Every inherited infrastructure we audit has roughly the same waste in roughly the same places. It's rarely exotic. It's forgotten resources, oversized instances, and one or two line items nobody has read in two years.
Here's the audit, in the order we run it, with the five findings that account for most of what we recover.
1. Idle and orphaned resources
Unattached EBS volumes. Load balancers pointing at nothing. Snapshots from a migration completed in 2023. NAT gateways in a subnet with no traffic. None of this is interesting, and all of it bills monthly.
This is usually the first ten percent, and it takes an afternoon. Start here because it's free money and it builds the case for the rest.
2. Rightsizing before committing
Teams reach for reserved instances and savings plans first because the discount is advertised. That's backwards: a commitment on an oversized instance locks in the waste for a year.
Look at actual utilisation over 30 days. In our experience most production fleets run comfortably at half the provisioned size. Right-size first, then buy the commitment against what you actually need.
A three-year reservation on an instance you didn't need is the most expensive discount in cloud computing.
3. Data transfer
Cross-AZ traffic, NAT gateway processing, and egress are the charges nobody reads and everybody overpays. We routinely find services chatting across availability zones for no architectural reason at all — just an accident of where things landed.
Co-locate the chatty services, put a CDN in front of anything public, and use VPC endpoints instead of routing internal traffic through a NAT gateway.
4. Storage tiers
Most S3 buckets have never had a lifecycle policy. Logs from 2022 sit in standard storage at full price. Set lifecycle rules, move cold data down the tiers, and delete what compliance doesn't require you to keep.
5. Non-production running at 3am
Staging, dev, and QA environments typically run 168 hours a week to serve about 50 hours of actual use. Schedule them down outside working hours. It's a scheduled Lambda and it cuts those environments by roughly two thirds.
The prerequisite: tagging
None of this is sustainable without attribution. If you can't say which team or service owns a resource, you can't decide whether it should exist — and the waste creeps back within a quarter.
Enforce tags at creation, set up per-team cost reporting, and make the numbers visible to the people who create the resources. Optimisation that isn't attributable is a one-off cleanup, not a practice.