Cloud billing is opaque by design. Cloud providers profit from your confusion. But with the right detective work, you can find where your money is going and stop the bleeding.
The Cloud Bill Investigation Framework
Step 1: Get the Raw Data
Export your billing data for the last 3 months. You need:
- Daily costs broken down by service
- Resource-level costs (which specific resources cost the most)
- Tagged costs (if you tag resources, group by tag)
- Data transfer costs (often the hidden killer)
Most cloud providers let you export this as CSV. If not, use their billing API.
Step 2: Find the Top 5 Cost Centers
Sort by cost, descending. The top 5 typically account for 80% of your bill.
Common culprits:
- Compute: Over-provisioned instances running 24/7
- Data transfer: Cross-region traffic, NAT gateways, CDN costs
- Storage: Unattached volumes, old snapshots, oversized databases
- Managed services: RDS, ElastiCache, MSK — convenient but expensive
- Network: Load balancers, VPC endpoints, private connections
Step 3: Calculate the Waste
For each top cost center, ask:
- Is this resource still needed? (Zombie check)
- Is it the right size? (Right-sizing check)
- Could it be cheaper elsewhere? (Spot/reserved check)
- Is it optimized for the workload? (Architecture check)
Typical waste percentages:
- 20-30% of compute spend is on over-provisioned instances
- 10-15% of storage spend is on unattached volumes
- 5-10% of total spend is on unnecessary data transfer
Step 4: Build the Optimization Plan
| Resource | Current Cost | Action | New Cost | Savings |
|---|---|---|---|---|
| 12x m5.large | $2,400/mo | Right-size to t3.medium | $600/mo | $1,800/mo |
| 8x unattached EBS | $160/mo | Delete | $0 | $160/mo |
| 50x old snapshots | $80/mo | Delete (keep 7 days) | $12/mo | $68/mo |
| Dev env (24/7) | $800/mo | Switch to spot | $200/mo | $600/mo |
| Total | $3,440/mo | $812/mo | $2,628/mo |
That is $31,536/year in savings from one audit.
Step 5: Set Up Guardrails
Prevent the waste from coming back:
- Budget alerts: Email at 50%, Slack at 80%, page at 100%
- Tag policy: Require tags on every resource (team, env, project)
- Lifecycle policies: Auto-delete old snapshots, transition S3 to cheaper tiers
- Instance scheduler: Auto-stop dev environments at night and on weekends
- Cost anomaly detection: Alert on any day that costs 20% more than average
The Data Transfer Trap
Data transfer is the most overlooked cost in cloud billing:
- Cross-region traffic: $0.02/GB. Seems small until you are moving 10TB/day.
- NAT gateway: $0.045/hour + $0.045/GB. A single NAT gateway can cost $500+/month.
- Internet egress: $0.09/GB. Serving 1TB of content = $90/month.
- VPC peering: Cheaper than internet, but still not free.
The fix: Cache aggressively, use CDNs, keep traffic within the same region, and minimize cross-AZ traffic.
The Database Cost Spiral
Databases are often the most expensive single resource:
- Right-size the instance: Most databases are over-provisioned by 2-3x
- Use storage autoscaling: Do not pre-provision 1TB when you need 100GB
- Delete old data: Archive or delete records older than 90 days
- Use read replicas wisely: Each replica costs as much as the primary
- Consider serverless: Aurora Serverless or similar for variable workloads
The Monthly Cost Review
Every month, spend 30 minutes on:
- Compare this month to last month — did costs go up? Why?
- Check for new resources you did not expect
- Verify budget alerts are still configured
- Review tag compliance — are all resources tagged?
- Update the cost dashboard with current numbers
Want a cloud cost audit checklist, billing alert templates, and a Python script that finds zombie resources? Check out our Ops Starter Kit:
Your cloud bill is a mystery. Be the detective. 🔍
Top comments (0)