🔍 $500/month quietly vanishing from your AWS bill while your app sits idle? Here's what's draining it — and how to fix it.
THE HIDDEN CULPRITS
Most idle-cost leaks fall into four categories that AWS billing doesn't make obvious:
→ Inactive VPC Interface Endpoints billed at ~$0.01/hr/AZ even with zero traffic
→ NAT Gateway processing charges on S3/DynamoDB traffic that could be free with Gateway Endpoints
→ Orphaned EBS volumes and snapshots charged at full rate — identical to active volumes
→ Public IPv4 addresses costing $0.005/IP/hour since February 1, 2024 — attached or not
AWS Trusted Advisor check c2vlfg0jp6 specifically flags VPC interface endpoints that have processed 0 bytes in the last 30 days. That's a direct money leak with no operational benefit.
AWS docs confirm: replacing S3 and DynamoDB NAT traffic with free Gateway VPC Endpoints eliminates both the data-processing AND hourly charges for those traffic types. No code changes required — just a route table update.
AWS Compute Optimizer now surfaces idle-resource recommendations (NatGateway, EBSVolume, EC2Instance, RDSDBInstance) integrated directly into Cost Optimization Hub, which deduplicates overlapping signals across tools.
THE REMEDIATION CHECKLIST
- Enable visibility tooling first — zero cost, under 15 minutes.
Enable Cost Optimization Hub:
AWS Console → Cost Optimization Hub → Activate
Enable Compute Optimizer:
aws compute-optimizer update-enrollment-status --status Active
Run Trusted Advisor check c2vlfg0jp6 for your zero-traffic endpoint list.
Ingest cost signals. Review Cost Explorer VPC/PrivateLink/EC2-Other line items. Document each idle resource — endpoint IDs, NAT Gateway IDs, EIP allocation IDs, orphaned snapshot IDs — with confirmed per-item monthly cost. Effort: ~1.5 hours.
Evaluate the NAT-vs-endpoint trade-off.
→ S3/DynamoDB traffic → free Gateway Endpoint (no hourly charge)
→ SSM access → Interface Endpoint at $0.01/hr/AZ (3 endpoints needed)
→ Internet egress → keep NAT Gateway
Run this CloudWatch Logs Insights query to see what's flowing through your NAT:
filter (dstAddr in ["YOUR-NAT-PRIVATE-IP"]
AND isIpv4InSubnet(srcAddr, "YOUR-VPC-CIDR"))
| stats sum(bytes) as bytesTransferred by srcAddr, dstAddr
| sort bytesTransferred desc
Draft a Well-Architected Cost Optimization report. Document current-state vs. target-state architecture with Mermaid diagrams. Include cost-per-option numbers for each networking path. Effort: ~2 hours.
Deliver the report. PDF + Markdown. Per-item pricing estimates. Optional walkthrough call. Effort: ~1 hour.
Optional: Hands-on implementation. If you'd rather have someone execute the changes in your account — scoped fixed-fee engagement, typically 8–16 hours depending on environment complexity.
FREE AWS-NATIVE TOOLS REFERENCED
→ AWS Cost Optimization Hub (free, native)
→ AWS Compute Optimizer (free, native)
→ AWS Trusted Advisor check c2vlfg0jp6 (Business/Enterprise Support or limited free tier)
→ AWS Cost Explorer (free, native)
→ CloudWatch Logs Insights (query NAT flow logs directly)
The tooling to find this waste is free. The fix for most of it is a route table entry and a CLI command.
What's the biggest surprise you've found hiding in your AWS networking bill?
Top comments (0)