The Recent Activity tab

TWO DIFFERENT QUESTIONS:

  METRICS: "What did the resource do?"
    CPU, memory, network, IOPS
    Resource's behavior

  ACTIVITY: "What happened TO the resource?"
    Operations: Modify, Start, Stop, Delete, Create snapshot
    Resource's lifecycle events

SOURCE                                  COLLECTS
─────────────────────────────────────────────────────────
AWS CloudTrail                          Write management events (read calls
                                        such as Describe are not collected)
GCP Cloud Logging                        Audit logs, admin logs
Azure Activity Log                      Resource-level operations

RECENT ACTIVITY: i-0abc123def            7-day lookback
─────────────────────────────────────────────────────────
  Total         7    write events in the window
  Max           3    events in the busiest hour
  Active hrs    4    hours with at least one event

  Chart: hourly buckets; hover an hour to see its
  operations (StartInstances, StopInstances,
  CreateSnapshot, ...)

RESOURCE DETAIL: Last Modified by
  ops-team@example.com   Active
  StopInstances · 2026-04-15

1. WRITE EVENTS IN THE 7-DAY WINDOW
   Total and active hours: has anyone changed it lately?
   No events at all = the panel does not render, which is
   itself the signal

2. LAST MODIFIED BY
   Who last changed it, when, and whether they are still
   in the directory (Active or Departed)
   A departed last modifier = nobody left who knows it

3. OPERATION MIX
   No Start/Stop/Modify among the write events
   = resource exists but isn't being managed
   Typical pattern for orphans

EXAMPLE: stopped EC2 instance

METRICS:
  CPU = 0% (always; it's stopped)
  Memory = 0% (always; it's stopped)
  Network = 0% (always; it's stopped)

  CONCLUSION FROM METRICS ALONE:
  Stopped resource using no compute. Idle? Maybe? Could be hot-swap DR target.

ACTIVITY (Recent Activity tab):
  Last 7 days: 0 write events (the Recent Activity panel
  does not render when there are none)
  Owner tag: empty
  Snapshot frequency: 0 in 7 days

  CONCLUSION FROM ACTIVITY:
  Nobody has changed this in the whole lookback window, and
  nobody owns it. Almost certainly abandoned. Safe to terminate.

COMBINED:
  Metrics + Activity = high confidence
  Multiple independent signals agreeing
  This is the canonical "safe to terminate" pattern

RC-001 (Idle EC2) fires on:
  1. status=stopped (cloud state)
  2. 30+ days stopped (history)

CROSS-CHECK with Recent Activity:
  3. Total write events = has anyone changed it
  4. Active hours = how often it was touched
  5. Operation mix = is anyone managing it

TRIPLE CONFIRMATION before terminating:
  All three signals align → high confidence

TYPICAL HIGH-CONFIDENCE PROFILE:
  Stopped 47 days
  No Recent Activity panel (0 write events in the 7-day lookback)

  → Terminate with snapshot; almost certainly safe

FOR RUNNING PRODUCTION RESOURCES:
  Recent Activity less useful (everything's active)
  Operations: thousands per day
  Hard to tease out signals

WHERE THE TAB SHINES:
  Stopped resources (confirm abandonment vs hot-standby)
  Rarely-used resources (confirm true low usage)
  Snapshots and orphans (confirm nobody touched)
  Cross-account resources (catch un-owned ones)

NOT USEFUL FOR:
  Detecting traffic patterns (use ALB / CloudFront logs)
  Performance debugging (use APM / tracing)
  Security incidents (use proper SIEM)

SIGNAL                              INTERPRETATION
─────────────────────────────────────────────────────────────
No Recent Activity panel            No write events in 7 days
                                    (strongest quiet signal)
A few active hours in 7 days        Sporadic use; investigate pattern
Active hours on most days           Active management; not idle

Last Modified by: Active            Someone still owns the change
Last Modified by: Departed          Possible abandonment; find
                                    the new owner
No Last Modified by                 No human write on record

No write operations at all          Nobody changing it
Operations include Modify/Start     Active management
Recent Delete                       Cleanup in progress (don't action)

Owner tag empty + no panel          Strong abandonment
Owner tag valid + recent event      Active management

NOT IN ACTIVITY-SYNC:
  Read operations from inside the resource (e.g., RDS query count)
  Application-level activity (HTTP requests, db queries)
  Internal service-to-service calls without cloud-API involvement

ACTIVITY-SYNC ONLY CAPTURES:
  Cloud-API operations (CloudTrail equivalent)
  Operations that touch the cloud control plane

FOR INTERNAL APPLICATION ACTIVITY:
  Use app-level monitoring
  Logs, metrics from the application
  Not in scope for cost-optimization rule evidence

ACTIVITY-SYNC cron:
  Daily at 20:50 UTC (fetches the previous day's logs)
  Higher frequency would hit cloud-log-API rate limits

DATA FRESHNESS:
  Max ~24 hours stale
  Cost optimization tolerates this

ALTERNATIVE for real-time activity:
  CloudTrail console directly (not via ZopNight)
  For incident response, not cost optimization

SCENARIO:
  Resource: db-temp-staging (RDS db.r5.4xlarge in production account)
  Original purpose: temporary database for a Q3 2024 project
  Status: still running (forgotten?)
  Current cost: $1,400/mo

ZopNight finding: RC-169 (idle resource pattern)
  Triggers: low utilization + no connections + 30+ day stable state
  Confidence: needs cross-check before terminating

EVIDENCE: METRICS TAB:
  DatabaseConnections (30 days):
    Average: 0
    Maximum: 0
    Minimum: 0

  CPU (30 days):
    Average: 1.2% (just monitoring overhead)
    Maximum: 3.4%

EVIDENCE: RECENT ACTIVITY TAB:
  Not shown: 0 write events in the 7-day lookback

  Last Modified by (resource detail):
    jane@example.com   Departed
    ModifyDBInstance · 2026-02-08 (101 days ago)

  Owner tag: blank (no current owner)

CONCLUSION:
  Database has 0 connections in 30 days
  No human has touched it in 101 days
  Original owner gone from org
  No remaining engineering owner

  Multiple data sources confirm: abandoned

ACTION:
  RC-169 is advisory: idle databases have no one-click apply
  Team follows the manual steps with high confidence
  Final snapshot first
  Delete the instance
  Saved: $1,400/mo recurring

TIMELINE:
  Investigation: 10 minutes
  Manual delete: 15 minutes
  Annual savings: $16,800

□ STEP 1: Open Recommendations
  Filter: category = idle OR orphan
  Pick a stopped resource

□ STEP 2: Open Recent Activity tab (7-day lookback)
  Panel shown?  □ Yes  □ No (0 write events)
  Total: _____   Max: _____   Active hrs: _____
  Operations seen (hover the chart): __________

□ STEP 3: Last Modified by (resource detail)
  Date: __________
  Caller: __________   □ Active  □ Departed

□ STEP 4: Cross-check with metrics
  CPU avg (30 days): _____%
  Connections (if applicable): _____

□ STEP 5: Decision
  □ Apply (multiple signals confirm abandonment)
  □ Snooze (uncertain; investigate further)
  □ Dismiss (false positive; resource is intentional)
  Reason: __________