) and 12 GB of memory in total, down from 4 and 24. If your setup was sized for the old allowance, it now generates charges. The other limits are easy to miss as well: one load balancer, 200 GB of storage, 5 backups, and every resource in the home region you chose at sign-up. If you rely on the free tier, you now have to decide whether to resize, pay, or move.

## What (success) looks like for you

| Outcome | How you measure it |
| --- | --- |
| No monthly bill with the defaults | Estimated cost: $0.00/month. Usage beyond the allowances, such as outbound data or more than 20 GB of object storage, stays billable |
| None of your servers reachable directly from the internet | Only web traffic reaches your load balancer; your administrators connect through a managed gateway, limited to known IP addresses, with sessions that expire after 3 hours |
| Your service survives the loss of one server | Two servers behind a load balancer that takes an unhealthy server out of rotation, placed in separate data centers when your region has more than one |
| Growth without a rewrite | One setting moves you to paid capacity, with the same architecture |
| Cost and security checked before anything changes | Configurations outside the free tier are rejected before deployment, and automated checks run on every proposed change to the module |

## Options compared

| Option | Effort to start | Monthly cost | Main risk | Path to growth |
| --- | --- | --- | --- | --- |
| One public server | Low | $0 | Single point of failure, exposed administration access | Rebuild |
| Hand-built free setup | Medium | $0 until a change crosses a limit | Not reproducible, charges noticed late | Manual and error-prone |
| Credit- or time-limited free trial | Low | $0 until the trial ends | A bill or a shutdown when the trial ends | Depends on the provider |
| Container orchestration platform | High | Depends on the setup | More operating effort than a two-server workload needs | Good, at a higher operating cost |
| **Reusable Terraform IaC module with cost checks** | Low: about 15 minutes for your first deployment | $0 by default, anything billable rejected before deployment | Tied to one cloud provider and its free-tier rules | One setting |

With the module, you keep your cost under control and your growth path open from day one. The price you pay is a dependency on one provider, covered in the trade-offs below.

## How the chosen approach works

Your whole setup is described as code, so every environment you create is the same, and each change you make is checked against the free-tier limits before anything is deployed:

![](https://cdn.hashnode.com/uploads/covers/663da93590b852c029e026ff/d0681cc9-353f-4f8a-ac58-56a9460839fc.png align="center")

- **One public entry point.** Your users only reach the load balancer, and only for web traffic. Your servers have no public address.
- **Administrator access through a managed gateway**, limited to the IP addresses you allow, with sessions that expire after 3 hours. No administration port is open to the internet.
- **Cost checks before deployment.** A change that would leave the free tier is rejected with the limit it crosses. Moving to paid capacity stays your deliberate choice: one setting, same architecture.

## Trade-offs accepted

- **10 Mbps of load balancer bandwidth.** Enough for your MVP, internal tool or demo, not for video or large downloads. A content delivery network for your static files, or paid bandwidth, lifts the limit.
- **Resilience inside one region only.** You get no recovery across regions. In regions with a single data center, both of your servers share it, and their placement on separate hardware isn't guaranteed yet: it is the next item on the roadmap.
- **The free database is reachable over the internet**, protected by an encrypted wallet and a password rather than by private networking. That is a limitation of the free tier; paid mode gives your database a private address.
- **Provider-managed encryption keys.** Your data is encrypted at rest with nothing for you to operate. If you handle regulated data, such as payments, health or personal data, you need customer-managed keys.
- **Short-lived administrator sessions.** They expire after 3 hours and are recreated at your next deployment: safer, and less convenient for you.
- **A dependency on one provider and its free-tier rules.** The code is specific to Oracle Cloud, and Oracle can change the allowance again, as it just did. The architecture pattern (private servers, one public entry point, managed administrator access, cost checks before deployment) carries over to other clouds; the code doesn't. The limits live in one place in the code, so following a new allowance is a small change for you.

## What it delivers today

- **An estimated $0.00 per month with the defaults**, for two servers, a load balancer, managed administrator access, private storage and one data volume per server.
- **Billable changes stopped before deployment.** Tested against a real Oracle Cloud account: the free defaults and a paid configuration go through, while more compute, a second load balancer and scheduled backups are rejected in free mode, each with the limit it crosses.
- **A smaller attack surface.** No server has a public address, only web traffic is exposed, and the automated security scan reports no failed check, with each accepted exception written down with its reason.
- **About 15 minutes from an empty account to a running service.** In the automated tests, a reduced environment (network and one server) is ready in about 76 seconds, then removed.
- **Defects caught before users found them.** A review before release found four problems that the automated checks had missed, including a load balancer that served no traffic. They are fixed, and a test now covers each of them.

## Recommendation

Start in free mode for your prototypes, MVPs, labs, internal tools and demos. Decide now which signals will move you to paid mode, and write them in your roadmap:

![](https://cdn.hashnode.com/uploads/covers/663da93590b852c029e026ff/9bf93528-913b-4211-b5f9-c353ca185384.png align="center")

## Your next step

- **If you are evaluating this for your team**: you need one sandbox Oracle Cloud account and an hour. About 15 minutes go to your first deployment; use the rest to check the trade-offs above against your own constraints and to write down your paid-mode triggers.
- **If it solves a problem you have**: star the repository, open an issue with what you need next, or send a pull request.
- **If you are weighing this kind of architecture for your organization**: reach out on LinkedIn to walk through the trade-offs for your context.

---

In **Part 2 - IaC Implementation**, you will see how the code enforces these decisions: cost checks that stop your change before deployment, tests that run without a cloud account, and how you deploy it in about 15 minutes.