Outcome
By the end of this lesson, you will be able to spot the ten most common cost mistakes in any cloud estate, and estimate the savings each one represents.
| Tier | Operator |
| JTBD | ”Where is the easy money hiding in my bill right now?” |
| Personas | All five |
| Prerequisites | L1, L2, L4 |
| Time | 11 minutes |
| Bloom verb | Spot (Analyze) |
1. Concept
These ten appear in every cloud bill, at every company, on every provider. They survive cost reviews, tooling rollouts and contract renewals, because each is small on its own and each has a reasonable-sounding explanation.
Together they account for 30 to 60 percent of avoidable spend. Nothing on this list is clever. That is the point: the money is in obvious things nobody owns.
# MISTAKE TYPICAL SAVINGS RANGE──────────────────────────────────────────────────────────────────── 1 Idle compute (non-prod left running) 30-60% of non-prod spend 2 Orphan storage (detached volumes) 2-8% of storage spend 3 Forgotten snapshots 3-10% of storage spend 4 Always-on NAT Gateways $30-$200 per gateway/month 5 Unused Elastic IPs $3.60 each per month (AWS) 6 Dev running as prod (oversized) 20-40% of dev compute 7 Over-provisioned RDS 20-35% of DB compute 8 Cross-zone chatter (all clouds) 2-10% of network spend 9 Public-internet egress for internal 3-15% of network spend10 Over-retained logs and metrics 5-20% of observability spend#1 Idle compute (non-prod left running)
Development, test and staging environments run all 168 hours in a week. People use them for 50 to 60.
Stopping them outside working hours and weekends recovers roughly 70% of those hours, and nothing notices, because nobody was using it. The arithmetic is in M0.3 L1.
How to spot it: a non-production resource with low CPU that never stops. The fix: put it on a schedule.
#2 Orphan storage (detached EBS / disks)
A server is terminated. Its disk was set not to be deleted with it. So the disk survives, attached to nothing, billing at the full rate for as long as the account exists.
How to spot it: storage sitting in available on AWS or unattached on Azure, with no recent activity. The fix: snapshot it if the data matters, then delete the disk.
#3 Forgotten snapshots
A snapshot bills forever until somebody deletes it, and almost nobody sets a rule to expire them. Estates accumulate snapshots of disks that no longer exist and of databases decommissioned years ago.
How to spot it: snapshots older than 90 days with no resource behind them and no tag saying how long to keep them. The fix: set a retention rule, then clear the backlog it makes eligible.
#4 Always-on NAT Gateways
A NAT Gateway lets private servers reach the internet. On AWS it costs $0.045 an hour, which is $32.40 a month each before a single byte moves, plus $0.045 for every GB it processes.
A development network with one gateway in each of three zones therefore costs $97 a month while idle. Most estates have several, created by an infrastructure template and never revisited.
How to spot it: gateways in non-production networks processing very little data. The fix: run one instead of three outside production, or replace it with a cheaper route for the traffic that genuinely needs it.
#5 Unused Elastic IPs
AWS charges $0.005 per hour ($3.60 per month) for any Elastic IP that is not attached to a running instance. The fee exists to discourage IP hoarding. Detection: EIPs in Unassociated state. Fix: release them.
#6 Dev running as prod (oversized)
Dev EC2 instances created at m5.2xlarge because somebody copied a Terraform module from prod. The dev workload runs at 2 percent CPU. Detection: non-prod instances with CPU consistently under 10 percent. Fix: drop a size or two. (See lesson 1 and rule RC-003.)
#7 Over-provisioned RDS
The hardest one to fix because it requires confidence in the workload’s headroom. RDS instances provisioned for a peak that never comes, multi-AZ enabled in dev, IOPS provisioned higher than throughput requires. Detection: low CPU, low connections, low IOPS. Fix: downsize during a maintenance window. (Database changes never auto-remediated: see the database denylist.)
#8 Cross-zone chatter (all clouds)
On AWS, GCP, and Azure, traffic between zones in the same region is charged, roughly $0.01 per GB in each direction (about $0.02 per GB round-trip). Only traffic that stays within a single zone is free. Result: a K8s cluster that wasn’t pinned to one zone can rack up significant network charges on any of the three clouds. Detection: inter-zone egress consistently high. Fix: pin workloads to a single zone or use regional persistent disks.
#9 Public-internet egress for internal traffic
The most embarrassing one. Internal services calling each other through public DNS / public IPs instead of through VPC endpoints or private DNS. Egress to public internet is charged ($0.09 per GB on AWS). Detection: large DataTransfer-Out-Bytes to addresses that resolve to your own IP ranges. Fix: route through VPC endpoints, private link, or internal load balancers.
#10 Over-retained logs and metrics
CloudWatch custom metrics at 30 cents per metric per month, log ingestion at 50 cents per GB, log storage at 3 cents per GB-month. Default retention is “Never expire.” A team that emits a custom metric per pod, with 200 pods, costs about $60 per month in metric charges forever (200 x $0.30), before log ingestion and storage. Detection: log groups and metric namespaces with no retention policy and large monthly delta. Fix: set retention, prune what’s not needed.
2. Demo
A real (anonymized) sample audit, one mid-size SaaS estate, $180,000 monthly AWS spend:
MISTAKE FOUND MONTHLY WASTE % OF BILL────────────────────────────────────────────────────────────────────────── 1 Idle compute (non-prod) 47 inst $18,400 10.2% 2 Orphan EBS volumes 12 vols $ 430 0.2% 3 Forgotten snapshots 1,247 snap $ 1,180 0.7% 4 Always-on NAT Gateways 6 GWs $ 194 0.1% 5 Unused Elastic IPs 23 EIPs $ 83 0.0% 6 Oversized dev compute 31 inst $ 4,100 2.3% 7 Over-provisioned RDS 4 DBs $ 2,800 1.6% 8 Cross-zone chatter (none found) - - - 9 Public-internet for internal 1 service $ 970 0.5%10 Over-retained logs/metrics - $ 1,840 1.0%──────────────────────────────────────────────────────────────────────────TOTAL avoidable $29,997 16.7%Three observations from this real audit: (a) idle compute is the single biggest line, (b) the long tail of small items together rivals it, (c) every category is present in some volume. The estate is not pathological. It is normal.
3. Hands-on (10 min)
For your own estate, score each of the ten mistakes. Use this checklist:
[ ] 1. Idle compute : any non-prod instance running 24/7?[ ] 2. Orphan storage : any EBS / disk in unattached state?[ ] 3. Forgotten snapshots: any snapshot >90d with no policy?[ ] 4. Always-on NAT GWs : any non-prod VPC with NAT in every AZ?[ ] 5. Unused EIPs : any EIP in Unassociated state?[ ] 6. Oversized dev : any non-prod instance with <10% CPU?[ ] 7. Over-provisioned RDS: any RDS with <30% CPU and steady connections?[ ] 8. Cross-zone chatter: AWS/GCP/Azure: inter-zone egress >5% of network?[ ] 9. Public-internet egress: any internal service via public DNS?[ ] 10. Over-retained logs : any log group with "Never expire"?For each “yes,” write down the resource count and an estimate of monthly waste. Add the total. Compare to your monthly cloud bill. The ratio is your avoidable spend percentage. Healthy estates land at 5 percent. Untended estates land at 25 to 40 percent.
4. Knowledge check
Q1
Of the ten mistakes, which one typically returns the largest absolute dollar savings in a mid-size estate?
A. Unused Elastic IPs
B. Over-retained logs
C. Idle compute (non-prod left running)
D. Public-internet egress for internal traffic
Show answer
Correct: C. Idle non-prod compute is consistently the largest single line, often 10-15% of total bill. Unused EIPs are individually trivial ($3.60 each). Logs and egress are real but typically smaller in absolute terms.
Q2
A team finds 1,247 forgotten snapshots, $1,180 per month. They argue: “It’s less than 1% of the bill, leave it.” Best response:
A. Agree, deprioritize
B. Delete all of the snapshots immediately
C. Buy bigger storage
D. Note that the snapshot pile grows over time
Show answer
Correct: D. Setting a lifecycle policy is one-time work that prevents the cost from compounding. The action is policy-as-code, not policy-as-promise. The savings number is real but small. The structural fix (lifecycle policy) costs almost nothing once and prevents the pile from doubling next year.
Q3
A FinOps team reports avoidable spend at 28% of bill. The CTO pushes back: “That’s impossible.” Most defensible response:
A. The team is wrong
B. 28% is on the high end of normal for untended estates
C. Buy a more expensive tool
D. Outsource the whole cloud management function entirely
Show answer
Correct: B. The fix is iterative: pick the top three mistakes by absolute dollar value and remediate those first. Re-baseline in 30 days. 28% is on the high end but plausible. The right move is sequenced remediation, not all-at-once. Most estates can close half the gap in 60 days with focused effort.
5. Apply
ZopNight pre-computes all ten mistakes as a subset of its 450+ audit rules. The Recommendations page filters expose each one:
- Idle compute →
category=idle, status=open - Orphan storage →
category=orphan, resource_type=ebs-volume / disk - Forgotten snapshots →
category=orphan, resource_type=snapshot - Always-on NAT →
category=idle, resource_type=nat-gateway - Unused EIPs →
category=orphan, resource_type=elastic-ip - Oversized dev →
category=rightsizing, severity=high - Over-provisioned RDS →
category=rightsizing, resource_type=rds - Over-retained logs →
category=compliance, resource_type=log-group
The summary card on the Recommendations page shows Total Open Recommendations and Potential Monthly Savings so the audit is one click away.
Open ZopNight Recommendations (deep link)
Module quiz
You have now completed all five lessons of M0.1. The module quiz (10 questions, 80% pass) is on the Operator certification page. Passing unlocks M0.2.
Related lessons
- T0.M0.3: Why scheduling beats commitments at non-prod scale (next module)
- T2.M2.1: The 450+ rule library, explained
- T5.M5.2: Schedule design patterns
Glossary terms touched
Avoidable spend · Lifecycle policy · NAT Gateway · Elastic IP · Cross-AZ traffic