Cost Management & Optimization

Cost dimensions

AWS Free Tier (2024+ model)

New AWS accounts receive up to $200 in credits for select services during the first six months, plus always-free tiers for specific services within limits. The old "12-month free tier for everything" model is largely replaced — always verify current terms on the AWS pricing page before architecture decisions.

Data transfer pricing (us-east-1 reference — verify your region)

Data transfer is the #1 surprise on AWS invoices for backend teams. Inbound to AWS is free; movement within and out of AWS is where costs accumulate.

Cost allocation tags

Tags are how finance maps AWS spend to teams, products, and environments. Without them, Cost Explorer shows one blob labeled "Amazon EC2" — useless for chargeback. Activate cost allocation tags in the Billing console, then enforce tag-on-create with SCPs, Config rules, or Terraform default_tags.

Enforce tags at deploy time

# Activate user-defined tags for Cost Explorer (once per account)
aws ce update-cost-allocation-tags-status \
  --cost-allocation-tags-status TagKey=Environment,Status=Active \
  --cost-allocation-tags-status TagKey=Team,Status=Active

# Tag an existing resource
aws ec2 create-tags --resources i-0abc123 \
  --tags Key=Environment,Value=production Key=Team,Value=payments

provider "aws" {
  default_tags {
    tags = {
      Environment = var.environment
      Team        = "platform"
      ManagedBy   = "terraform"
    }
  }
}

resource "aws_instance" "app" {
  ami           = data.aws_ami.amazon_linux.id
  instance_type = "m7g.large"
  tags = {
    Service = "order-api"
  }
}

import * as cdk from 'aws-cdk-lib';

const app = new cdk.App();
new cdk.Stack(app, 'OrderApiStack', {
  tags: {
    Environment: 'production',
    Team: 'payments',
    Service: 'order-api',
  },
});

Purchasing options compared

Savings Plans calculator

Model your monthly On-Demand compute spend and steady-state percentage. Committed plans cover only the steady portion; burst traffic stays On-Demand. Use Cost Explorer → Savings Plans recommendations for AWS-generated commit amounts before purchasing.

Graviton (ARM) economics

Graviton3/4 instances (m7g, c7g, r7g) typically deliver 20–40% better price/performance than equivalent x86 for Java/Spring workloads on Corretto 17+. Savings Plans and RIs apply to Graviton the same way — you're stacking architecture choice on top of commitment discounts.

Right-sizing

The cheapest instance is the one that's appropriately sized — not the smallest SKU. Over-provisioned instances waste money; under-provisioned ones cause latency incidents that cost more in engineering time.

1. Enable Detailed Monitoring (1-minute CloudWatch metrics) on production EC2 — $2.10/instance/month well spent
2. Review CPUUtilization p95 over 14 days — sustained <20% suggests downsizing
3. Check MemoryUtilization via CloudWatch agent — CPU low but memory high → move to r family
4. Use AWS Compute Optimizer — free ML recommendations for EC2, EBS, Lambda, ECS on Fargate
5. Schedule non-prod environments to stop nights/weekends with Instance Scheduler or ASG scheduled actions

AWS Compute Optimizer

Compute Optimizer analyzes 14 days of CloudWatch metrics and recommends instance type changes, EBS volume type changes, and Lambda memory settings. It requires opt-in (free) and appropriate IAM permissions. Export findings to CSV or integrate with Systems Manager for automated right-sizing workflows.

$ aws compute-optimizer get-ec2-instance-recommendations \
  --account-ids 123456789012 \
  --filters name=Finding,values=Underprovisioned,Overprovisioned
→ currentInstanceType: m5.xlarge → recommendation: m7g.large (estimated savings 34%)
$ aws compute-optimizer get-lambda-function-recommendations \
  --function-arns arn:aws:lambda:us-east-1:123456789012:function:order-processor
→ memory 1024 MB → recommendation: 512 MB (no perf impact, 50% cost reduction)

S3 lifecycle & Intelligent-Tiering

Lifecycle rules transition objects by prefix and age — e.g. move logs/ to Glacier after 90 days, expire temp/ after 7 days. Intelligent-Tiering removes manual tier decisions for buckets with mixed access patterns (user uploads, ML training sets).

aws s3api put-bucket-lifecycle-configuration --bucket my-app-logs \
  --lifecycle-configuration '{
    "Rules": [{
      "ID": "archive-old-logs",
      "Status": "Enabled",
      "Filter": { "Prefix": "app/" },
      "Transitions": [
        { "Days": 30, "StorageClass": "STANDARD_IA" },
        { "Days": 90, "StorageClass": "GLACIER" }
      ],
      "Expiration": { "Days": 365 }
    }]
  }'

resource "aws_s3_bucket_lifecycle_configuration" "logs" {
  bucket = aws_s3_bucket.logs.id
  rule {
    id     = "archive-old-logs"
    status = "Enabled"
    filter { prefix = "app/" }
    transition {
      days          = 30
      storage_class = "STANDARD_IA"
    }
    transition {
      days          = 90
      storage_class = "GLACIER"
    }
    expiration { days = 365 }
  }
}

import * as s3 from 'aws-cdk-lib/aws-s3';

bucket.addLifecycleRule({
  id: 'archive-old-logs',
  prefix: 'app/',
  transitions: [
    { storageClass: s3.StorageClass.INFREQUENT_ACCESS, transitionAfter: cdk.Duration.days(30) },
    { storageClass: s3.StorageClass.GLACIER, transitionAfter: cdk.Duration.days(90) },
  ],
  expiration: cdk.Duration.days(365),
});

EBS cleanup

Detached EBS volumes and old snapshots are silent budget killers — they bill at full storage rates forever until deleted. A 500 GB gp3 volume costs ~$40/month doing nothing.

• Run weekly reports: aws ec2 describe-volumes --filters Name=status,Values=available
• Enable DLM (Data Lifecycle Manager) for automated snapshot retention — keep 7 daily, 4 weekly, delete older
• Delete AMIs you no longer deploy from — the backing snapshots remain until the AMI is deregistered
• Prefer gp3 over gp2 — decouple IOPS from volume size; right-size baseline 3,000 IOPS
• Use AWS Config rule ec2-volume-inuse-check to flag unattached volumes

The NAT Gateway surprise

NAT Gateway charges hourly per AZ plus per-GB processed — even for traffic destined to S3 or DynamoDB that could use free gateway endpoints. This is the most common "why is our AWS bill so high?" finding for teams new to VPC networking.

CloudFront egress savings

Serving content directly from S3 to global users incurs S3 data transfer-out charges from the origin region. CloudFront caches at edge locations — repeat requests hit the edge, not your origin. PriceClass_100 (US/Europe only) reduces cost for US-centric apps.

Aurora Serverless v2

Aurora Serverless v2 scales ACUs (Aurora Capacity Units) automatically between a min and max you define. Pay per ACU-second — ideal for dev/staging databases that idle nights/weekends, and prod workloads with predictable baseline but occasional spikes. Not a replacement for provisioned Aurora when you need sustained high throughput at lowest $/query — benchmark both.

DynamoDB: on-demand vs provisioned

AWS Budgets

Budgets let you set monthly, quarterly, or annual spend thresholds at account, linked account, service, or tag level. Alerts fire at configurable percentages (50%, 80%, 100%, forecasted 100%). Budgets are reactive alerts — they don't stop spend (use SCPs for hard blocks).

aws budgets create-budget --account-id 123456789012 --budget '{
  "BudgetName": "monthly-prod-cap",
  "BudgetLimit": { "Amount": "15000", "Unit": "USD" },
  "TimeUnit": "MONTHLY",
  "BudgetType": "COST",
  "CostFilters": {
    "TagKeyValue": ["User:Environment$production"]
  }
}' --notifications-with-subscribers '[{
  "Notification": {
    "NotificationType": "FORECASTED",
    "ComparisonOperator": "GREATER_THAN",
    "Threshold": 100
  },
  "Subscribers": [{ "SubscriptionType": "EMAIL", "Address": "[email protected]" }]
}]'

resource "aws_budgets_budget" "prod_monthly" {
  name         = "monthly-prod-cap"
  budget_type  = "COST"
  limit_amount = "15000"
  limit_unit   = "USD"
  time_unit    = "MONTHLY"

  cost_filter {
    name   = "TagKeyValue"
    values = ["User:Environment$production"]
  }

  notification {
    comparison_operator        = "GREATER_THAN"
    threshold                  = 80
    threshold_type             = "PERCENTAGE"
    notification_type          = "ACTUAL"
    subscriber_email_addresses = ["[email protected]"]
  }
}

import * as budgets from 'aws-cdk-lib/aws-budgets';

new budgets.CfnBudget(this, 'ProdMonthlyCap', {
  budget: {
    budgetName: 'monthly-prod-cap',
    budgetType: 'COST',
    timeUnit: 'MONTHLY',
    budgetLimit: { amount: 15000, unit: 'USD' },
    costFilters: { TagKeyValue: ['User:Environment$production'] },
  },
  notificationsWithSubscribers: [{
    notification: {
      notificationType: 'FORECASTED',
      comparisonOperator: 'GREATER_THAN',
      threshold: 100,
    },
    subscribers: [{ subscriptionType: 'EMAIL', address: '[email protected]' }],
  }],
});

Cost Explorer

Cost Explorer is the primary analysis UI — group by service, linked account, tag, usage type, or API operation. Enable 13-month retention (free). Saved reports and monthly PDF exports feed finance reviews.

• Monthly cost by service — find the top 3 services; drill into usage type
• Cost by tag (Team, Environment) — requires activated allocation tags
• Net Amortized cost — includes RI/SP benefit spread across covered usage
• Right-sizing recommendations — EC2 instances with low utilization
• Savings Plans recommendations — suggested commit $/hr based on 7/30/60-day history

Cost Anomaly Detection

ML service that learns your normal spend patterns and alerts on anomalies — e.g. a misconfigured S3 sync loop, a crypto-mining instance, or a forgotten load test. Create monitor scopes (entire account, specific service, tag-based) and SNS/Chatbot subscriptions. First 1,000 anomalies/month free tier.

aws ce create-anomaly-monitor --anomaly-monitor '{
  "MonitorName": "prod-ec2-anomalies",
  "MonitorType": "DIMENSIONAL",
  "MonitorDimension": "SERVICE"
}'

aws ce create-anomaly-subscription --anomaly-subscription '{
  "SubscriptionName": "platform-slack-alerts",
  "Threshold": 50.0,
  "Frequency": "DAILY",
  "MonitorArnList": ["arn:aws:ce::123456789012:anomalymonitor/..."],
  "Subscribers": [{ "Type": "SNS", "Address": "arn:aws:sns:us-east-1:123456789012:cost-alerts" }]
}'

AWS Trusted Advisor

Trusted Advisor scans your account against AWS best practices across five categories — including Cost Optimization. Checks include idle load balancers, underutilized EBS/RDS/EC2, unassociated Elastic IPs, and S3 bucket versioning without lifecycle. Basic checks are free; full checks require Business or Enterprise Support plans.

Recommended monitoring stack

• Cost Explorer — weekly saved reports by service and tag; net amortized view for unit economics
• Budgets — per-environment caps at 80%/100% actual and forecasted; SNS → Slack
• Anomaly Detection — ML alerts on unexpected spikes before month-end close
• Allocation tags — Environment + Team + Service on every resource; SCP deny if missing
• CUR + Athena — hourly line-item billing for engineering-level dashboards
• Trusted Advisor — monthly idle-resource review; automate remediation with Config + Lambda