DEV Community

Ace7-coder
Ace7-coder

Posted on

AWS FinOps Field Notes: Detecting CPU Credit Depletion and Runaway Dev Workloads

#aws #python #finops #devops

While auditing cloud infrastructure costs this week, recurring configuration gaps continue to quietly inflate monthly bills.

Field Insight: The Hidden Cost Trap

Preview app workers stuck in OOM-kill loops burning CPU credits, combined with unoptimized logging clients streaming request bodies that silently double monthly cloud costs.

Automated Detection: Flagging Exhausted T-Series CPU Credits with Boto3 

import boto3
from datetime import datetime, timedelta, timezone

def audit_cpu_credits(region='us-east-1'):
    cw = boto3.client('cloudwatch', region_name=region)
    ec2 = boto3.client('ec2', region_name=region)
    now = datetime.now(timezone.utc)
    one_day_ago = now - timedelta(days=1)

    reservations = ec2.describe_instances(
        Filters=[{'Name': 'instance-state-name', 'Values': ['running']}]
    ).get('Reservations', [])

    flagged = []
    for r in reservations:
        for inst in r['Instances']:
            i_type = inst['InstanceType']
            if not i_type.startswith(('t2.', 't3.', 't4g.')):
                continue
            i_id = inst['InstanceId']
            res = cw.get_metric_statistics(
                Namespace='AWS/EC2',
                MetricName='CPUCreditBalance',
                Dimensions=[{'Name': 'InstanceId', 'Value': i_id}],
                StartTime=one_day_ago,
                EndTime=now,
                Period=3600,
                Statistics=['Average']
            )
            points = res.get('Datapoints', [])
            if points and points[-1]['Average'] < 10:
                flagged.append(i_id)
                print(f"[ALERT] {i_id} ({i_type}) has exhausted CPU credit balance.")
    return flagged

if __name__ == '__main__':
    audit_cpu_credits()
Enter fullscreen mode Exit fullscreen mode

Running ad-hoc scripts in a single account or region does not scale across enterprise AWS Organizations. Sustained cloud cost governance requires automated anomaly detection, cross-account STS role assumption, and scheduled auditing.

  • 📦 Download Free Single-Account Core: Free Lite Package | GitHub
  • 💼 Managing Multiple Accounts or Client Infrastructure?
    • Practitioner License ($99): Single-account CLI scanner, compliance exports, and dynamic bash remediation.
    • Consultancy & Agency Pack ($499): Automated multi-account STS role assumption, CloudFormation StackSets, and branded executive PDF showback reports.

👉 Get the AWS Cloud Cost Auditor on Gumroad

Top comments (0)