A $47,000/month AWS bill that should be under $30,000. That's the situation we walked into with one engagement. Six weeks later, the bill was at $26,400 — a 44% reduction, with nothing turned off that was actually needed.
This post is a breakdown of where the waste was, how we found it, and the specific levers we pulled. If you're running a production AWS environment and haven't done a structured cost review in the last year, assume you have 20–40% savings available.
Where AWS Waste Lives
Before touching anything, we run a full cost attribution analysis using AWS Cost Explorer, Cost and Usage Reports (CUR), and Compute Optimizer. The goal: identify where money is going and why.
The categories where we consistently find waste:
1. Oversized Compute
EC2 instances are typically provisioned at peak-demand sizing and never revisited. An instance sized for a launch traffic spike is running at 8% CPU utilization two years later.
AWS Compute Optimizer runs ML-based recommendations against CloudWatch CPU, memory (where the agent is installed), and network metrics. It identifies instances that can be downsized without performance risk, with a confidence indicator.
In the engagement above: 23 EC2 instances downsized, average 40% size reduction. Monthly savings on compute alone: $6,200.
2. Unattached and Oversized EBS Volumes
EBS volumes that aren't attached to running instances still cost money. So do volumes provisioned at 2TB for a workload using 200GB.
Common sources: - Volumes left after instance termination (snapshots kept, volume not deleted) - Root volumes from AMI-created instances that were supersized "just in case" - io1/io2 volumes provisioned for IOPS that turned out not to be needed (gp3 is cheaper and often sufficient)
Audit: query all EBS volumes for attached state, utilization metrics (where available), and type. Compare against Compute Optimizer recommendations.
In this engagement: $1,800/month in unattached volumes deleted; $2,100/month saved converting io1 to gp3 at equivalent performance.
3. Data Transfer Costs
Data transfer in AWS is "free" within a region for many services, but data flowing out to the internet or across regions accumulates. Surprise: most teams don't audit this.
Common culprits: - EC2 instances talking to S3 without VPC endpoints (cross-AZ data transfer charges) - Cross-region replication configured for DR but hitting far more data than expected - NAT Gateway costs from Lambda functions calling external APIs at high volume
Fix: S3 VPC endpoints eliminate data transfer charges for EC2→S3 traffic. For high-volume Lambda-to-external-API patterns, consider CloudFront or a proxy layer. For cross-region replication, audit what's actually being replicated and whether S3 Intelligent-Tiering would reduce the replicated data size.
In this engagement: $3,400/month in data transfer waste identified and resolved via VPC endpoints and replication audit.
4. Reserved Instance and Savings Plan Gaps
On-Demand pricing is 3–4× more expensive than 1-year Reserved Instances or Compute Savings Plans for the same instance type. Teams running production workloads on On-Demand are paying a premium for flexibility they're not using.
Process: 1. Identify stable, always-on workloads (database servers, production app tier, NAT gateways) 2. Match them to RI recommendations from Cost Explorer 3. Purchase 1-year no-upfront or partial-upfront RIs/Savings Plans for the stable baseline 4. Keep On-Demand for variable or experimental workloads
In this engagement: $4,800/month saved by covering the stable compute baseline with 1-year Compute Savings Plans. Zero upfront cost; savings started immediately.
5. RDS Oversizing and Idle Instances
RDS instances follow the same oversizing pattern as EC2, with the added issue that RDS instances in dev/test environments often run 24/7 when they're only used 8–10 hours a day.
Actions: - Rightsize production RDS based on Performance Insights CPU and I/O utilization - Enable RDS Aurora Serverless v2 for dev/test databases (scales to zero when idle) - Delete unused read replicas - Audit Multi-AZ configurations — not every environment needs it
In this engagement: $2,700/month from RDS rightsizing and dev environment migration to Aurora Serverless.
6. S3 Storage Tiers
Data in S3 Standard costs 3–5× more than S3 Infrequent Access or Glacier Instant Retrieval for data accessed rarely. Most teams don't have lifecycle policies on old S3 buckets.
Audit: identify buckets older than 6 months, check access patterns in CloudWatch S3 metrics, add lifecycle policies to move infrequently accessed objects to S3 IA or Glacier after 30/90 days.
In this engagement: $1,600/month from S3 lifecycle policy additions across 12 buckets.
The 6-Week Process
Week 1: Cost attribution and analysis. CUR setup (if not already in place), Cost Explorer segmentation by service/environment/team, tagging audit. Identify top-10 cost drivers.
Week 2: Compute assessment. Compute Optimizer report review, EBS audit, RDS Performance Insights review. Produce rightsizing recommendations with risk assessment per instance.
Week 3: Quick wins. Delete unattached resources, purchase Savings Plans for stable baseline, add VPC endpoints, enable S3 lifecycle policies. These are low-risk, high-value changes.
Week 4: Compute rightsizing. Downsize EC2 and RDS instances per recommendations. Stagger changes with monitoring periods. Validate performance metrics post-change.
Week 5: Architecture-level optimizations. Move dev/test to Aurora Serverless, identify Lambda patterns driving NAT Gateway costs, review data transfer flows.
Week 6: Tagging enforcement and ongoing governance. Implement AWS Config rules to enforce tagging on new resources. Set up Cost Anomaly Detection alerts. Document optimization playbook for ongoing use.
What Doesn't Get Cut
Cost optimization isn't cost elimination. We don't touch:
- Production redundancy (Multi-AZ RDS, cross-region backups) — this has cost for a reason
- Monitoring and logging infrastructure — CloudWatch, Security Hub, GuardDuty aren't overhead
- Reserved capacity for latency-sensitive workloads — On-Demand flexibility sometimes justifies the premium
- Any change that requires architecture redesign without business approval
The goal is waste removal, not infrastructure degradation. Every recommendation includes a risk assessment.
For the full infrastructure capability context, see AWS Cloud Infrastructure and our FinOps consulting services overview.
Also see the AWS FinOps Foundation's framework documentation for the governance model we align to.
Frequently Asked Questions
How much waste should we expect to find?
For environments that haven't been cost-optimized in 12+ months, 20–40% is a realistic range. Environments that grew rapidly (startup scaling phase) tend toward the higher end. Mature, actively managed environments have less obvious waste but still typically have 10–20% available.
Will rightsizing break our production applications?
Rightsizing recommendations come with risk indicators from Compute Optimizer. We start with high-confidence, low-risk recommendations (e.g., instances running at <20% CPU for months) and validate performance metrics for 1–2 weeks after each change before proceeding. High-risk changes require your sign-off.
Do we need to be running AWS Cost and Usage Reports?
CUR gives the most granular data and is required for precise savings analysis. If it's not set up, we set it up as part of the engagement. Data takes 24–48 hours to populate.
Can you help maintain savings over time, or is this a one-time audit?
One-time audits produce one-time savings. Without governance (tagging policies, regular Compute Optimizer review, anomaly alerts), costs drift back up. We include ongoing governance tooling as part of our engagements and can provide periodic reviews.
What's the typical ROI on a cost optimization engagement?
The engagement fee is typically recovered within the first 1–2 months of savings. After that, every month of maintained savings is net positive. The 6-week engagement above produced approximately $20,600/month in ongoing savings.
Get a free AWS cost review → rutagon.com/contact