DEV Community

Cover image for Your Cloud Bill Is Full of Zombies. Here’s How I Hunt Them Down.
Asif Muzammil
Asif Muzammil

Posted on Edited on Originally published at builder.aws.com

Your Cloud Bill Is Full of Zombies. Here’s How I Hunt Them Down.

#aws #devops #docker #finops

Whether you operate on AWS, Microsoft Azure, or Google Cloud (GCP), every cloud engineer has shared that same sinking feeling on the 1st of the month:

You open your billing dashboard, expecting a quiet staging bill, only to find a shocking budget spike. The knee-jerk reaction is almost universal: "The cloud provider is overcharging me!"

As an AWS Solutions Architect and Community Builder, I challenge that assumption. In most cases:

The cloud provider is not responsible for your high bill. The cloud did exactly what you asked it to do.

The bill is simply the cumulative total of everything we provisioned and never cleaned up. Under the spirit of the Shared Responsibility Model, cloud providers maintain the underlying infrastructure 24/7/365, but we, as engineers, own resource lifecycle hygiene and the Cost Optimization Pillar of the Well-Architected Framework.

To be fair, a few hyperscaler defaults make this easy to miss:

  • Non-root EBS storage volumes can easily outlive the EC2 instance they were attached to.
  • Since 2024, AWS charges for all public IPv4 addresses ($0.005/hour), making unassociated Elastic IPs quiet budget drains.
  • Test VPCs and Kubernetes clusters often leave highly-available NAT Gateways running in the background.

Across every cloud provider, silent budget killers known as Zombie Resources bleed organizations 24/7:

  • In AWS: Idle VPC NAT Gateways ($32.40/mo each), detached EBS volumes ($0.08–$0.125/GB/mo), unassociated Elastic IPs ($3.65/mo each), and untagged ECR container images.
  • In Azure: Orphaned Managed Disks and unattached Static Public IPs lingering post-VM deletion.
  • In Google Cloud: Dangling Persistent Disks and idle Cloud NAT gateways incurring fixed hourly tariffs.

Where the Quiet Waste Hides

Zombie Resource Typical Cost (us-east-1) How It Happens
Orphaned EBS Volume ~$0.08 / GB-mo (gp3) → 100 GB is ~$8.00/mo EC2 instance terminated, but non-root attached volume is retained
Idle VPC NAT Gateway ~$0.045 / hour → ~$32.40/mo (+ data fees) EKS cluster, ECS VPC, or test environment deleted, but NAT left behind
Unassociated Elastic IP $0.005 / hour → ~$3.65/mo Public IPv4 allocated and forgotten (billed since 2024 IPv4 pricing update)
Untagged Dangling ECR Images ~$0.10 / GB-mo CI/CD container pipelines pushing layers without automated lifecycle policies

(Prices vary by region and change over time. Always verify against official AWS pricing pages).

None of these looks terrifying in isolation. But multiply them across multiple regions, multiple staging/dev accounts, and 12 billing cycles, and they become a substantial line item that nobody owns.

The problem is not the cloud. Fast-moving development teams lack a simple, safe way to audit lifecycle hygiene regularly.

Why Start with AWS?

While cloud financial waste is an industry-wide epidemic across all hyperscalers, as an AWS Community Builder (Containers) and AWS Solutions Architect, I decided to solve this problem for the ecosystem I know and love the most: The AWS Community.

My goal was simple:

Build a zero-knowledge, 100% read-only waste auditor that any engineer can run in under 30 seconds with zero security friction.

That is how CostGuard Cloud (AWS Edition) 🛡️ was born.

The Zero-Trust Architecture: Why Engineers Love It

Most FinOps tools suffer from massive onboarding friction. They require intrusive SaaS agents, long sales calls, or write access to your cloud account.

CostGuard is built on four core architectural principles:

1. Audit, Don't Destroy (Human in the Loop)

CostGuard never auto-deletes anything. It identifies dormant resources and outputs the exact, reviewable AWS CLI remediation commands so a human engineer remains in full control.

2. Strictly Read-Only (Mathematical Safety)

CostGuard relies exclusively on AWS Describe* and Get* APIs (or the AWS-managed SecurityAudit policy). It has zero delete or modify permissions.

3. All You Need is Docker (Zero Dependencies)

No Python environments, no pip installs, and no local dependency conflicts. If you have Docker running (Linux, Mac, or Windows), you can run a complete multi-region audit with a single line.

4. Local & Transparent (Zero Telemetry)

The audit runs locally on your machine, produces zero telemetry (no external analytics pings), and the source code is 100% open for you to inspect.

30-Second Quickstart

If you have Docker and your AWS CLI configured, run: 

docker run --rm -it \
  -v ~/.aws:/root/.aws:ro \
  -v $(pwd)/costguard-report:/app/output \
  ghcr.io/asifmuzammil/costguard:latest scan
Enter fullscreen mode Exit fullscreen mode

A Note on :ro: The :ro flag mounts your ~/.aws folder in strictly read-only mode, ensuring the container cannot modify your credential files at the OS level. However, read-only does not mean unreadable. If you are security-conscious, I recommend the Disposable Identity approach below.

"Paranoid Mode": A Disposable Read-Only Identity

Don't want to use your everyday credentials? Create a temporary, disposable IAM user with AWS's official SecurityAudit policy, run the scan, and tear it down completely:

1. Create a disposable read-only IAM user 

aws iam create-user --user-name costguard-audit
aws iam attach-user-policy --user-name costguard-audit \
  --policy-arn arn:aws:iam::aws:policy/SecurityAudit
aws iam create-access-key --user-name costguard-audit
Enter fullscreen mode Exit fullscreen mode

2. Save the returned keys into a temporary profile 

aws configure --profile costguard-audit
Enter fullscreen mode Exit fullscreen mode

3. Run the 30-second audit 

docker run --rm -it \
  -v ~/.aws:/root/.aws:ro \
  -v $(pwd)/costguard-report:/app/output \
  ghcr.io/asifmuzammil/costguard:latest scan --profile costguard-audit
Enter fullscreen mode Exit fullscreen mode

4. Clean up completely (Zero footprint left behind) 

aws iam delete-access-key --user-name costguard-audit --access-key-id <ACCESS_KEY_ID>
aws iam detach-user-policy --user-name costguard-audit \
  --policy-arn arn:aws:iam::aws:policy/SecurityAudit
aws iam delete-user --user-name costguard-audit

# Finally, remove [costguard-audit] from your ~/.aws/credentials file
Enter fullscreen mode Exit fullscreen mode

The Deliverable: Instant Executive Report
In under 30 to 60 seconds, CostGuard delivers:

Real-time Terminal Output: A clear colored breakdown of wasted resources, monthly cost penalties, and 1-click CLI remediation commands.

Interactive HTML Dashboard: Saved locally in ./costguard-report/index.html. It features clean charts, cost summaries, and an Export / Print to PDF option that engineers can hand directly to their CTO or engineering manager.

(Cost figures are estimates designed to help you prioritize cleanup, not an official AWS invoice).

How CostGuard Differs from Native AWS Tools
AWS provides powerful built-in tools like AWS Cost Explorer, Compute Optimizer, and AWS Trusted Advisor.

However, many of Trusted Advisor's actionable cost optimization checks require a Business or Enterprise Support plan (which starts at $100+/month minimum). CostGuard Cloud brings that visibility to every developer, freelancer, startup, and sandbox account for 100% FREE with zero setup inside the account.

The Roadmap: Multi-Cloud is Coming 🚀
While Version 1.0 is engineered specifically for AWS workloads, the name is CostGuard Cloud for a reason.

We are actively developing scanners for:

Azure Edition: Orphaned Managed Disks, Unassociated NICs, Idle App Service Plans.

GCP Edition: Unused Persistent Disks, Idle Cloud NATs, Unattached Static IPs.

Try It Today on Your AWS Account
CostGuard Cloud is 100% free, open-source, and has zero telemetry (no tracking tokens, no external pings).

👉 GitHub Repository: asifMuzammil/costguard-cloud

docker run --rm -it \
  -v ~/.aws:/root/.aws:ro \
  -v $(pwd)/costguard-report:/app/output \
  ghcr.io/asifmuzammil/costguard:latest scan
Enter fullscreen mode Exit fullscreen mode

Test it on your sandbox or staging account today, and drop a comment below with how much monthly waste you uncovered! ⭐ A star on GitHub helps other cloud engineers discover it!

👨‍💻 Connect with Me

Top comments (0)