All cheat sheets
Cost Governancecheat sheet

Trusted Advisor — Underutilized EBS Volumes

EBS waste comes in two flavors Trusted Advisor lumps together: unattached orphans (snapshot-and-delete) and oversized/over-tier attached volumes (gp2→gp3 or io2→gp3). The io2→gp3 conversion alone can save ~$200/month per volume.

Last reviewed: July 14, 2026

TL;DR: EBS waste comes in two very different flavors that Trusted Advisor mixes into one finding. Orphans — volumes unattached after an instance was terminated without delete-on-termination — are pure dead weight (snapshot-and-delete). Oversized/over-tier — attached volumes doing tiny I/O on a big gp2 or Provisioned-IOPS io2 volume — are silent overspend (convert to gp3). The actions are completely different, and the highest-dollar move is usually io2→gp3, ~$200/month per volume.

The numbers

  • EBS bills continuously regardless of instance state — stopping an EC2 instance pauses compute, not storage; a 1 TB gp2 orphan = $100/mo ($1,200/yr) doing nothing.
  • Rates: gp2/gp3 $0.08–0.10/GB-mo; io1/io2 $0.125/GB-mo + $0.065 per provisioned IOPS-mo (a 500 GB io2 at 3000 IOPS ≈ $257/mo); st1 $0.045, sc1 $0.015.
  • gp3 is strictly cheaper than gp2 (~20% off) and includes 3000 IOPS + 125 MB/s free — an online, reversible one-command conversion.
  • io2→gp3 on a low-IOPS volume: ~$257/mo → ~$40/mo (gp3's free 3000 IOPS usually exceeds actual use).
  • Field examples: 40 unattached gp2 orphans = $320/mo ($3,840/yr) snapshot-and-deleted; a "match production" io2 volume doing 4 IOPS average = $390/mo → ~$45/mo ($4,140/yr) converted to gp3.

Do this

  1. Snapshot-and-delete the orphansdescribe-volumes --filters Name=status,Values=available, sort by size, snapshot anything large/uncertain (snapshots are ~50–87% cheaper per GB, or use the archive tier), then delete. Set delete-on-termination in IaC so it stops recurring.
  2. Convert all gp2 to gp3 — online, zero downtime, ~20% cheaper at equal-or-better performance: aws ec2 modify-volume --volume-id <id> --volume-type gp3.
  3. Downgrade over-provisioned io1/io2 to gp3 — the single biggest per-volume win; check peak (not just average) IOPS first, and confirm you don't need >16,000 IOPS, >1,000 MB/s, or io2's 99.999% durability SLA.
  4. Only shrink oversized volumes when it's worth it — EBS can't shrink in place (snapshot → smaller volume → filesystem resize → swap), so reserve the effort for 1 TB+ volumes oversized 4×+, ~$30/mo+ savings.
  5. Audit snapshot orphans too — snapshots of deleted volumes linger and still cost; delete ones you no longer care about.

Gotchas

  • "Low average IOPS" misleads on burst workloads — a volume idle 99% of the time but bursting to thousands of IOPS during a daily job needs the headroom; check peak before downgrading.
  • Multi-attach (io1/io2) blocks gp3 — gp3 doesn't support multi-attach; verify usage before converting.
  • Encryption KMS access — a snapshot-restore to a new volume needs access to the original customer-managed KMS key.
  • Root vs data volumes — root volumes are trickier to swap (AMI mechanics); Trusted Advisor doesn't distinguish, you should.

Skip this if

  • An io2 volume genuinely needs >16,000 IOPS, >1,000 MB/s, or the 99.999% durability SLA — it's correctly sized; the "we picked io2 to be safe" case is the one to convert.
  • A small oversized volume would save under ~$30/mo — the shrink procedure's downtime and fiddliness aren't worth it. Deep-dive on the biggest single move: EBS gp3 Volumes; prevent orphan accumulation with EBS DeleteOnTermination and cut snapshot cost with EBS Snapshot Archive. Parent: Trusted Advisor Cost Optimization; Compute Optimizer also produces EBS recommendations.

Run this audit with your AI assistant

Paste this into Claude, ChatGPT, or any agent that can run the AWS CLI with read-only credentials. It audits your account for exactly the waste this sheet describes — and changes nothing.

You are auditing an AWS account for underutilized EBS volumes. Use the
AWS CLI with READ-ONLY credentials. Do not create, modify, or delete
anything — report findings and recommended (unapplied) fixes only.

1. Unattached orphans: aws ec2 describe-volumes --filters
   Name=status,Values=available — list id, size, type, CreateTime, tags.
   Flag anything >90 days old and untagged (recommend snapshot-then-delete).
2. gp2 -> gp3: aws ec2 describe-volumes --filters
   Name=volume-type,Values=gp2 — all are ~20% cheaper on gp3 at same
   performance (online, reversible).
3. Over-tier Provisioned IOPS: for io1/io2 volumes pull CloudWatch
   VolumeReadOps/VolumeWriteOps (peak AND average) over 30 days. Flag
   sustained use well under 3000 IOPS as gp3 candidates (~$200/mo each).
   Check multi-attach (blocks gp3) and encryption KMS access first.
4. Oversized: flag volumes far larger than filesystem use, but only
   recommend the shrink (snapshot->smaller volume) when savings >~$30/mo.

Report a table: volume | attached? | type | size | 30-day IOPS (avg/peak)
| recommended action (snapshot-delete / gp2->gp3 / io2->gp3 / shrink) |
est. $/mo. Change nothing.
Works with any assistant that can run shell commands.

Want the guided version?

The Trusted Advisor — Underutilized EBS Volumes walkthrough covers this topic interactively — it asks about your setup, branches to what’s relevant, and quizzes you on the tricky parts. Free and anonymous.

Start the walkthrough