AWS Defaults Problem: A FinOps Playbook for Engineering Teams

#aws #ai #programming #techtalks

AWS doesn’t have a pricing problem. It has a defaults problem.

Every default in AWS is chosen for day-one convenience – get the resource up, get the demo working, ship the feature . Nobody is paged when a default quietly compounds into a five-figure line item eight months later. That’s the pattern behind almost every “why is our bill so high” investigation:

T3 and T4g instances default to Unlimited credit mode – an undersized workload bursts past its baseline and racks up surplus charges no one is watching for.
Auto-assign public IP is on by default, leaving a ~$3.65/month charge on every instance whether it’s actually reachable from the internet or not.
S3 buckets provisioned without a lifecycle policy keep cold, unread data at hot-storage rates indefinitely.

None of these are AWS “gotchas.” They’re reasonable defaults for a proof of concept that nobody revisited once the workload became production.

This playbook covers the full FinOps discipline – visibility, rightsizing, commitments, Spot, storage and data transfer and closes with a deep dive into the single cleanest example of the pattern: CPU credits.

Everything below rests on one premise: you cannot optimize what you cannot see.

Tagging: The Price of Visibility

An untagged resource is invisible waste. Nobody owns it, nobody deletes it, and it bills the account every month, potentially for years.

Do this:

Define a mandatory tag schema – Environment, Team, Application, Owner, CostCenter. Five tags, not fifty.
Enforce it with Organizations tag policies and SCP conditions on supported resource types.
Kill drift at the source with an EventBridge + Lambda auto-tagger that stamps every new resource with creator, date, and account at creation time.
Track untagged% as a weekly KPI. Under 2% is healthy. Above 10% means your cost allocation is fiction.

[ Also Read - What Is Agentic AI Data Engineering? ]

Build the Visibility Pipeline First

Ingest the Cost & Usage Report (CUR) into your own store – Athena or ClickHouse. Cost Explorer is built for humans clicking around; the CUR is built for automation.
Use AWS Budgets as tripwires and anomaly detection as the real alarm. Budgets tell you at month-end. Anomaly detection tells you on day two.
Distinguish one-time spikes (a pentest, a migration) from step changes (a new resource class, a rightsizing miss that never gets corrected). Spikes are noise. Step changes compound.

Rightsizing: Profile Before You Pick

The most common EC2 mistake isn’t choosing the wrong instance family — it’s sizing off a bad sample. A workload profiled for ten minutes on a random Tuesday gets permanently sized for that Tuesday’s peak, then runs 24/7 at 15% utilization for the next two years.

Review average vs. peak CPU/network on a rolling 30-day window, every month. Below ~20% average CPU on a fixed-performance instance is a signal to downsize one or two sizes.
Consistently above baseline on a burstable instance means the wrong family was chosen, not the wrong size – see the CPU credits deep dive below.
Graviton-compatible workloads get up to ~40% better price-performance. Default new deployments to t4g / m6g / c6g / r6g unless there’s a hard x86 dependency.

Commitments: Pay Less for What You Already Do

Savings Plans should cover roughly 70–80% of your stable baseline — the always-on floor of your compute. Let commitments cover the floor; let autoscaling — not over-provisioning — handle the variance above it.
Track both coverage and utilization on every commitment. An unconsumed commitment is worse than no commitment at all.
Start broad with 1-year Compute Savings Plans, then layer 3-year EC2 Instance Savings Plans onto your most predictable, stable workloads.

Spot for Anything That Can Die Gracefully

Stateless web tiers, batch processing, CI runners, EKS/Karpenter workloads – all strong Spot candidates at 60–90% off on-demand pricing.
Diversify instance families and capacity pools, and design workloads for interruption (checkpointing, graceful drain) rather than trying to design around it.
Critical: run Spot-backed burstable instances in Standard credit mode. Short-lived Spot instances never live long enough to earn credits before bursting – more on why this matters below.

Storage Hygiene: The Compounding Leak

EBS
Default to gp3 — roughly 20% cheaper than gp2, with 3,000 IOPS / 125 MB/s included at no extra charge.
Run a weekly sweep for unattached volumes. A stopped instance’s disk keeps billing forever if nobody notices.

S3
Every bucket needs a lifecycle policy or Intelligent-Tiering from day one. “We’ll script it later” turns into two years of Standard-rate storage on data nobody reads.

Snapshots
Orphaned AMIs and old snapshots are the classic audit finding – both financially and as a data-exposure risk. Put them on an archive-or-delete schedule.

Read For - AWS Defaults Problem: A FinOps Playbook for Engineering Teams

DEV Community