AWS cost-savings cheat sheets
Every topic in our library, boiled down to what matters: the actual prices, the commands to run, and the gotchas that bite. Read one in three minutes — then pick the format that suits how you work.
Skim the cheat sheet
The condensed version — numbers, commands, gotchas. You’re already here.
Take the guided walkthrough
Prefer step by step? Each sheet links to its interactive workflow — questions, branches, and quizzes.
Send your AI assistant
Every sheet ends with a copy-paste audit prompt for Claude, ChatGPT, or any agent with read-only AWS access.
Compute
Amazon Lightsail
AWS with the training wheels on: fixed-price monthly bundles ($3.50–$40) that roll compute, storage, and data transfer into one predictable number. The right tool for WordPress, dev environments, and small apps — and the wrong one past ~16 GB RAM.
Read the cheat sheetAuto Scaling Groups
Match EC2 capacity to real demand automatically — target-tracking, step, and scheduled policies plus a mixed On-Demand/Spot instances policy. Running 3 instances most of the day and bursting to 10 at peak beats 10 instances 24/7 by ~56%.
Read the cheat sheetAWS Batch with Spot
Run batch and data-processing jobs at 70–85% off On-Demand by letting AWS Batch handle Spot interruptions for you — diversified pools, capacity-optimized allocation, and automatic retries. Set min_vcpus=0 and pick the right allocation strategy.
Read the cheat sheetAWS Compute Optimizer
Free ML-driven rightsizing for EC2, Auto Scaling Groups, EBS, Lambda, and Fargate — reads CloudWatch metrics over 14 days and hands you specific downsizes with dollar figures and a performance-risk rating. Enable it, install the agent for memory, act monthly.
Read the cheat sheetAWS Graviton-based Instances
Switch from x86 to AWS's ARM-based Graviton chips for up to 40% better price-performance — often a single config change. Lambda arm64 is a one-field flip; containers are a base-image swap; the savings compound every hour, forever.
Read the cheat sheetBottlerocket OS
AWS's minimal, immutable, container-only OS cuts host overhead 30–50% versus general-purpose Linux — often enough to drop a full instance size cluster-wide. Fewer packages means fewer CVEs; no SSH means SSM-only access. A launch-template AMI swap.
Read the cheat sheetCompute Optimizer GPU Recommendations
GPU instances cost 10–20× a comparable CPU box and most teams use only 20–30% of them. Compute Optimizer's workload-aware GPU rightsizing (P/G/Inf families, added 2023) surfaces the over-provisioning — often 60–68% savings on a single service.
Read the cheat sheetCompute Optimizer Memory Optimization
Memory-optimized r- and x-family instances carry a RAM premium teams pick 'just to be safe' and never revisit. Compute Optimizer's memory recommendations find the over-provisioning — but only if the CloudWatch Agent is installed, and only if you leave headroom.
Read the cheat sheetCompute Savings Plans
Commit to a steady $/hour of compute for 1 or 3 years for up to 66% off — and the discount follows you automatically across EC2, Lambda, and Fargate, any family, size, OS, or region. The flexible commitment that survives architecture changes.
Read the cheat sheetEC2 Dedicated Host Reservations
A physical server that's entirely yours, so you can run BYOL Microsoft, Oracle, or SAP on hardware you can see and license per socket — avoiding AWS's license-included premium. On-Demand is punishing; the Reservation is where the math works (30–50% off).
Read the cheat sheetEC2 Fleet
Spot Fleet's more sophisticated sibling: launch a mix of Spot, On-Demand, and Reserved capacity in one request, balancing cost against guaranteed baseline. 50–80% savings — though for web apps an Auto Scaling Group with a mixed-instances policy usually beats it.
Read the cheat sheetEC2 Hibernation
A pause button that saves RAM to the root EBS volume — resume in 30–60s with warm caches and loaded models instead of a 5–10 min cold boot. Great for expensive-warm-up dev and ML instances; a tactical tool, not an architecture pattern.
Read the cheat sheetEC2 Instance Savings Plans
The precision cousin of Compute Savings Plans: commit to a specific instance family in a specific region for 1 or 3 years for up to 72% off — 6% more than Compute SP. You can flex size, OS, and tenancy, but not family or region. Deepest discount, least flexibility.
Read the cheat sheetEC2 Instance Scheduling
Turn non-production instances off when nobody's using them. Dev/test/demo boxes needed ~50 of 168 hours a week are a ~70% overspend running 24/7 — ten m5.large go from $700 to about $208/month. AWS Instance Scheduler automates it with a tag.
Read the cheat sheetECS Capacity Providers
Blend Spot and On-Demand EC2 (and Fargate Spot) behind an ECS cluster with a base+weight strategy — 60–80% off container compute while an On-Demand baseline keeps you reliable. Diversify Spot pools; keep base on On-Demand only.
Read the cheat sheetECS Fargate Task Rightsizing
Fargate bills provisioned CPU/memory, not used — so the '2 vCPU / 4 GB just to be safe' you set at launch and never revisited is a silent 30–60% leak. Size to p95 + ~25% headroom from Container Insights. A 20-minute, high-confidence win.
Read the cheat sheetECS Service Auto Scaling
Stop running peak-hour task counts at 3 AM. ECS scales tasks to real demand via target-tracking, step, and scheduled policies — often 40–60% off bursty workloads. The catch: scale queue workers on queue-depth-per-task, not CPU, and scale out fast, in slow.
Read the cheat sheetEKS Karpenter
Replace static node groups with Karpenter — it picks the cheapest instance that fits each pod (across hundreds of types), prefers Spot, and consolidates underused nodes continuously. Often 40–60% off EKS with no app changes. The catch: eviction hygiene.
Read the cheat sheetEMR Managed Scaling
Set min/max node boundaries and let EMR scale compute up and down with real workload (YARN memory, pending containers, idle nodes) instead of running peak-sized clusters 24/7. Often ~55% off bursty batch. Scale task nodes; protect data on core nodes.
Read the cheat sheetEMR Reserved Instances
EMR runs on EC2 under the hood, so you don't buy 'EMR RIs' — you buy matching EC2 Reserved Instances that auto-apply to predictable clusters for 30–50% off. A slam dunk for nightly ETL on the same instance types; the wrong tool for exploration.
Read the cheat sheetFargate Spot
Serverless containers on spare capacity for up to 70% off — same Fargate, but AWS can reclaim a task with a 2-minute SIGTERM warning. A near-instant win for batch, queue workers, CI/CD, and dev/test; keep production APIs On-Demand.
Read the cheat sheetReserved Instances
Commit to a specific EC2 instance type + region for 1 or 3 years and get up to 72% off — an automatic billing discount ('a coupon'), not a reserved server. The classic play for steady-state production; cover the baseline, burst on-demand or Spot.
Read the cheat sheetSavings Plans
Reserved Instances' more flexible sibling: commit to a fixed $/hour of compute for 1 or 3 years for up to 72% off, applied automatically across EC2, Lambda, and Fargate. Two flavors — flexible Compute (~66%) or family-locked EC2 Instance (~72%). The modern default.
Read the cheat sheetSpot Fleet
Manage large-scale Spot capacity intelligently — declare 'I need N vCPUs' and Spot Fleet spreads it across many instance types and AZs at the cheapest available price, replacing interruptions automatically. 70–90% off for fault-tolerant workloads. Diversification is the whole game.
Read the cheat sheetSpot Instances
Spare EC2 capacity at up to 90% off — with a 2-minute reclaim warning. The best cost lever in AWS for fault-tolerant, checkpointable, stateless workloads (batch, rendering, CI/CD, ML training). Diversify across types/AZs and set max price to On-Demand.
Read the cheat sheetWorkSpaces AutoStop Billing
Part-time and contractor WorkSpaces on monthly billing pay full rate for desktops that are dark 95% of the week. AutoStop hourly billing hibernates them when idle and charges a tiny base + per-hour — 40–80% cheaper below ~70 hrs/month, but pricier above it.
Read the cheat sheetStorage
AWS Backup Archive Tier
One lifecycle field on a backup plan moves long-retention recovery points to Glacier-backed cold storage at ~$1/TB-month — an 80–90% cut on backups whose realistic future is 'sits on a shelf until the retention clock runs out.'
Read the cheat sheetEBS DeleteOnTermination
The wrong default on secondary EBS volumes leaves orphaned storage billing forever after instances terminate. One boolean in your launch templates stops the bleed; one audit command finds what already leaked.
Read the cheat sheetEBS gp3 Volumes
Migrate EBS volumes from gp2 to gp3 for an immediate 20% price cut with the same or better performance — live, no downtime, one API call per volume.
Read the cheat sheetEBS Snapshot Archive
Move compliance backups and 'just in case' EBS snapshots from Standard to the Archive tier for 75% lower storage cost — the trade is a 24–72 hour restore window that cold snapshots never actually need.
Read the cheat sheetEFS Archive Storage Class
EFS Standard costs ~$0.30/GB-month; EFS Archive costs ~$0.008 — a 97% cut on the same POSIX filesystem for files touched once or twice a year. The only trade: 3–5 hour retrieval on cold reads.
Read the cheat sheetEFS Infrequent Access
The EFS tier for files read less than monthly: ~95% cheaper storage than Standard with the same instant access, plus a small per-GB read fee. Enabled by one lifecycle policy — no app changes, no migration.
Read the cheat sheetEFS Lifecycle Management
The checkbox almost nobody flips: automatic tiering that moves cold EFS files to Infrequent Access and Archive — completely invisible to applications, routinely cutting shared-filesystem bills by half or more.
Read the cheat sheetS3 Batch Operations
Run one action across millions of S3 objects — storage-class changes, mass deletes, cross-account copies — for $0.25 per million, with automatic retries and an audit-grade completion report. No scripts to babysit.
Read the cheat sheetS3 Glacier Deep Archive
AWS's cheapest storage: $0.00099/GB-month — 23× cheaper than S3 Standard — for data you must keep but will almost never read. The trade: 12–48 hour retrievals and a 180-day minimum.
Read the cheat sheetS3 Glacier Flexible Retrieval
Archive storage at ~$4/TB-month — 82% cheaper than S3 Standard — with retrieval speeds you pick per request: minutes (expedited), hours (standard), or overnight (bulk, nearly free).
Read the cheat sheetS3 Glacier Instant Retrieval
Archive pricing with millisecond reads: ~68% cheaper storage than S3 Standard, same GET API, no restore jobs — the sweet spot for compliance and archive data you touch a few times a year but need instantly when you do.
Read the cheat sheetS3 Glacier Select
Run SQL directly against archived Glacier data and retrieve only the matching rows — skip the restore-everything-then-query dance. A 100 GB archive queried for 2 GB of records: ~$0.43 instead of a full restore plus temporary storage.
Read the cheat sheetS3 Glacier: Choosing the Right Tier
The three Glacier tiers — Instant, Flexible, Deep Archive — differ 4× in price and a million× in retrieval speed. A decision guide with the price ladder, the minimums, and the access-pattern test that picks the right one.
Read the cheat sheetS3 Intelligent-Tiering
Let AWS move S3 objects between storage tiers automatically based on real access patterns — no retrieval fees, no lifecycle rules to maintain, typically 30–50% off buckets with mixed or unpredictable access.
Read the cheat sheetS3 Inventory
A scheduled audit report of every object in a bucket — size, age, storage class, encryption status — delivered as queryable CSV/Parquet for ~$0.0025 per 1,000 objects. The foundation for cleanups, compliance answers, and Batch Operations manifests.
Read the cheat sheetS3 Lifecycle Policies
Automatically move aging S3 objects to cheaper storage classes and delete what expires — often 50%+ off the storage line with one rule. The numbers, the commands, and the gotchas.
Read the cheat sheetS3 One Zone-Infrequent Access
20% cheaper than Standard-IA by storing data in a single Availability Zone — a calculated risk that's free money for regenerable data (thumbnails, dev copies, secondary caches) and a terrible idea for anything else.
Read the cheat sheetS3 Requester Pays
Shift S3 download bandwidth and request fees to the people pulling your data — the sustainable model for public datasets and automatic internal chargeback, at the cost of requiring authenticated requests.
Read the cheat sheetS3 Select
Run SQL WHERE clauses inside S3 and receive only the matching rows — pay ~$0.002/GB to scan instead of $0.09/GB to egress whole files. Routinely 40× cheaper when you need a slice of a large CSV, JSON, or Parquet object.
Read the cheat sheetS3 Storage Class Analysis
The free, observation-only tool that watches a bucket's real access patterns for 30 days and tells you exactly which objects belong in cheaper storage — data-driven lifecycle rules instead of guesses.
Read the cheat sheetS3 Storage Lens
Free, org-wide S3 analytics that expose the three classic money leaks — incomplete multipart uploads, non-current version bloat, and cold data in hot storage classes — in a dashboard you just switch on.
Read the cheat sheetDatabases
Amazon RDS Proxy
Connection count, not CPU, is often what forces an RDS upsize. RDS Proxy pools thousands of client connections (especially from Lambda) onto ~10–30 real ones, so a small instance stays small — the proxy fee typically covers 10–25% of the avoided upsize.
Read the cheat sheetAthena Partition Projection
Instead of asking S3 which partitions exist before every query, Partition Projection lets Athena calculate the paths from a pattern you declare — near-instant query startup on tables with thousands of partitions, zero LIST metadata calls.
Read the cheat sheetAthena Query Result Reuse
Athena caches identical query results in S3, so a repeated dashboard refresh or scheduled report returns instantly with zero bytes scanned. A workgroup checkbox that routinely cuts thousands off a scan-heavy bill.
Read the cheat sheetAurora I/O-Optimized
Aurora bills a sneaky third bucket — I/O operations at ~$0.20/million — that can dwarf compute and storage on I/O-heavy workloads. I/O-Optimized zeroes it out for a ~30–40% higher instance rate. A break-even calc, not a default.
Read the cheat sheetAurora Serverless Sizing
Aurora Serverless replaces a fixed instance size with an ACU capacity range that auto-scales — and in v2 pauses to zero compute when idle. Dev/test, bursty, and multi-tenant databases save up to 80%; steady 24/7 high-CPU workloads are cheaper provisioned.
Read the cheat sheetAWS Glue Flex Execution
Flex Execution is economy shipping for Glue jobs: same code, same engine, ~34% less per DPU-hour, in exchange for the job starting when AWS has spare capacity — usually within minutes. One setting, no refactor, ideal for batch ETL.
Read the cheat sheetAWS Glue Job Bookmarks
Without bookmarks, a nightly Glue job rescans the entire S3 bucket to find a sliver of new data. One checkbox makes it track what it's already processed and touch only the delta — routinely cutting incremental-job runtime and cost 90%+.
Read the cheat sheetDynamoDB On-Demand vs Provisioned
DynamoDB On-Demand bills per request and scales instantly with zero capacity planning — nearly 4× cheaper than provisioned on bursty workloads. The break-even: if you'd run provisioned above ~27% utilization consistently, provisioned wins.
Read the cheat sheetDynamoDB Reserved Capacity
Pre-commit to a baseline of provisioned DynamoDB throughput for 1 or 3 years and cut capacity rates up to 77%. Regional (not per-table), Provisioned-mode only, non-refundable — reserve your floor, never your peak.
Read the cheat sheetDynamoDB Standard-IA
DynamoDB Standard-IA cuts storage cost ~60% ($0.25 → $0.10/GB-mo) for tables full of cold data you must keep but rarely query, in exchange for ~25% pricier reads/writes. Same engine, same latency, reversible online in minutes.
Read the cheat sheetElastiCache Auto Scaling
ElastiCache Auto Scaling adds and removes Redis shards on real demand via a target-tracking policy, so you stop paying 24/7 for peak capacity you use a few hours a day. Redis cluster-mode only; scales shard count, not node size.
Read the cheat sheetElastiCache Reserved Nodes
Commit to 1 or 3 years of ElastiCache capacity for 30–55% off on-demand on the same Redis/Memcached nodes you already run. Region- and instance-type-locked, no refunds, compute-only — reserve your baseline, never your peak.
Read the cheat sheetMSK Serverless
MSK Serverless is Apache Kafka billed on throughput (MB-hour) and storage (GB-month) instead of 24/7 brokers — often ~97% cheaper than provisioned at low/variable volume. Same Kafka APIs; the catch is fixed per-partition throughput caps.
Read the cheat sheetNeptune Serverless
Neptune Serverless swaps always-on graph-database instances for capacity that scales per NCU (~$0.12/NCU-hour) between a floor and ceiling you set — 40–60% cheaper on bursty or off-hours graph workloads, pricier on flat 24/7 ones.
Read the cheat sheetOpenSearch Reserved Instances
Commit to 1 or 3 years of OpenSearch capacity for 30–50% off on-demand on the nodes you already run 24/7. Instance-family- and region-locked, no refunds, compute-only — reserve the baseline, not the peak.
Read the cheat sheetOpenSearch Serverless
OpenSearch Serverless bills per OCU consumed instead of always-on nodes, scaling between a floor and cap you set — 40–70% cheaper on spiky log/search workloads, occasionally pricier than a Reserved-Instance cluster on flat 24/7 production.
Read the cheat sheetRDS Instance Stop/Start
Stop RDS instances during off-hours and the compute meter stops (storage keeps billing). Scheduling dev/test and reporting databases nights and weekends saves up to 73% — mind the 7-day auto-restart and don't forget read replicas.
Read the cheat sheetRDS Storage Auto-Scaling
Stop provisioning RDS storage 'just in case.' Start at real size, set a max ceiling, and RDS grows the volume online only when free space drops below 10% or 10 GB. The catch that governs the setting: storage can never shrink.
Read the cheat sheetRedshift Pause and Resume
A Redshift cluster used 9-to-5 still bills 24/7. Pause stops the compute meter (storage keeps billing, resume takes 3–5 min, data intact). Automate it with EventBridge + a 15-line Lambda and a business-hours cluster drops from 168 to ~50 billed hours/week.
Read the cheat sheetRedshift Reserved Nodes
Commit to 1 or 3 years of Redshift capacity for 40–75% off on-demand — one of the biggest discounts AWS offers on a service that's often a huge slice of the bill. Node-type- and region-locked, no refunds, compute-only — reserve the baseline.
Read the cheat sheetRedshift Serverless
Redshift Serverless is the automatic transmission to Pause/Resume's manual lever: same query engine, no cluster sizing, per-second billing, and compute charges that drop to zero when idle. Intermittent and bursty warehouses win big; pegged-24/7 ones may still favor provisioned + RIs.
Read the cheat sheetNetworking
AWS Direct Connect
A dedicated line to AWS drops Data Transfer Out from $0.09/GB to ~$0.02/GB — a 66–75% cut that pays for the port fee many times over at 20+ TB/month of hybrid traffic, and loses money below ~5 TB.
Read the cheat sheetAWS PrivateLink
Interface Endpoints route AWS-service traffic through your VPC privately at $0.01/GB — 4.5× cheaper than NAT Gateway data processing. The payoff is biggest on chatty services: ECR, CloudWatch Logs, Secrets Manager.
Read the cheat sheetAWS WAF Rule Optimization
One rule per blocked IP or bot signature is how teams hit WAF's 1,500-WCU ceiling and a $1/rule/month bill. IP Sets, Regex Pattern Sets, and combined conditions collapse 50 rules into 10 — same protection, 60%+ less capacity and cost.
Read the cheat sheetCloudFront Egress Discounts
Counterintuitive but true: putting CloudFront in front of S3, EC2, or an ALB usually makes the egress bill smaller — CDN transfer rates undercut direct Data Transfer Out, and edge caching removes origin traffic entirely. 30–55% cuts are typical at scale.
Read the cheat sheetCloudFront Private Pricing
AWS's worst-kept secret: at 10+ TB/month of CDN egress you can negotiate custom CloudFront rates — typically 20–40% below the public price list — but only if you ask. AWS will never bring it up first.
Read the cheat sheetCloudFront Security Savings Bundle
A self-service, console-buried discount: commit to a monthly CloudFront + WAF spend for one year and get up to 30% off — no account manager, no procurement, ten minutes of clicking. Size the commitment to your lowest month, not your average.
Read the cheat sheetNAT Gateway Consolidation
Every VPC running its own NAT Gateways pays ~$32/month per AZ before data charges. One shared egress VPC behind a Transit Gateway replaces most of them — typically saving $3,000–$10,000+ a year at 3+ VPCs.
Read the cheat sheetTransit Gateway Peering
Route inter-region AWS traffic over the private backbone at $0.02/GB instead of $0.09/GB public-internet egress — a 77% cut — while replacing an N²-connection VPC-peering mesh with one hub per region.
Read the cheat sheetVPC Endpoints
Gateway Endpoints (free, S3/DynamoDB) and Interface Endpoints ($7.20/month + $0.01/GB, most other services) keep AWS-service traffic off the public internet — cutting $0.09/GB transfer and $0.045/GB NAT fees. Know the break-even before creating fifteen of them.
Read the cheat sheetVPC Gateway Endpoints
A free, 60-second route-table change that makes all S3 and DynamoDB traffic from private subnets bypass the NAT Gateway — eliminating $0.045/GB in data processing fees. One of the only pure-savings plays in AWS.
Read the cheat sheetServerless & AI
API Gateway HTTP APIs
HTTP APIs cost ~$1.00 per million requests versus REST's ~$3.50 — a 71% cut with lower latency and native JWT auth. Most REST APIs use none of the features that premium pays for; audit and migrate the eligible 80%.
Read the cheat sheetApp Runner Automatic Pausing
App Runner Automatic Pausing scales your service to zero when idle — you stop paying for provisioned compute and trade it for a 2–5s cold start on the first request. Business-hours apps save 60–70%, sporadic ones 80–95%.
Read the cheat sheetAWS Lambda Power Tuning
Lambda bills GB-seconds, so memory and speed trade off — and for CPU-bound code, more memory is often cheaper. Power Tuning tests every memory setting against your real function in ~5 minutes and typically finds 20–50% savings.
Read the cheat sheetGameLift Spot Fleets
Run multiplayer game servers on Spot capacity with an On-Demand buffer and let GameLift FleetIQ handle the 2-minute interruption choreography — typically 70–85% cheaper than pure On-Demand, invisible to players.
Read the cheat sheetIoT Core Message Filtering
IoT Core is cheap (~$1/M messages) but the fan-out to Lambda, DynamoDB, Kinesis, and S3 is where the bill lives. A single Rules Engine SQL WHERE clause drops noise at the door and cuts downstream cost 50–90%.
Read the cheat sheetLambda Function URLs
Every Lambda can have a free built-in HTTPS endpoint — no API Gateway, no per-request routing fee, 10–30 ms less latency. The right tool for webhooks, internal service calls, and simple endpoints that were never using gateway features.
Read the cheat sheetSageMaker Inference Recommender
Cost-per-inference — not cost-per-hour — decides what a SageMaker endpoint really costs. Inference Recommender benchmarks your model across instance families, ranks them by dollars-per-10K, and routinely surfaces an Inferentia win worth half the bill.
Read the cheat sheetSageMaker Managed Spot Training
One boolean puts SageMaker training jobs on Spot capacity at 50–90% off, with interruption handling and checkpoint-resume automated. The only real requirement: your script must actually write checkpoints.
Read the cheat sheetSageMaker Multi-Model Endpoints
Host dozens to hundreds of models on one endpoint: hot models stay in RAM, cold ones live in S3 and load on demand. For per-customer or per-category model fleets with skewed traffic, it's an 85–95% hosting cut — and the only architecture that scales economically.
Read the cheat sheetSageMaker Savings Plans
Commit to a $/hour of SageMaker compute for 1–3 years and get up to 64% off — flexible across instance types, regions, training, and inference. The discipline: commit to 70–80% of your proven baseline, never your peak, and never mid-migration.
Read the cheat sheetSageMaker Serverless Inference
Stop renting a 24/7 endpoint for a model invoked sporadically — serverless inference bills only compute-milliseconds and memory-GB actually used, turning $100+/month idle endpoints into single-digit bills. The trade: 5–15 s cold starts, 6 GB/60 s/CPU-only limits.
Read the cheat sheetStep Functions Express Workflows
Step Functions bills Standard Workflows per state transition and Express per request + GB-second. For high-volume, sub-5-minute, idempotent orchestrations the same workflow runs 90–98% cheaper on Express — one config change.
Read the cheat sheetOperational Efficiency
AWS Config Resource Exclusion
AWS Config bills ~$0.003 per configuration item, and the 'record everything' default meters every ENI and Lambda-version change your account churns through. Excluding high-churn, zero-audit-value resource types cuts most Config bills 40–70%.
Read the cheat sheetAWS License Manager
Windows EC2 costs ~2× Linux; SQL Server Enterprise adds $4–5/hour on top. If you already own those licenses under Software Assurance, BYOL removes the AWS markup — and License Manager is the free tracking layer that makes it audit-safe.
Read the cheat sheetAWS Resource Explorer
Free, cross-region, cross-account search for everything in your AWS estate — the fastest way to surface the orphaned volumes, unassociated Elastic IPs, forgotten NAT Gateways, and idle SageMaker endpoints that accumulate in any account older than two years.
Read the cheat sheetCloudWatch Logs Infrequent Access
The IA log class halves both ingestion (~$0.25/GB) and storage (~$0.015/GB-month) for write-and-forget log groups — but silently disables metric filters, subscription filters, and Live Tail. Know the disable list before you move anything.
Read the cheat sheetCloudWatch Logs Retention Policies
Every new log group defaults to Never Expire, so logs from 2019 experiments still bill you today. One CLI line per log group (or one bulk script per region) cuts log storage 60–90% with zero application risk.
Read the cheat sheetGuardDuty Selective Protection
GuardDuty is six separately-billed products in one console — and the default enables all of them, with a 30-day trial that rolls into paid without warning. Disable the plans monitoring services you don't run: zero security loss, often a 60–80% cut.
Read the cheat sheetQuickSight Reader Pricing
QuickSight readers cost $0.30 per 30-minute session, capped at $5/user/month — light users cost pennies, heavy users self-cap. It's what makes company-wide BI cost hundreds instead of the $30–70/seat that traditional BI charges.
Read the cheat sheetQuickSight SPICE Capacity
SPICE bills on capacity allocated, not used — and allocations only drift upward. Auditing datasets (delete unused, trim SELECT *, pre-aggregate fact tables) then lowering the allocation routinely cuts the second-largest QuickSight line by 40–60%.
Read the cheat sheetSecrets Manager Rotation Scheduling
At $0.40 per secret per month, the waste isn't the price — it's the 240 orphaned and duplicate secrets nobody deleted, the daily rotations your policy never asked for, and the un-cached GetSecretValue calls burning $1,300/month on one Lambda.
Read the cheat sheetCost Governance
AWS Billing Conductor
Billing Conductor restructures how a bill is allocated and presented internally — pro-forma invoices with custom rates, markups, and line items — without changing what AWS actually charges. It's an accounting tool for MSPs and complex chargeback, not a savings tool.
Read the cheat sheetAWS Budget Actions
A regular budget emails you; a Budget Action does the thing for you — attach a deny-IAM policy, apply an SCP, or stop tagged EC2/RDS when a threshold breaks. The difference between an alarm and a circuit breaker, and it costs nothing extra.
Read the cheat sheetAWS Budgets
The one cost-governance feature to set up first: a threshold plus a notification that pings you before the bill lands. Forecasted-80% is the single most effective alert AWS offers; first two budgets are free.
Read the cheat sheetAWS Cost and Usage Reports
Cost Explorer is a dashboard; CUR is the database. Every billing line item — one resource × one hour × one usage type, hundreds of columns — dumped to S3 for Athena/QuickSight when the question doesn't fit Cost Explorer's dropdowns. Use CUR 2.0 via Data Exports.
Read the cheat sheetAWS Cost Anomaly Detection
Free ML-driven monitors that learn your normal spend and flag deviations within a day or two — catching the runaways you never thought to set a budget on. Narrow per-service monitors catch small spikes broad ones miss.
Read the cheat sheetAWS Cost Categories
A free rules engine that re-bundles tags, services, and accounts into the stakeholder-friendly dimension your CFO actually reads — and can proportionally split shared costs across consumers — without re-tagging a single resource.
Read the cheat sheetAWS Cost Explorer
If Budgets is the alarm clock, Cost Explorer is the magnifying glass — the free console for slicing 12 months of spend by service, tag, and account. Enable it day one, start broad and drill down; it turns a multi-hour mystery into a 5-minute investigation.
Read the cheat sheetAWS Cost Optimization Hub
The 2023 dashboard that finally puts every AWS cost recommendation — Compute Optimizer rightsizing, Trusted Advisor idle resources, Savings Plans/RI advice — on one sortable screen with dollar amounts. It prioritizes the work; it doesn't do it for you.
Read the cheat sheetAWS Free Tier
The Free Tier is three different things — 12-month, Always Free, and trials — and knowing which is which is the difference between a permanently-free serverless stack and a $480 month-13 surprise. Plus the un-free traps (NAT Gateway, ALB, unattached EIPs) that bite new accounts.
Read the cheat sheetAWS Organizations Consolidated Billing
The free multi-account structure that pools volume-tier pricing and auto-shares one Reserved Instance or Savings Plan across every linked account. Going from one big account to a 5-account Org costs $0 and unlocks 5–15% of the bill.
Read the cheat sheetAWS Pricing Calculator
calculator.aws builds a per-service estimate before you build — the per-unit rates are accurate; the usage you type isn't. The seven line items people forget (cross-AZ transfer, NAT processing, S3 requests, CloudWatch Logs…) are what turn a $4k estimate into a $14k bill.
Read the cheat sheetCost Allocation Tags
The single biggest unlock for knowing who spends what on AWS — and the prerequisite nearly every other cost tool assumes. It's two switches: tag the resource, then activate the tag key in Billing. Teams forget the second one.
Read the cheat sheetRightsizing Recommendations in Cost Explorer
Cost Explorer's built-in EC2 rightsizing tab is free, already populated, and almost nobody opens it — a fast first-pass scan for oversized and idle instances. Its one trap: without the CloudWatch Agent it sees only CPU, so memory-bound workloads look downsizable.
Read the cheat sheetTrusted Advisor — Cost Optimization Checks
AWS's built-in 'free money detector' — automated checks for idle, unattached, and underutilized resources, each with a dollar figure. The full suite needs Business+ Support; Compute Optimizer and Cost Optimization Hub cover most of it free.
Read the cheat sheetTrusted Advisor — Idle Load Balancers
The single most common 'orphan in plain sight' finding — ELBs still billing ~$16–25/month long after the service they fronted was deleted. Highest-confidence Trusted Advisor cleanup: verify with DNS + IaC + CloudWatch, then delete.
Read the cheat sheetTrusted Advisor — Low Utilization EC2 Instances
The flagship 'somebody's running an instance for nothing' check — flags <10% CPU + <5 MB net on 4+ of 14 days. Useful but blunt and CPU-only; it's the start of a conversation (stop / schedule / terminate / rightsize), not a delete button.
Read the cheat sheetTrusted Advisor — Public EBS Snapshots
A public EBS snapshot is a disk image of your server any AWS customer can copy — a security incident first, a cleanup second. Making it private stops future access but can't undo copies already made. Rotate exposed credentials, then delete.
Read the cheat sheetTrusted Advisor — RDS Idle DB Instances
An idle RDS instance bills 24×7 even with zero connections — and a Multi-AZ SQL Server one can be $2K+/month doing nothing. You can't 'stop and forget' (7-day auto-restart), so the durable fix is snapshot-and-delete: ~97% cheaper, data preserved.
Read the cheat sheetTrusted Advisor — Redshift Reserved Node Optimization
Redshift is the rare service where Reserved Nodes still crush on-demand — up to 75% off at 3-year all-upfront, with no Savings Plan equivalent coming. Trusted Advisor's recommendation is usually right; the one rule is migrate node family first, buy the RN second.
Read the cheat sheetTrusted Advisor — Unassociated Elastic IPs
The cleanest 'free money' finding in AWS: EIPs reserved but attached to nothing, billed ~$3.60/month each — sometimes by the hundreds. Release everything except tagged partner-allowlist/DR reserves; the per-resource cost is small enough that nobody notices the bleed.
Read the cheat sheetTrusted Advisor — Underutilized EBS Volumes
EBS waste comes in two flavors Trusted Advisor lumps together: unattached orphans (snapshot-and-delete) and oversized/over-tier attached volumes (gp2→gp3 or io2→gp3). The io2→gp3 conversion alone can save ~$200/month per volume.
Read the cheat sheetTrusted Advisor — Unutilized NAT Gateways
A NAT Gateway costs ~$32/month per AZ just to exist — a 3-AZ VPC is $96/month before a byte flows. Trusted Advisor lists the near-zero-traffic ones; delete them (and release the EIP underneath), and replace AWS-service egress with VPC Endpoints.
Read the cheat sheet