I used to have a nginx + apache configuration when I was running VestaCP, and my ram and cpu usage was very high, I even thought I may have misconfigured the values. When I moved to HestiaCP I choose to go with only nginx + php-fpm instead and ditch apache.
I also realised one thing that really messes with CPU usage is allowing wordpresss XML-RPC to keep running. I saw in my logs that random IPs were hammering xmlrpc.php on my wordpress sites.
I have a 4 core linode and when the bots were trying to brute force the xmlrpc.php api I was getting about 20% across all cores and that site was getting 0 real visitors. So after I blocked it the cpu utilization only went up when I or a visitor loaded the site.
I also used the fastcgi cache and it really helps. I tried using k6 performance testing and I ran into nginx setting limitations before maxing out my cpu. Where else without caching even a load of 50 would max out my CPU usage. With caching I think I did a few thousand VUs(it was a long time ago I don’t remember). Bottom line my recommendation would be to use caching when possible and block access to xmlrpc.php
The way I block xmlrpc.php is in my nginx template (if you like I can include the whole thing but below is really the only bit you would need. Add it in your server { } of the wordpress template and make a copy with a different name of it will be overwritten during updates. Remember to add your own servers ip addresses so it can be accessed internally.);
location = /xmlrpc.php {
allow 127.0.0.1;
allow Public IPv4;
allow Private IPv4;
allow Public IPv6;
allow Private IPv6;
deny all;
}
As for how many cores I would say at least 2 cores 4gb of ram. But if you can swing it, 4 cores and 8gb of ram would be better. I would not go to amazon, linode(or digital ocean) would be a much cheaper option.