T-series instances throttling on an empty CPU credit balance
What does ZopNight detect here?
Burstable EC2 instances (t2, t3, t3a, t4g) throttle to baseline once their CPU credit balance runs out. ZopNight flags an instance only when both the average and the maximum CPUCreditBalance stay below 5.0 across a full 30-day window. That is chronic starvation, never a one-off busy day.
Signal and threshold
| Field | Value |
|---|---|
| Rule IDs | RC-188 |
| Category | performance |
| Severity | medium |
| Metric | none — pure configuration read |
| Source | ec2_burstable_credits.go |
Where it applies
What an empty balance does to a workload
T-series instances run on a bargain: stay below a CPU baseline most of the time and bank credits for short bursts. When the balance hits zero the instance does not fail. It is throttled to its baseline share of the CPU. The symptom is mystery latency: utilisation graphs look modest because modest is all the instance is allowed, while request queues quietly grow.
The two-statistic bar
One low reading proves nothing, so the rule reads CPUCreditBalance, one of the metrics EC2 reports to CloudWatch, across a 30-day window and requires two things at once: the average balance is below 5.0, and the maximum balance is below 5.0.
The maximum is the important half. A healthy instance that occasionally drains its credits still refills to a high peak between bursts, so its 30-day maximum sits well above the floor. Only a box that never climbs above 5 credits, even at its best moment in a month, is chronically starved. And the 5.0 floor, rather than exactly zero, tolerates the small hourly refills a throttled instance still earns.
Watch the balance yourself
aws cloudwatch get-metric-statistics \ --namespace AWS/EC2 --metric-name CPUCreditBalance \ --dimensions Name=InstanceId,Value=i-0123456789abcdef0 \ --start-time "$(date -u -v-30d +%Y-%m-%dT%H:%M:%SZ)" \ --end-time "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \ --period 86400 --statistics Average MaximumFlat lines near zero in both columns reproduce the finding.
Why the claimed saving is $0 on purpose
Every remedy costs more, not less: unlimited mode bills per vCPU-hour spent over baseline, and moving to a fixed-performance family (m5, c5) buys a bigger machine. So this recommendation claims no saving. It is a performance advisory, and it is excluded from savings headlines entirely rather than counted as a $0 cost item.
What it will not flag
Non-burstable instance types are out of scope, as are stopped instances. A newly launched instance abstains until enough metric history has accumulated to be representative. A day-old box with a low balance is normal, not starved. And when the CPUCreditBalance series is missing altogether, the rule abstains instead of guessing from CPU utilisation.