"We're paying for things that are running and doing nothing" is the most common cloud cost complaint, and also the least specific. Idle isn't one thing. An idle NAT gateway, an idle load balancer, and a 4%-CPU EC2 instance are three different problems with three different price tags and three different confidence levels about whether they're safe to touch.
So here's the specific version: for each idle type, the threshold that makes "idle" a defensible claim rather than a hunch, and the monthly dollar figure at us-east-1 list prices (early 2026, 730-hour month). Because "we have idle resources" starts a debate, and "these eleven resources burn $1,340 a month doing nothing" starts a cleanup.
The idle catalog, priced
The sub-5% EC2 instance. Threshold worth defending: average CPU below 5% AND negligible network traffic, sustained for 14 days. Both conditions matter; a proxy at 2% CPU pushing gigabits is not idle, and one quiet week proves nothing. The price is whatever the instance costs, in full: an m5.large burns about $70 a month to be 96% empty, an m5.2xlarge about $280, a c5.4xlarge about $500. Idleness doesn't discount the meter. The 14-day check:
aws cloudwatch get-metric-statistics --namespace AWS/EC2 \
--metric-name CPUUtilization --dimensions Name=InstanceId,Value=i-0123456789 \
--start-time "$(date -u -d '14 days ago' +%FT%TZ)" --end-time "$(date -u +%FT%TZ)" \
--period 86400 --statistics Average --query 'Datapoints[].Average'
Fourteen numbers back, all under 5, plus a NetworkPacketsIn check: that's a case, not a vibe.
The NAT gateway routing nothing. $32.85 a month each, before a single gigabyte of processing. Threshold: BytesOutToDestination flat at zero for 7 days. Common in VPCs whose workloads moved or died; the gateway outlives everything. Adjacent trap while you're there: NAT gateways routing S3 or DynamoDB traffic are charging $0.045/GB for a path a gateway VPC endpoint provides free; that one's not idle, just overpriced.
The idle load balancer. $16.43 a month for an ALB or NLB at rest ($18.25 for a Classic). Threshold: zero requests (or zero processed bytes for NLB) for 7 days. These accumulate behind decommissioned services because the DNS name feels load-bearing long after the service is gone. Check whether anything still resolves to it before deletion, then delete; a load balancer is recreatable in minutes.
The zero-connection database. The expensive one. Threshold: DatabaseConnections maximum of zero for 14 days (14, not 7, because weekly batch jobs exist). Price: a db.t3.medium is about $50 a month, a db.m5.large about $125, and Multi-AZ doubles both. RDS also can't hide behind "it's on for a reason": a database nobody has connected to in two weeks has no reason.
The empty-cluster control plane. An EKS cluster with zero nodes still bills its control plane at $73 a month. Threshold: node count zero for 7 days. These are leftovers from experiments and migrations, and they're pure subscription.
The two that look scary but cost almost nothing
Honesty section, because idle lists lose credibility when they inflate.
Lambda with zero invocations costs approximately nothing to leave alone: no invocations, no compute charges. It matters as hygiene (dead code, stale IAM permissions, an attack surface nobody watches) and its log group may hold paid storage, but it belongs on a cleanup list, not a savings list. A tool or a blog post claiming dollar savings from idle Lambdas is padding the number.
Stopped instances aren't idle compute either; they're a storage problem (their EBS volumes and Elastic IPs keep billing). Different category, different fix, covered by every zombie-hunting checklist.
Separating these keeps the real claim sharp: idle spend is dominated by always-on compute and databases, followed by the fixed-price network gear (NAT gateways, load balancers) that nobody remembers exists.
The portfolio view
Single-resource findings don't move organizations; portfolios do. A representative mid-size account sweep: six sub-5% instances averaging m5.large-ish (about $420 a month), two forgotten NAT gateways ($66), five idle load balancers ($82), two zero-connection databases, one of them Multi-AZ ($375), one node-less EKS control plane ($73). Total: roughly $1,016 a month, about $12,000 a year, from eleven resources that a two-hour metrics sweep can identify with defensible thresholds.
Two rules make the list actionable rather than argued with. State the threshold next to every finding ("zero connections, 14 days" ends the "but maybe it's used" conversation). And attach the monthly price to every line, because a list of instance IDs is homework, while a dollar figure with evidence is a decision.
FAQ
What counts as an idle EC2 instance?
A defensible bar: average CPU under 5% and negligible network traffic, sustained over 14 days. CPU alone misses network-bound workloads; short windows miss weekly patterns. At that bar, the instance costs its full price to do effectively nothing, and downsizing or stopping it is a data-backed call, not a guess.
How much does an unused NAT gateway cost?
$32.85 a month at us-east-1 list price, plus $0.045 per GB processed when it does carry traffic. Zero BytesOutToDestination for a week is the idle signal. Also check for S3/DynamoDB traffic flowing through NAT that a free gateway VPC endpoint could carry instead.
How much does an idle load balancer cost per month?
About $16.43 for an ALB or NLB at rest, $18.25 for a Classic ELB, per load balancer, before any traffic. Zero requests over 7 days is the test; the usual cause is a decommissioned service whose load balancer and DNS record outlived it.
Do idle Lambda functions cost money?
Essentially no: zero invocations means zero compute charges, aside from possible log-group storage. Clean them up for hygiene and security reasons, not savings. Any idle-cost report claiming meaningful dollars from unused Lambdas is inflating its total.
What's the fastest way to find all of this in my account?
Metrics sweeps per type: CPU and network for EC2 (14 days), BytesOutToDestination for NAT gateways (7 days), RequestCount for load balancers (7 days), DatabaseConnections for RDS (14 days), node counts for clusters. Each is one CloudWatch query in a loop, and each finding should carry its threshold and its monthly price.
Top comments (0)