Cloud Cost Analyzer runs 92 rules against your cloud account in a single scan. A rule is a real unit of work: it pulls a resource's config and metrics, evaluates them against a cost model, and maybe emits a finding. They're independent, and every one of them leans on libraries I don't control — cloud SDKs, response parsers, date and math crates.

Any of that can meet an input it didn't anticipate and panic: an unwrap() that couldn't fail until some resource shape I'd never seen, an index out of bounds deep in a dependency, an overflow on a field that's normally small. Usually it isn't "someone wrote bad code" — it's a library panicking on an edge case nobody dependency-audited for.

The question that matters isn't "will a rule panic." It's "when rule #57 panics, do I lose the other 91 and the whole scan?" A cost report that dies two-thirds through because one rule hit one weird EBS volume is worse than useless.

Cloud Cost Analyzer (CCA) lets you share a read-only scan as a link. Someone drops that link in Slack or on LinkedIn, and instead of a bare URL I wanted it to unfurl into a proper card: the brand mark, the monthly savings we found, the number of findings.

That was two separate problems. Figuring them out took me somewhere I didn't expect, because neither one wanted a headless browser, but both needed a card. One of them even ate an afternoon because the fonts wouldn't cooperate. Here's the whole thing.

Short version: we pointed all 89 checks at one real AWS account, 1,358 resources in a single region. The scan returned 403 findings worth about $2,681/month, roughly $32,000/year, in potential savings. This is the raw surface area of waste a single account carries. It is not a promise you will bank all of it, and below I am going to be honest about why.

Short version: AWS Graviton is still about 20% cheaper than equivalent x86 and up to 40% better price/performance, and for most workloads it is a one-line instance-type swap. The thing that changed in 2026 is the target. Graviton4 (m8g, c8g, r8g) is now the current generation, up to 30% faster than Graviton3. If your last migration stopped at m6g or m7g, this is the update.

Short version: most AWS waste is not a pricing negotiation, it is a pile of specific resources nobody turned off. This is the checklist we use: find the waste, rank it by dollars, fix the top items, and stop it from coming back. Each item below has a concrete number and a step-by-step guide.

Short version: we scanned a real production AWS account (~$10.7K/month, 1,084 resources in us-east-1), fixed six things, and cut $1,925.57/month. Every dollar was checked against AWS Cost Explorer billing data over three cycles. No production incidents. Here is what actually moved the bill.

Short version: AWS gp3 EBS volumes cost ~20% less per GB than gp2 ($0.08 vs $0.10 per GB-month in us-east-1) and include 3,000 IOPS and 125 MB/s of baseline performance for free. You can convert a volume from gp2 to gp3 online, with no downtime and no snapshot: a single modify-volume call. For most volumes it is free money. Here is how to find them, migrate them, and the one caveat to check.

Short version: An Application or Network Load Balancer costs ~$0.0225/hour - about $16/month - just to exist, plus capacity units. Classic Load Balancers run ~$18/month. Load balancers outlive the services behind them: the app gets torn down, the ALB keeps billing. Here is how to find load balancers with no real traffic or no healthy targets, and remove them safely.

Short version: Every NAT Gateway costs $0.045/hour, about $32/month, before a single byte of data, plus $0.045 per GB processed. They are easy to create per subnet and easy to forget. Here is how to find NAT Gateways that carry little or no traffic, delete them without breaking egress, and stop paying NAT data charges for traffic that could use free VPC endpoints instead.

Short version: Since February 2024, AWS charges $0.005/hour for every public IPv4 address, about $3.60/month each, whether it is attached to anything or not. An unattached Elastic IP (EIP) is pure waste, and orphaned network interfaces (ENIs) often hold them. Individually small; at scale, and multiplied across accounts, it adds up. Here is how to find and release them safely.