What we look at in the first hour of a cloud cost audit

Cloud cost audits tend to get treated as a deep, multi-week engagement — and eventually they can be. But the first hour usually surfaces most of the low-hanging savings, because the same handful of patterns show up in almost every account we look at.

We start with idle and orphaned resources: unattached EBS volumes, load balancers with zero registered targets, and elastic IPs that were never released after an instance was terminated. None of these do any work, and all of them bill continuously. In accounts that haven’t had a cleanup pass in a while, this alone is often 5–10% of the monthly bill.

Next is instance sizing versus actual utilization. It’s common to find production workloads running on instance types chosen at launch time and never revisited, sitting at 8–15% average CPU utilization months later. Right-sizing based on real utilization data — not guesswork — is usually the single biggest line item we adjust.

Snapshot and backup sprawl is the third pattern. Automated snapshot schedules are easy to set up and easy to forget about; we regularly find years of daily snapshots retained with no lifecycle policy, for volumes that no longer even exist. A retention policy that matches your actual recovery requirements, instead of "keep everything forever," usually cuts storage costs from this category dramatically.

Last, we check commitment coverage — reserved instances or savings plans against actual steady-state usage. Teams that scaled up their baseline capacity after their last commitment purchase are often paying full on-demand rates for workloads that have been running steadily for a year or more.

None of this requires touching application code. It’s an inventory-and-cleanup exercise that, done properly, tends to fund the rest of a cloud modernization project on its own.