AWS Idle Resources: NAT, Load Balancers, Caches, Endpoints
On AWS the idle bill hides in infrastructure nobody logs into: network plumbing, managed data services and ML endpoints.
The AWS idle rules look past EC2 to the services that bill by the hour whether or not anything touches them. Each one reads the CloudWatch metrics its service publishes, requires 30 days of coverage, and prices the finding from the resource’s own monthly cost. If a metric is missing or the price is unknown, the rule abstains.
Network plumbing
Idle NAT Gateway is the strictest check on the list: all five NAT gateway counters, active connections plus bytes in and out on both the request and return path, must be zero for the whole window. Idle Load Balancer reads request count, active connections, flows, processed bytes and consumed LCUs by exact name, and treats network load balancers separately because they publish a different metric set. Idle VPC Interface Endpoint prices the endpoint from its per-AZ interface count. Idle Transit Gateway and VPN Connection Idle, No Tunnels Up cover the rest of the network edge. Fact sheets: NAT gateway, ALB, VPC endpoint.
Managed data services
ElastiCache Cluster Idle needs four metric axes below their floors for 30 days before it fires, and prices the whole node run-rate. OpenSearch Domain Idle checks search rate, indexing rate and CPU together, so a domain that only indexes is not called idle. Idle RDS Instance, No Connections fires on zero client sessions with CPU as corroboration; it is advisory, because a one-time stop does not deliver a saving priced on removal. Idle Aurora Cluster, Idle Neptune Cluster and Idle DocumentDB Cluster follow the same connection-based pattern. See ElastiCache and RDS.
ML and AI endpoints
Idle SageMaker Endpoint, No Invocations watches endpoints in service with no invocations, using CPU as a telemetry guard, and abstains on multi-variant endpoints where one series cannot prove the whole endpoint idle. Bedrock Provisioned Throughput Idle fires on throughput with no invocations but abstains when the throughput is under a commitment term, since it cannot be torn down early.
Leftovers of stopped compute
Idle EC2 Instance is different from its name: it targets instances stopped for 30 days or more, where compute has already stopped billing but attached EBS volumes and an associated Elastic IP have not. The saving is that residual, not the instance rate. EKS Abandoned Node Group does the same for a degraded node group’s orphaned volumes and load balancers. For running but quiet EC2, the lever is a schedule, covered on AWS EC2.
Acting
Deletes such as Idle EFS File System run through the remediation wizard with precondition and approval steps, on a read + write account. Everything else links to its console page with a numbered fix. All AWS rules: AWS recommendations. Other AWS categories: orphans, rightsizing.