Cloud Spend Review

Cloud Spend Review

Purpose

Find and remove cloud waste with evidence, and put guardrails in place so it does not return. This is read-and-recommend work: rightsizing over-provisioned compute against real utilization, deleting idle and orphaned resources (unattached disks, idle load balancers, stale snapshots, unused IPs), moving cold data to cheaper storage tiers, attacking data-egress charges, applying reserved/spot/committed-use discounts to steady baseload, enforcing cost-allocation tagging, and wiring cost-anomaly alerts. The output is a ranked savings list with the evidence behind each line and the safe action to capture it — never a blind "delete to save money."

When to use

• The monthly cloud bill is rising and the largest line items have not been attributed to a service or team.
• Instances/databases were sized for peak or "to be safe" and run far below their provisioned CPU/memory.
• You suspect orphaned resources (disks with no instance, unattached IPs, old snapshots, idle load balancers).
• A surprising data-transfer/egress charge appears and the cross-region or internet path is unclear.
• Steady baseload runs entirely on on-demand pricing with no reserved/committed/spot coverage.
• Untagged spend makes it impossible to attribute cost to teams or environments.

When not to use

• The workload is already efficiently sized and discount-covered, and the remaining spend is genuine working cost — there is no waste to cut.
• The "cost" is per-token LLM/API billing — use LLM API cost optimization instead.
• A one-time spike came from a known, finished batch job that has already stopped.

Procedure

1. Attribute the bill before cutting anything. Pull cost grouped by service, region, account/project, and tag for the last 30–90 days. Rank the top line items; a few services usually dominate (the 80/20 rule holds for cloud bills). You cannot prioritize savings you have not attributed, and cutting the small lines first wastes effort.
2. Rightsize against real utilization. For compute and databases, compare provisioned vCPU/memory against actual p95 utilization over weeks. Persistently low utilization (e.g., p95 CPU under ~20–40%) is a rightsizing candidate — step down a size or move to autoscaling, not delete. Account for memory as well as CPU; a memory-bound workload may need its current size even at low CPU.
3. Hunt idle and orphaned resources. List resources with no attachment or no traffic: unattached block volumes, unassociated static IPs, idle/empty load balancers, stopped instances still billing for disks, and snapshots/AMIs older than the retention policy. These accrue silently because nobody owns a resource that nothing points at.
4. Tier storage by access pattern. Identify cold objects (not read in N days) and move them to infrequent-access/archive tiers via lifecycle rules. Check that frequently-read data is NOT in an archive tier where retrieval fees and latency would dominate — a wrong tier can cost more than the standard tier it replaced.
5. Attack egress. Find cross-region, cross-AZ, and internet egress charges. Co-locate chatty services, put a CDN in front of repeated public downloads, and use private/VPC endpoints to keep traffic off the metered internet path. Egress is metered per GB and rarely appears as a single obvious line, so it hides in plain sight.
6. Cover baseload with commitments and spot. Quantify the steady 24/7 floor and cover it with reserved instances / committed-use / savings plans; run fault-tolerant, interruptible work (batch, CI, stateless workers) on spot/preemptible. Do not over-commit beyond the proven floor, because an unused commitment is locked-in waste, not a discount.
7. Schedule non-production environments. Dev, staging, and test environments rarely need to run 24/7. Confirm they auto-stop outside business hours; an always-on non-prod fleet is one of the most common and easiest-to-fix sources of waste.
8. Enforce tagging and wire anomaly alerts. Require cost-allocation tags (team, env, service) and report untagged spend. Turn on the provider's cost-anomaly detection plus a budget alert so the next regression pages someone instead of surfacing in next month's invoice — guardrails stop waste from recurring after this review ends.

Concrete checks

• Spend is attributed by service, region, account/project, and tag; the top line items are ranked.
• Compute/database provisioned size is compared against weeks of real p95 utilization (not a single reading).
• Unattached volumes, unassociated IPs, idle load balancers, and stale snapshots/images are enumerated.
• Stopped instances are checked for disks/IPs that still bill while stopped.
• Storage lifecycle rules move cold data to cheaper tiers; hot data is not stranded in archive.
• Cross-region/cross-AZ and internet egress charges are identified and attributed to a path.