Every AWS cost audit starts the same way: read-only credentials, a week of pulling Cost Explorer, Trusted Advisor, and CloudWatch data, and a walkthrough of what's actually running versus what's actually being used. Before a single architecture diagram gets redrawn, the same handful of findings show up almost every time — not because every account is identical, but because the same incentives produce them.

1. NAT gateways nobody remembers provisioning

A NAT gateway bills by the hour whether or not anything is routing through it, plus a per-GB charge on top. In a multi-AZ setup that seemed reasonable during a migration two years ago, it's common to find two or three sitting idle in subnets that no longer have live workloads behind them — quietly costing hundreds of dollars a month for zero traffic.

2. Orphaned EBS volumes and old snapshots

When an EC2 instance is terminated, its root volume doesn't always go with it — depending on how it was launched, the volume can be left available, detached, and billing indefinitely. Stack that across a few years of ad-hoc terminations and a few dozen unattached volumes is a normal find, alongside snapshot chains nobody's pruned since a migration that already happened.

3. Reserved Instances and Savings Plans nobody's tracking

This one cuts both ways. Some accounts are paying full on-demand rates for steady-state workloads that have run unchanged for a year — a straightforward case for Savings Plans. Others bought Reserved Instances for an instance family the team migrated away from months ago, and the commitment is now just a sunk cost nobody's revisited.

Why this keeps happening None of this is negligence — it's what happens when the person who provisioned something and the person paying the bill are rarely the same person looking at the same dashboard at the same time. A cost audit is just that dashboard, once, on purpose.

4. Over-provisioned compute that was sized for a launch that already happened

Instance sizes chosen for a product launch, a migration cutover, or "to be safe" during an incident tend to stay put long after the load that justified them has settled. Right-sizing based on actual CloudWatch utilization — not the instance type someone picked under pressure — is usually the single largest line item in the findings.

What this doesn't require

  • No changes to running infrastructure during the audit itself — it's read-only, start to finish.
  • No architecture redesign as a prerequisite — most of what's found is cleanup, not a rebuild.
  • No long engagement — a week of data pulling and analysis is usually enough for a first pass.

The findings get prioritized by dollar impact and effort to fix, so the report is a worklist, not a slide deck. Some items are a five-minute console change; others are worth a conversation before anything gets touched.

This is the same audit running as a live, fixed-fee service — read-only access, a report back within a week, no obligation to act on it.

See the AWS cost audit →

📢 Have questions or feedback? Drop a comment below or connect with me on Twitter/X@spysood!