"Idle" sounds free. It is not. Some of the most reliable waste in an AWS account comes from resources that are running, doing almost nothing, and billing you the full rate anyway. The frustrating part is that none of them is expensive enough on its own to trigger a second look, so they survive for months. Put a real monthly number on each and they stop looking harmless.
Here are the three most common idle-but-billing resources, roughly what each costs, and how to find yours.
Idle NAT gateway: roughly $32+ per month, before traffic
A NAT gateway bills two ways: an hourly charge just for existing, plus a per-GB data processing charge for traffic through it. The hourly charge alone is about $0.045 per hour in most regions, which is roughly $32 a month per gateway whether or not a single byte flows through it.
The waste pattern: a NAT gateway left behind in a region or VPC you migrated out of, or one provisioned per-AZ "for high availability" in an environment that no longer needs all of them. Each idle one is $32+ a month for nothing, and teams often have several.
Find NAT gateways with near-zero traffic by checking their BytesOutToDestination CloudWatch metric over the last couple of weeks. Flatlined at zero means it is billing you for existing and nothing else.
Idle load balancer: roughly $16 to $22+ per month with no healthy targets
An Application or Network Load Balancer has an hourly charge (around $0.0225/hour for an ALB, so ~$16+ a month) plus capacity-unit charges. A load balancer with zero healthy targets is the giveaway: the thing it was routing to got deprovisioned, but the load balancer stayed, still billing.
Find them by checking HealthyHostCount per target group. Zero healthy hosts over a sustained period means the LB is routing to nothing and can almost certainly go.
Sub-5% CPU EC2 instance: the full instance price for near-idle
An EC2 instance at 3% average CPU costs exactly the same as one at 80%. A box that has averaged under 5% CPU with negligible network for two weeks is either wildly over-provisioned or genuinely unused, and either way you are paying full rate. Depending on size that is anywhere from a few dollars to hundreds a month per instance.
The detection rule most teams use: average CPU under 5% and low network IO for 14 days. That combination separates "idle" from "low but real" (a box can be low-CPU but doing important memory or IO work, so check network and memory before acting, not just CPU).
Why these survive for months
Two reasons, and they are worth naming because they tell you how to fix the process, not just the resources:
- Each is individually small. $32 here, $16 there, one small instance. None trips a budget alert, so none gets investigated. The waste is real only in aggregate.
- Nobody owns "idle." These resources have no obvious owner to notice them. They are the residue of changes, migrations, and experiments that moved on.
How to find and fix yours
-
NAT gateways: list them all, check
BytesOutToDestination. Delete the ones flatlined at zero (confirm no private subnet still needs egress through them first). -
Load balancers: check
HealthyHostCountper target group. Zero healthy hosts sustained means delete. - EC2: pull 14-day average CPU and network. Under-5% CPU plus low network means rightsize or stop, after checking it is not memory or IO bound.
Then make it recurring. Idle resources regenerate constantly, so a one-time cleanup is a one-time win. A monthly detection pass (a script, or a tool that continuously flags idle resources with the dollar figure attached, which is part of what ZopNight does) is what actually keeps the number down.
The take
Idle does not mean free. An idle NAT gateway is ~$32 a month, an idle load balancer is ~$16 or more, and a near-idle EC2 instance is the full instance price for almost no work. Individually forgettable, collectively a real line on the bill, and among the safest cuts you can make because nobody is using them. Put the dollar figure on each and they stop being invisible.
Which idle resource has cost you the most before you caught it? For me it was a pair of per-AZ NAT gateways in a region we had mostly left, quietly billing ~$64 a month between them for traffic that had dropped to nearly zero.
Top comments (0)