Skip to main content
idle · aws

Idle API Gateway

resource types
1
rule IDs covered
1
severity
medium

What does ZopNight detect here?

API Gateway APIs with a Count series showing zero requests across the full 30-day window would be delete candidates worth their entire monthly cost. ZopNight abstains on every API today: the aggregator prices api-gateway at $0 (calcFree), and the CloudWatch query dimensions ApiName by ID instead of display name.

Signal and threshold

How ZopNight evaluates Idle API Gateway.
Field Value
Rule IDsRC-166
Categoryidle
Severitymedium
Metricnone — pure configuration read
Sourceapi_gateway_idle.go

The Count series and the cost gate

  • metric: Count (CloudWatch AWS/ApiGateway, Dimension ApiName; replaces the dead requests Tag). Keyed UID:Count.
  • pricing: per-API recoverable monthly cost (abstains when absent or ≤ 0).

Two producer gaps that keep this abstaining

Concrete or abstain: savings = cost × 1.00 (full cost recoverable on delete). Fires only when the Count series is present, covers the full window, is idle (Maximum==0 && Average==0), and r.pricing[uid] > 0. Producer-gap #1 (cost, dormant on live data): aws api-gateway/api-gateway-v2 are mapped to calcFree in the aggregator (registry.go:166-167), so r.pricing[uid]==0 for every API Gateway in production and the cost-gate always abstains, so RC-166 never emits on live data today. To make it fire concretely, the producer must move api-gateway off calcFree onto a Count(Sum) times per-request-rate calc (and surface fixed standing items like custom-domain/ACM/log-retention); an idle API’s usage cost is itself ~$0. Producer-gap #2 (metric, independent, fails first): the aggregator’s api-gateway MetricSpec dimensions the CloudWatch Count query with the resource UID (the API’s ID), but AWS’s real ApiName dimension is the API’s configured display name, so for most real APIs the series is empty/absent and the metric gate abstains before the cost gate is even reached. Fixing this requires the discoverer to capture the API’s display name into Metadata and the MetricSpec to dimension off it. Never fabricates a fraction and never emits $0.

Retiring an unused API

  1. Verify no applications depend on this API
  2. Check custom domain mappings and Route 53 records
  3. Delete unused stages first
  4. Delete the API Gateway if confirmed unused

The Count metric window

Count (30d)

See it fire on your bill.

Connect an account read-only. The first findings land in minutes.

417 rule families across 353 resource types on 22 platforms. Every threshold, metric, and IAM action is documented on these pages before you grant anything.

417 rule families documented
353 resource types covered
read-only default access level
Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console· Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console·