Outcome
By the end of this lesson, you will be able to spot the ten most common cost mistakes in any cloud estate, and estimate the savings each one represents.
New to the cloud? The optional track Cloud, from zero covers the basics first.
| Prerequisites | L1, L2, L4 |
| Time | 11 minutes |
1. Concept
These ten appear in every cloud bill, at every company, on every provider (AWS, Google Cloud and Microsoft Azure). A few words first: an estate is everything a company runs in the cloud, non-prod (non-production) means development, test and staging environments that customers never touch, and compute means rented servers. They survive cost reviews, tooling rollouts and contract renewals, because each is small on its own and each has a reasonable-sounding explanation.
Together they account for 30 to 60 percent of avoidable spend (money paid for things nobody needs). Nothing on this list is clever. That is the point: the money is in obvious things nobody owns.
# MISTAKE TYPICAL SAVINGS RANGE──────────────────────────────────────────────────────────────────── 1 Idle compute (non-prod left running) 30-60% of non-prod spend 2 Orphan storage (detached volumes) 2-8% of storage spend 3 Forgotten snapshots 3-10% of storage spend 4 Always-on NAT Gateways $30-$200 per gateway/month 5 Unused Elastic IPs $3.60 each per month (AWS) 6 Dev running as prod (oversized) 20-40% of dev compute 7 Over-provisioned RDS 20-35% of DB compute 8 Cross-zone chatter (AWS, GCP) 2-10% of network spend 9 Public-internet egress for internal 3-15% of network spend10 Over-retained logs and metrics 5-20% of observability spend#1 Idle compute (non-prod left running)
Development, test and staging environments run all 168 hours in a week. People use them for 50 to 60.
Stopping them outside working hours and at weekends recovers roughly 70% of those hours, and nothing notices, because nobody was using it. The arithmetic is in M0.3 L1.
How to spot it: a non-production resource with low CPU (processor) use that never stops. The fix: put it on a schedule.
#2 Orphan storage (detached EBS / disks)
EBS is AWS’s name for the disks attached to its servers. A server is terminated (deleted for good). Its disk was set not to be deleted with it. So the disk survives, attached to nothing, billing at the full rate for as long as the account exists.
How to spot it: storage sitting in available (attached to nothing) on AWS or unattached on Azure, with no recent activity. The fix: snapshot it if the data matters, then delete the disk.
#3 Forgotten snapshots
A snapshot is a saved copy of a disk at a moment in time. It bills forever until somebody deletes it, and almost nobody sets a rule to expire them. Estates accumulate snapshots of disks that no longer exist and of databases decommissioned years ago.
How to spot it: snapshots older than 90 days with no resource behind them and no tag saying how long to keep them. The fix: set a retention rule (how long copies are kept before automatic deletion), then clear the backlog it makes eligible.
#4 Always-on NAT Gateways
A NAT Gateway is a managed device (run by the provider for you) that lets private servers reach the internet. On AWS it costs $0.045 an hour, which is $32.40 a month each before a single byte moves, plus $0.045 for every GB it processes.
A development network with one gateway in each of three availability zones (separate data centres inside one region, the provider’s geographic location) therefore costs $97 a month while idle. Most estates have several, created by an infrastructure template (a file that builds a whole network in one go) and never revisited.
How to spot it: gateways in non-production networks processing very little data. The fix: run one instead of three outside production, or replace it with a cheaper route for the traffic that genuinely needs it.
#5 Unused Elastic IPs
An Elastic IP is a fixed public internet address you reserve on AWS. AWS charges $0.005 per hour ($3.60 per month) for any Elastic IP that is not attached to a running instance (server). The fee exists to discourage IP hoarding. Detection: EIPs in Unassociated state. Fix: release them.
#6 Dev running as prod (oversized)
Development servers (EC2 instances, AWS’s rented servers) created at the large m5.2xlarge size because somebody copied a Terraform module (a reusable infrastructure-as-code file that creates resources) from production. The dev workload runs at 2 percent CPU. Detection: non-prod instances with CPU consistently under 10 percent. Fix: drop a size or two. (See lesson 1 and rule RC-003, the server rightsizing rule.)
#7 Over-provisioned RDS
RDS is AWS’s managed database service. This is the hardest one to fix because it requires confidence in the workload’s headroom (spare capacity). RDS instances sized for a peak that never comes, multi-AZ (a standby copy in a second zone) enabled in dev, IOPS (disk reads and writes per second) provisioned higher than the workload needs. Detection: low CPU, low connections, low IOPS. Fix: downsize during a maintenance window. (ZopNight’s one-click fixes never resize or stop a database: see the database denylist.)
#8 Cross-zone chatter (AWS and GCP)
On AWS and GCP, traffic between zones in the same region is charged. AWS bills roughly $0.01 per GB out plus $0.01 per GB in (about $0.02 per GB transferred); GCP bills about $0.01 per GB. Only traffic that stays within a single zone is free. Azure stopped charging for traffic between availability zones in May 2024. Result: a Kubernetes (K8s) cluster, a group of servers running many applications, that wasn’t pinned to one zone can rack up significant network charges on AWS or GCP. Detection: inter-zone traffic consistently high. Fix: pin workloads to a single zone or use regional persistent disks.
#9 Public-internet egress for internal traffic
The most embarrassing one. Internal services calling each other through public internet addresses instead of private routes inside your own network (on AWS, a VPC: your private network, reached privately through VPC endpoints or private DNS). Egress, data leaving for the public internet, is charged ($0.09 per GB on AWS). Detection: large DataTransfer-Out-Bytes to addresses that resolve to your own IP ranges. Fix: route through VPC endpoints, private link, or internal load balancers.
#10 Over-retained logs and metrics
CloudWatch is AWS’s monitoring service. Custom metrics cost 30 cents per metric per month, log ingestion at 50 cents per GB, log storage at 3 cents per GB-month. Default retention is “Never expire.” A team that emits a custom metric per pod (one running copy of an application on Kubernetes), with 200 pods, costs about $60 per month in metric charges forever (200 x $0.30), before log ingestion and storage. Detection: log groups and metric namespaces with no retention policy and large monthly delta. Fix: set retention, prune what’s not needed.
2. Demo
A real (anonymized) sample audit, one mid-size SaaS estate (a company selling its software as an online service), $180,000 monthly AWS spend:
MISTAKE FOUND MONTHLY WASTE % OF BILL────────────────────────────────────────────────────────────────────────── 1 Idle compute (non-prod) 47 inst $18,400 10.2% 2 Orphan EBS volumes 12 vols $ 430 0.2% 3 Forgotten snapshots 1,247 snap $ 1,180 0.7% 4 Always-on NAT Gateways 6 GWs $ 194 0.1% 5 Unused Elastic IPs 23 EIPs $ 83 0.0% 6 Oversized dev compute 31 inst $ 4,100 2.3% 7 Over-provisioned RDS 4 DBs $ 2,800 1.6% 8 Cross-zone chatter (none found) - - - 9 Public-internet for internal 1 service $ 970 0.5%10 Over-retained logs/metrics - $ 1,840 1.0%──────────────────────────────────────────────────────────────────────────TOTAL avoidable $29,997 16.7%Three observations from this real audit: (a) idle compute is the single biggest line, (b) the long tail of small items together rivals it, (c) every category is present in some volume. The estate is not pathological. It is normal.
3. Hands-on (10 min)
For your own estate, score each of the ten mistakes. If you cannot see your company’s cloud yet, ask someone who can, or score the Demo estate above. Use this checklist:
[ ] 1. Idle compute : any non-prod instance running 24/7?[ ] 2. Orphan storage : any EBS / disk in unattached state?[ ] 3. Forgotten snapshots: any snapshot >90d with no policy?[ ] 4. Always-on NAT GWs : any non-prod VPC with NAT in every AZ?[ ] 5. Unused EIPs : any EIP in Unassociated state?[ ] 6. Oversized dev : any non-prod instance with <10% CPU?[ ] 7. Over-provisioned RDS: any RDS with <30% CPU and steady connections?[ ] 8. Cross-zone chatter: AWS/GCP: inter-zone egress >5% of network?[ ] 9. Public-internet egress: any internal service via public DNS?[ ] 10. Over-retained logs : any log group with "Never expire"?For each “yes,” write down the resource count and an estimate of monthly waste. Add the total. Compare to your monthly cloud bill. The ratio is your avoidable spend percentage. Healthy estates land at 5 percent. Untended estates land at 25 to 40 percent.
4. Knowledge check
Q1
Of the ten mistakes, which one typically returns the largest absolute dollar savings in a mid-size estate?
A. Unused Elastic IPs
B. Over-retained logs
C. Idle compute (non-prod left running)
D. Public-internet egress for internal traffic
Show answer
Correct: C. Idle non-prod compute is consistently the largest single line, often 10-15% of total bill. Unused EIPs are individually trivial ($3.60 each). Logs and egress are real but typically smaller in absolute terms.
Q2
A team finds 1,247 forgotten snapshots, $1,180 per month. They argue: “It’s less than 1% of the bill, leave it.” Best response:
A. Agree, deprioritize
B. Delete all of the snapshots immediately
C. Buy bigger storage
D. Set a snapshot lifecycle (retention) policy now, because the pile grows over time
Show answer
Correct: D. Setting a lifecycle policy is one-time work that prevents the cost from compounding. The action is policy-as-code, not policy-as-promise. The savings number is real but small. The structural fix (lifecycle policy) costs almost nothing once and prevents the pile from doubling next year.
Q3
A FinOps team reports avoidable spend at 28% of bill. The CTO pushes back: “That’s impossible.” Most defensible response:
A. The team is wrong
B. 28% is within the normal 25 to 40% range for untended estates
C. Buy a more expensive tool
D. Outsource the whole cloud management function entirely
Show answer
Correct: B. The fix is iterative: pick the top three mistakes by absolute dollar value and remediate those first. Re-baseline in 30 days. 28% sits inside the 25 to 40% range the lesson gives for untended estates, so it is plausible. The right move is sequenced remediation, not all-at-once. Most estates can close half the gap in 60 days with focused effort.
5. Apply
ZopNight, the cost platform these lessons are built around, pre-computes all ten mistakes as a subset of its 684 audit rules. Each rule’s finding is called a recommendation, and the Recommendations page filters expose each one:
- Idle compute →
category=idle, status=open - Orphan storage →
category=orphan, resource_type=ebs-volume / disk - Forgotten snapshots →
category=orphan, resource_type=ebs-snapshot - Always-on NAT →
category=idle, resource_type=nat-gateway - Unused EIPs →
category=orphan, resource_type=eip - Oversized dev →
category=rightsizing, severity=high - Over-provisioned RDS →
category=rightsizing, resource_type=rds - Over-retained logs →
category=rightsizing, resource_type=cloudwatch-logs
The summary card on the Recommendations page shows Total Open Recommendations and Potential Monthly Savings so the audit is one click away.
Open ZopNight Recommendations (deep link)
Module quiz
You have now completed all five lessons of M0.1. Take the module quiz: 10 questions, 80% to pass.
Related lessons
- T0.M0.2: FinOps Foundation principles (next module)
- T0.M0.3: Why scheduling beats commitments at non-prod scale
- T2.M2.1: The 684-rule library, explained
- T3.M3.2: Schedule design patterns
Glossary terms touched
Avoidable spend · Lifecycle policy · NAT Gateway · Cross-AZ traffic