Cutting AWS costs systematically: break down the bill, gate the measures, measure afterwards
How I cut the AWS bill of my one-person account by around 40 percent with invoice analysis, a review board, gated measures and a budget as code – and which line items did not go down.
How I reduced the AWS costs of my own account with a traceable process rather than a clean-up sprint. The same process works in client accounts – usually with more stakeholders and more to lose.
Starting point
My one-person company runs a small AWS account: the website, a chatbot, a few serverless applications and some on-demand EC2 instances – among them SonarQube, a database front end and an orchestrator for AI coding agents, all defined with AWS CDK.
Over the first half of the year the monthly bill grew step by step, each step justified on its own, until July was considerably higher than expected. The trigger was a convenience change of my own: in early July I had added an automatic morning start for the agent orchestrator. The generously sized instance then ran around 18 hours a day – at a CPU utilisation of two to five percent. Compute accounted for almost 40 percent of the July bill before tax, nearly all of it that one instance.
On top came the usual leftovers – snapshots of uncertain purpose, unused secrets, monitoring options of an experimental project – and a manually created budget that had been exceeded every month for months without a single warning arriving.
Solution
I worked in four steps.
1. Break down the bill. I broke the July bill down to usage types in Cost Explorer and mapped every larger line item to a resource and the project that caused it. That turns “AWS is expensive” into a list.
2. Have the findings challenged. The list of measures went to a review board of five roles – architecture, security, senior developer, FinOps and an explicit sceptic – which I ran as AI agents with separate briefs. It refuted four of my assumptions. An apparently orphaned Elastic IP in fact belonged to an AWS-managed resource that two services depended on. Two safety snapshots were to be deleted because an S3 backup existed – except that backup predated the last configuration change. Another snapshot turned out to be the only copy of a data volume outside the instance. And an old machine image I had written off as archived is the only forensic baseline of a former server. Each mistake would have cost more than the deletion saved.
3. Gate measures instead of executing them. Every measure got a switch or a hard precondition.
4. Measure afterwards. What counts are the actual monthly costs from Cost Explorer, not a target figure, checked against two success criteria the board had defined up front as daily costs.
Guardrails
- Switches instead of deletion. The automatic morning start was not removed but disabled through a stack property that defaults to “off”. The nightly stop remains. I start the instance on demand from my operations cockpit or the CLI. A side effect: a stopped instance now stays stopped, which is also a security property.
- Backup before clean-up, enforced in the script. The clean-up script runs as a dry run by default. It deletes snapshots only if a dated backup of the affected data is at most seven days old. Secrets read within the last 90 days are blocked; all others are deleted with a 30-day recovery window. Execution requires an interactive, typed, date-bound confirmation – no pipeline, no agent.
- A backup script as precondition. The agent orchestrator previously had no complete copy outside the instance. The new script streams database dump and data volume straight to S3.
- Budget as code. The account-wide monthly budget now lives in its own CDK stack with email alerts instead of being a manual console setting. Note: direct use of the Anthropic API is billed outside AWS and not covered by it.
- A human decides. Code and analysis came as a pull request; choosing between the variants and deploying was my call.
Result
The measured figures from Cost Explorer, July to September:
- The total bill fell by around 40 percent, with and without VAT alike. By August it was already more than a third below July.
- Compute costs fell by more than 90 percent from July to August and stayed low in September. That single switch explains almost the entire reduction.
- The first of the two success criteria was met in September; the second was not.
Just as important is what did not go down. Networking – mainly interface endpoints and public IPv4 addresses – and CloudWatch stayed almost unchanged. In September these two items together made up more than two thirds of the bill before tax. The budget was still exceeded in August and September despite the reduction; a lower threshold only makes sense once the next levers take effect.
The gated clean-up only ran in October, once the enforced backups were fresh. Since then the experimental project behind most of the CloudWatch metrics has been shut down and an unneeded database deleted. Their effect cannot be shown yet: October is distorted by one-off domain registrations, so I will measure again in November. Still open are the evaluation of a smaller instance size, the question of whether the endpoints can run in one Availability Zone instead of two, and a scheduled rather than manual backup run.
Transfer
What carries over to client accounts one-to-one is the process: break the bill down to resource and cause, have a critical second party challenge the findings, put measures behind switches and enforced preconditions, keep the budget in code, and report measured costs afterwards rather than targets. The sceptic pays off in particular: the most expensive cost-cutting mistakes are deletions of what turns out to be the only copy.
What does not carry over is the speed of decision-making. For me, operator, cost centre and approver are one person. In a company, the same list needs an owner per line item, agreed maintenance windows and often tagging before a clean breakdown is even possible.
The pattern fits when a bill has grown step by step, nobody can explain every line item any more, and a fast clean-up would be riskier than a slow one.
Stack: AWS · AWS CDK · AWS Cost Explorer · AWS Budgets · EventBridge Scheduler · Bash