We ran 89 cost checks on one AWS account: $32,000/year in findings, ranked
Short version: we pointed all 89 checks at one real AWS account, 1,358 resources in a single region. The scan returned 403 findings worth about $2,681/month, roughly $32,000/year, in potential savings. This is the raw surface area of waste a single account carries. It is not a promise you will bank all of it, and below I am going to be honest about why.
If you want the other side of this, where we actually fixed things and watched the invoice drop, read the realized case study. This post is the opposite end: not "here is what we saved," but "here is everything one scan finds before you touch anything."
The account
A normal setup. EC2 for pipelines and services, Aurora and RDS, ElastiCache, a pile of Lambda functions, an EKS cluster, and the usual sediment of resources nobody has looked at in a year. One region, us-east-1. We ran the full rule set once, read-only, and looked at what came back.
First, the honest part
That $2,681/month is a gross, identified number, not a realizable one. Two reasons it is not a shopping total you get to add up:
- The big line items overlap. A single idle EC2 instance can show up three ways: buy a Savings Plan, cover it with a Reserved Instance, or right-size it. Those are not additive. You pick one. A cost tool will happily count all three.
- Some findings are hygiene, not dollars. Seven unused security groups and four idle Step Functions saved $0.00 each. They are worth cleaning up, but they do not move the bill.
So read the ranking below as a map of where the account is soft, not a check you can cash. With that said, the map is the useful part.
The ranking (real numbers)
| Finding | Count | $/mo |
|---|---|---|
| Spot-eligible workloads | 11 | $726.59 |
| Savings Plan opportunities | 18 | $554.85 |
| Idle / low-CPU EC2 | 7 | $493.20 |
| ElastiCache, low connections | 4 | $428.34 |
| Reserved Instance coverage gaps | 14 | $382.23 |
| Underutilized RDS | 6 | $257.00 |
| x86 to Graviton (EC2) | 15 | $228.99 |
| ElastiCache, low memory | 4 | $214.17 |
| Previous-generation instances | 17 | $171.74 |
| Underutilized EKS nodes | 2 | $158.53 |
| Aurora I/O-Optimized | 1 | $129.86 |
| Unattached EBS volumes | 80 | $106.34 |
| Route 53 zones with only NS/SOA records | 37 | $82.23 |
| Unused VPC endpoints | 36 | $80.00 |
| Cross-region data transfer | 11 | $33.30 |
| Old EBS snapshots | 45 | $13.96 |
| CloudWatch log retention | 50 | $10.96 |
| Unattached Elastic IPs | 5 | $11.10 |
| gp2 to gp3 EBS | 7 | $1.86 |
| Everything else (hygiene) | ~30 | ~$0 |
Two patterns fall out of this
The money is in commitment and right-sizing, and it overlaps. The top six lines, Spot, Savings Plans, idle EC2, ElastiCache, RI coverage, and RDS, are about $2,500/month between them. They are also the most entangled. The same handful of steady EC2 instances drives the Spot, Savings Plan, RI, and right-size numbers at once. The real, non-double-counted win here is smaller than the sum, and it starts with one decision: are these workloads staying? If yes, commit (Savings Plan). If they are bursty and fault-tolerant, Spot. If they are oversized, shrink them first, then commit to the smaller footprint. Do not buy a three-year commitment on an instance you are about to halve.
The volume is in hygiene, and it is nobody's job. Look at the counts, not the dollars: 80 unattached EBS volumes, 50 log groups with no retention cap, 45 old snapshots, 37 Route 53 zones holding nothing but default records, 36 VPC endpoints with no traffic. That is 248 findings for a few hundred dollars. Individually trivial, collectively a mess, and it accumulates because no single person owns "delete the thing we stopped using." A scan is how you find it, because you are never going to click through 1,358 resources by hand.
The modernization layer
Three findings are not really about this month's bill, they are about not overpaying structurally:
- 15 instances on x86 with a Graviton equivalent ($229/mo here). Graviton is the lowest-effort price-performance lever AWS offers, roughly 20% cheaper for a family swap, and the current target is Graviton4 (m8g, c8g, r8g). More on this in the Graviton series.
- 17 previous-generation instances ($172/mo). m5, c5, r5 and older, quietly costing more than current-gen for the same work.
- 7 gp2 volumes that should be gp3 ($2/mo here, but it is a free 20% on storage and a zero-downtime change, so there is no reason not to).
Small numbers in this one account, but they are one-time migrations that keep paying, and they scale with fleet size.
One honest miss, because it is a good lesson
The scan flagged 7 x86 Lambda functions that could move to arm64 for about 20% off, and reported $0.00 in savings for all of them. Not a bug. This account had no per-function cost data available to the scan, so the rule correctly emitted the recommendation with no dollar figure rather than inventing one. arm64 Lambda is still worth doing, a one-line architecture change, but it is a good reminder: a savings estimate is only as good as the cost data behind it, and a tool that makes up numbers when it has none is not doing you a favor.
What we would actually do first
Not all 403. Three moves, in order:
- Delete the orphans. Unattached volumes, unattached EIPs, empty Route 53 zones, dead VPC endpoints. Low risk, no downside, and it clears the noise so the real signal is easier to see.
- Right-size, then commit. Shrink the oversized EC2, RDS, and ElastiCache first. Then put a Compute Savings Plan over the steady baseline that remains.
- Take the free modernizations. gp2 to gp3, and the Graviton family swaps on anything that is already ARM-compatible.
Run it on your own account
Every number above came from one read-only scan. You can run the same 89 checks against your account with Cloud Cost Analyzer. The free tier gives you the executive summary and finding counts, no credit card, and your credentials never leave your environment. If the surface area looks anything like this account, the ranking alone will tell you where to point your next afternoon.