Where AWS savings actually hide: notes from cost audits

Every AWS bill we audit tells the same story: nobody decided to overspend, and yet 20–40% of the bill is waste. It accumulates the same way in every company — through defaults, forgotten experiments and “we’ll fix it later.” Here’s where it hides, ordered by how much work it takes to claw back.

Tier one: delete things (days of work)

Zombie resources. Unattached EBS volumes, idle load balancers, elastic IPs held for nothing, snapshots multiplying since 2023, dev instances someone spun up for a demo. Boring, unglamorous, and routinely 5–10% of the bill. You cannot find these without tagging discipline — which is why the real first step of any cost program is making resources attributable.

Dev and staging running 24/7. Non-production environments needed 50 hours a week and billed for 168. Scheduling them off nights and weekends is a solved problem that most teams simply never get around to.

Log and storage hoarding. CloudWatch logs with no retention policy, S3 buckets full of never-read data in the Standard class. Lifecycle rules to Infrequent Access and Glacier take an afternoon and pay forever.

Tier two: resize and commit (weeks)

Rightsizing. Instances sized by guesswork at launch and never revisited — utilization graphs flat at 12%. The same applies to RDS, where over-provisioning hides best because databases feel scary to touch.

Savings Plans and Reserved Instances. Once usage is cleaned up and stable, committing to the baseline is a straight discount — often 30–40% on compute — for a signature. The order matters: commit after rightsizing, or you’re bulk-buying your own waste. This is the most common sequencing mistake we see.

NAT gateways and data transfer. The bill’s dark matter. Cross-AZ chatter, traffic routed through NAT that could use VPC endpoints, unnecessary egress. Nobody looks here because the line items are cryptic — which is exactly why there’s money in them.

Tier three: architecture (months, biggest ceiling)

Spiky workloads on always-on instances that should be serverless or scheduled batch. Kubernetes clusters provisioned for peak with no autoscaling. Self-managed services on EC2 that a managed equivalent runs cheaper once you count the engineering hours babysitting them. These changes cost real engineering time — they’re also where a second 20% lives after the easy tiers are done.

Making it stick

The audit is the easy part; staying optimized is cultural. Three habits do most of the work: cost as a tagged, attributable metric engineers actually see (a team that never sees its spend can’t manage it), anomaly alerts so surprises surface in days rather than at month-end, and a quarterly rightsizing pass on the top ten line items — the bill re-grows waste the way gardens grow weeds.

If your bill has crossed the threshold where these percentages are real money, a cost audit pays for itself quickly — ours are run by AWS-certified engineers as fixed, bounded engagements, and everything we change ships as Terraform so the savings don’t evaporate when we leave.