AWS cost optimization: where cloud bills go wrong

1. Resources attached to nothing

The first pass is always the same and always finds something: unattached EBS volumes, snapshots of instances long gone, unassociated elastic IPs, load balancers with no healthy targets, NAT gateways in subnets nothing routes through any more.

These carry no performance risk to remove — only the risk of removing something that is quietly needed. Map each to an owner, give a notice window, then delete.

2. Non-production running around the clock

Development, staging, QA and demo environments typically need to exist for around fifty of the week's 168 hours. Left running continuously, roughly two-thirds of their cost buys nothing.

Scheduled start and stop is the highest return-on-effort change available in most estates, and it is reversible with a single parameter.

3. Sizing chosen before there was data

Instance families and sizes are usually picked at launch from an estimate, or carried over from physical hardware during a migration, then never revisited. Utilisation over a representative period — including peaks and including month-end — tells you the truth.

Two adjacent wins usually appear at the same time: moving to a current-generation family, and moving suitable workloads to Graviton. Both reduce cost per unit of work without changing the architecture.

4. Storage that never ages

Storage accumulates silently, which is what makes it the most common cause of a bill that grows faster than traffic.

• Objects sitting in standard storage that have not been read in a year
• Log groups with no retention policy set — the default is forever
• Backup and snapshot chains with no expiry
• Multiple copies of the same dataset across environments
• General-purpose volumes provisioned for a throughput requirement that never materialised

Lifecycle policies and retention settings are the fix, and they are configuration rather than engineering.

5. Data movement nobody attributed

Data transfer rarely appears as a single alarming line, which is why it survives. Cross-availability-zone chatter between services that did not need to be separated, egress that should have been served from a CDN, and NAT gateway processing for traffic that could have used a VPC endpoint.

Finding it requires the Cost and Usage Report rather than the console summary, but the architectural fix is often small.

6. Pricing models applied in the wrong order

Savings Plans and Reserved Instances are real reductions for genuinely steady workloads. The mistake is sequencing: committing before rightsizing locks in the oversizing for one or three years and makes it harder to fix, not easier.

Model commitments against a baseline you have already cleaned, cover the portion of usage you are confident is permanent, and leave headroom on demand. For interruption-tolerant batch work, Spot capacity is a larger reduction than any commitment.

Making it hold

Every estate drifts. What stops the drift returning is a tagging standard that is actually enforced, budgets and anomaly alerts routed to someone who owns the number, and a short monthly review. Without those, expect to repeat the exercise within a year.