We scanned our own AWS account before selling audits. It found 3.4%.
We built an AWS cost scanner. Around 70 checks, read-only, walks every region
with spend in it. Before pointing it at anybody else we pointed it at ourselves,
partly as a test and partly because it seemed like the minimum you should do
before charging people for the same thing.
It found $293.82 a month of savings against $8,746.75 of spend. That is 3.4%,
which is below the 20% threshold we guarantee. If we were a client, the audit
would have been free.
We published the whole result anyway, resource by resource: https://cloud-cost.framz.io/demo
This post is the part that was actually interesting, which is not the total.
The findings were not where we expected
105 findings. The distribution surprised us:
- 66 of them were S3, worth $148 a month, and almost all of it was one bucket with no lifecycle policy.
- 18 were EBS and snapshots, worth $96 a month, and most of that was snapshots of volumes that no longer exist.
- Compute, the thing everybody optimises first, produced almost nothing, because we already run small and we already schedule things off.
The pattern generalises. Compute is where attention goes because it is where the
instance list lives. Storage is where the money quietly accumulates, because
storage grows without anybody deploying anything.
Six things worth checking in your own account
These are the checks that produced findings on ours, in the order they produced
them. All of them are things you can do yourself in an afternoon.
1. Cost Explorer, six months, grouped by service, then by usage type.
Grouping by service tells you where to look. Grouping by usage type inside the
top service is the step people skip, and it is the one that turns "EC2-Other is
$900" into "EBS snapshots are $400 of it". EC2-Other is not a service; it is a
bucket containing EBS, snapshots, NAT processing, public IPv4 and data transfer.
2. Log groups with no retention.
Every CloudWatch log group AWS creates for you defaults to never expiring.
Ingestion is $0.50 per GB and storage is $0.03 per GB-month, so the expensive
part is getting the data in, but the never-expiring part is what makes the line
grow forever. Setting retention is free, takes one API call per group, and the
storage charge stops within about 72 hours.
Check VPC Flow Logs specifically. Enabled once for a security review with ALL
traffic captured, they are frequently the largest ingester in an account, and
nobody reads them.
3. Snapshots whose source volume is gone.
Terminating an instance does not delete its snapshots. Deleting the volume does
not delete its snapshots. Deregistering an AMI does not delete the snapshots
behind it. They are $0.05 per GB-month and they outlive everything they were
taken from.
One detail that trips people up: deleting one snapshot from a chain frees almost
nothing, because later snapshots reference its blocks. You have to delete the
chain.
4. Public IPv4 addresses.
Since 1 February 2024 every public IPv4 address costs $0.005 an hour, about
$3.60 a month, attached or not. The old rule that an attached Elastic IP was
free is no longer true. Unassociated addresses left behind by terminated
instances are the most common orphan there is, and they are also the easiest
thing on this list to fix.
5. NAT gateways carrying traffic that should be free.
A NAT gateway is $0.045 an hour plus $0.045 per GB processed. The per-GB part
applies to traffic going to S3, DynamoDB and ECR, which never leaves the AWS
network. Gateway VPC endpoints for S3 and DynamoDB cost nothing at all and take
that traffic off the NAT path entirely.
If your CI pulls container images through a NAT gateway a hundred times a day,
that is real money for traffic that a free endpoint would carry.
6. Savings Plan coverage.
Cost Explorer, Savings Plans, Coverage. If it says 0% and your compute spend is
flat month to month, that is the largest single number in your audit and it is
one purchase away.
Order matters here. Rightsize first, let the baseline settle for a couple of
weeks, then commit to about 70 to 80% of what is left. A Savings Plan is a
promise to spend a fixed amount per hour for one to three years, and committing
before a cleanup means paying for capacity you are about to delete.
The uncomfortable conclusion
Our account came in at 3.4% because it is small, it is new, and we already do
most of this. An account that has been running for three years without anybody
owning the bill is a different story, and 20% to 35% is normal there.
But the reason it is normal is not technical. Creating a resource on AWS takes
one API call and no approval. Deleting one requires somebody to know it exists,
know nothing depends on it, and care. Those costs are wildly asymmetric, which
is why the bill goes up while traffic stays flat.
The calculators
We turned the arithmetic behind each of these checks into free calculators. No
signup, no email gate, and they run on the same price constants the scanner
uses:
Twelve of them, including data transfer, NAT gateway, snapshots, CloudWatch
Logs, S3 storage classes, Graviton and a Fargate against Lambda against EC2
comparison.
And the full checklist the audit runs, published in full rather than gated:
Full disclosure, since it would be odd not to say it: we sell a fixed-price
audit. The scan of our own account is on the site precisely because it is
unflattering, and it is the only real evidence we have that the thing works.
Top comments (0)