ECS AirGap Sizing Calculator (S3-only)
Use this calculator to estimate how many Vault Agent VMs you need, whether your vault window is achievable, and what network bandwidth to provision.
Assumptions
- S3 only (CAS not supported)
- Per-agent capacity in a 4-hour window is 30–40 TB (conservative vs. validated)
- Capacity scales linearly with agents
- Bandwidth formula: Gb/s ≈ (TB moved × 8192) / (window_seconds)
Tip: For this profile, ≈0.245 TB/day is a representative S3 increment.
Target 2 h; 4 h absolute max.
Throughput capped by min(NIC, 6 Gb/s empirical).
Diminishing returns: 5 jobs ≈1.33× vs 1 job.
Default 37.5 (=7.5×5×S3 efficiency).
Penalties start ≥100 M (−15%), ≥200 M (−30%).
Penalties: <256 KB (−25%), 256 KB–1 MB (−10%).
Per-job rate: 37.5 MiB/s
Concurrency speedup: × 1.333 (jobs=5)
Penalties (size×count): × 1
Per-agent throughput (capped): 0.39 Gb/s
Aggregate available: 0.78 Gb/s
Total capacity this window: 0.687 TB
Required aggregate: 0.28 Gb/s
Hours required: 0.73 h
Headroom: 1.27 h
Agents required: 1
✅ Within window: Current agents and settings complete within the selected vault window.
Assumptions & Notes
- Baseline per-job rate uses CAS average 7.5 MiB/s scaled by 5× for S3 efficiency; tune if you have onsite measurements.
- Parallel efficiency matches plan guidance: 5 jobs ≈ 0.75× serialized time (≈ 1.33× speedup), up to 10 jobs with diminishing returns.
- Throughput is capped by min(NIC, empirical ≈ 6 Gb/s per agent). Upgrade links or add agents to increase aggregate.
- Window capped to 4 h; aim for 2 h target per security posture.