Skip to main content
idle · aws

Idle SageMaker Endpoint, No Invocations

resource types
1
rule IDs covered
1
severity
high

What does ZopNight detect here?

SageMaker real-time endpoints that are in service, single-variant, and record zero Invocations over the 7-day lookback burn continuous ML-compute for nothing. ZopNight treats an absent Invocations series as genuine zero traffic only when CPUUtilization telemetry proves the endpoint is monitored, books the full monthly cost as savings, and abstains on Savings-Plan-covered endpoints.

Signal and threshold

How ZopNight evaluates Idle SageMaker Endpoint, No Invocations.
Field Value
Rule IDsRC-1613
Categoryidle
Severityhigh
Metricnone — pure configuration read
Sourcesagemaker_endpoint_idle.go

Absent invocations on a single-variant endpoint

  • resource.Type: sagemaker-endpoint, Status inservice
  • Metadata[“productionVariantCount”]: abstains when > 1 (a multi-variant endpoint stores a single Invocations series keyed by one VariantName; a zero reading does not prove the whole endpoint is idle)
  • metric: AWS/SageMaker Invocations (Sum), one of the endpoint metrics SageMaker publishes to CloudWatch, dimensioned by EndpointName/VariantName, keyed by endpoint UID
  • metric: CPUUtilization, the telemetry guard. CloudWatch publishes no Invocations datapoints for a zero-traffic endpoint (B3, #1701), so an absent Invocations series is the common idle signal; a CPUUtilization series with ≥ MinMaxCoverageDays coverage proves the endpoint is live/monitored, letting us treat absent Invocations as genuine zero traffic rather than a data hole. in-service real-time, single-variant endpoint AND telemetry exists (an Invocations series OR a CPUUtilization series with ≥ MinMaxCoverageDays coverage) AND the Invocations series is absent OR reads Average == 0 AND Maximum == 0 AND positive monthly cost AND not SP/reservation covered. A single spike (Maximum > 0) suppresses the rule; the endpoint is in use.

Why committed spend blocks the saving

concrete-or-abstain (cost-driven idle). Non-covered: the full eliminated continuous ML-compute charge is the real saving: savings = cost, optimized = 0. Commitment guard → abstain: an SP/reservation-covered endpoint now returns nil (deleting does not stop the committed spend, since it re-applies to other eligible usage, and the true committed charge is unknown since the on-demand rate overstates it 30-70%, so there is no concrete dollar lever, #96). It no longer fires at savings=0/medium. Skips when pricing is unavailable (no zero-cost recs).

Serverless or delete the endpoint

  1. Confirm no application is invoking this endpoint (check CloudWatch Invocations)
  2. If a model must stay deployable, migrate to a serverless endpoint (pay-per-inference)
  3. Otherwise delete the endpoint to stop instance charges
  4. Clean up the associated endpoint config and unused models

Invocations and the 7-day telemetry guard

Invocations (Sum, traffic signal) + CPUUtilization (telemetry guard for the absent-Invocations case), 7-day lookback (sagemakerEndpointIdlePeriodDays=7)

See it fire on your bill.

Connect an account read-only. The first findings land in minutes.

417 rule families across 353 resource types on 22 platforms. Every threshold, metric, and IAM action is documented on these pages before you grant anything.

417 rule families documented
353 resource types covered
read-only default access level
Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console· Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console·