Cutting an AWS bill without touching production: a checklist for small teams
NAT gateways, one load balancer per environment, security tooling on default settings, premium storage tiers, and networks you accumulated rather than designed. The seven line items that account for most of a small team's overspend.
Small teams do not have a FinOps function. They have an AWS bill that tripled while nobody was looking, usually right after the credits ran out or right after the security tooling for an audit went in. The good news is that the same handful of line items are responsible almost every time, and most of them can be fixed without touching production. This is the checklist we run on a first review, in the order that has paid off most.
1. NAT Gateways
Managed NAT is billed per hour per gateway plus per gigabyte processed, and a team with a few environments and a few availability zones can be running six or more of them. For non-production, and for production workloads whose outbound traffic is not latency-critical, a NAT instance does the same job for the price of a small EC2 instance. On one client's account, replacing managed NAT with fck-nat instances took the NAT line from $4,093 to $450 over seven months, an 89 percent cut.
2. Load balancers, one per environment
Each application load balancer has an hourly charge before it serves a request. Environments that each own a load balancer, and services that each own a listener on their own load balancer, add up. Consolidating per-environment load balancers onto a shared set with host-based routing halved that line for the same client, and the shared set was where the FIPS TLS listeners the audit wanted went in.
3. Security services on default settings
CloudTrail, GuardDuty, Security Hub, Config, and Macie are the right tools before a SOC2 audit. Their defaults are not. CloudTrail logging every data event with retention far beyond what any control requires, GuardDuty with every optional protection enabled, Config recording every resource type in every region: each is a line item that grows with usage. Read what the audit actually requires, keep that, and turn off the rest. For a fintech client this was part of a 42 percent reduction from peak spend with the SOC2 Type 1 report issued on schedule.
4. Storage tiers
RDS volumes on io1 where gp3 would do. S3 buckets with no lifecycle policy. Snapshots nobody has deleted since the account was created. Cross-region backup copies running daily for an environment whose recovery objective is measured in days. Each is a few minutes to change and a permanent reduction.
5. Non-production sized like production
Staging and demo environments copied from the production template run production-sized instances around the clock. Right-size them, and schedule what can be scheduled to shut down outside working hours.
6. Networks you accumulated rather than designed
This one takes longer but pays twice. Five VPCs created over time, all on the same address range so none can be peered, each with its own NAT and load balancers, and production sharing an account with staging, is a common shape for a company a few years in. Consolidating into one VPC per account boundary, with subnets shared across accounts through Resource Access Manager, removed the duplicate networking spend and gave the cardholder data environment the isolated subnets the PCI work needed. Cost and compliance usually pull in the same direction: fewer networks and fewer load balancers meant a smaller bill and a smaller audit surface at the same time.
7. Compute reservations nobody checks
On ECS, tasks are billed on what they reserve, and reservations drift up because nothing ever asks whether they match usage. Pull two weeks of utilization from Container Insights and put reservation next to usage for every service. If the fleet reserves several times what it uses, right-sizing the tasks is an afternoon's work. If the gap is extreme and the service count is large, that is the case for a packed cluster, which is a separate decision.
What to leave alone
Do not start with savings plans or reserved instances. They lock in whatever waste exists today. Fix the sizing first and buy commitments against the floor that remains. Do not turn off the audit-relevant logging to save money; immutable CloudTrail logs are cheap and are the first thing an auditor asks for. And do not cut the backup frequency below what a rehearsed recovery actually needs. Rehearse the recovery, then set the frequency.
What a first review finds
On the two engagements above, the first pass found enough to fund the cleanup that followed, and the cleanup produced a rehearsed 30 to 60 minute full-infrastructure recovery from Terraform as a side effect. The order matters: the quick wins in items 1 to 5 pay for the structural work in item 6.
The full story
Both engagements are written up: SOC2 Type 1 and the 42 percent cost reduction, and the VPC consolidation and NAT replacement that followed.
Paying for infrastructure you accumulated rather than designed?
A short review usually finds savings that fund the cleanup. We'll go through your bill line by line and tell you which of these apply.
