Hidden Costs Investigation

Hidden AWS Cost Audit

AWS bills often hide costs in small line items that add up. Here’s what to check:

Often-Overlooked Cost Sources

1. CloudWatch Logs with No Retention

Default retention is “never expire” - logs accumulate forever.

Find log groups without retention:

aws logs describe-log-groups \
  --query 'logGroups[?retentionInDays==null].[logGroupName,storedBytes]' \
  --output table

Set 30-day retention (adjust based on compliance needs):

# For a single log group
aws logs put-retention-policy \
  --log-group-name /aws/lambda/my-function \
  --retention-in-days 30

# For all log groups without retention
aws logs describe-log-groups \
  --query 'logGroups[?retentionInDays==null].logGroupName' \
  --output text | while read group; do
  echo "Setting retention for $group"
  aws logs put-retention-policy \
    --log-group-name "$group" \
    --retention-in-days 30
done

Typical savings: $10-100/month

2. S3 Versioning Bloat

If versioning is enabled, old versions stay forever.

Check versioning status:

# List all buckets
aws s3api list-buckets --query 'Buckets[*].Name' --output text | while read bucket; do
  status=$(aws s3api get-bucket-versioning --bucket $bucket --query 'Status' --output text)
  echo "$bucket: $status"
done

Check storage by version (requires S3 Storage Lens - check in console):

• Go to S3 > Storage Lens > Default dashboard
• Look for “Current version bytes” vs “Noncurrent version bytes”

Set lifecycle rule to delete old versions:

cat > lifecycle.json <<'EOF'
{
  "Rules": [
    {
      "ID": "Delete old versions after 30 days",
      "Status": "Enabled",
      "NoncurrentVersionExpiration": {
        "NoncurrentDays": 30
      }
    }
  ]
}
EOF

aws s3api put-bucket-lifecycle-configuration \
  --bucket my-bucket \
  --lifecycle-configuration file://lifecycle.json

Typical savings: $20-200/month

3. Old Lambda Versions

Lambda keeps all versions forever. Each version consumes storage.

Find functions with many versions:

aws lambda list-functions \
  --query 'Functions[*].FunctionName' \
  --output text | while read func; do
  count=$(aws lambda list-versions-by-function \
    --function-name $func \
    --query 'length(Versions)' --output text)
  echo "$func: $count versions"
done

Delete old versions (keep $LATEST and last 3):

function_name="my-function"

aws lambda list-versions-by-function \
  --function-name $function_name \
  --query 'Versions[?Version!=`$LATEST`].Version' \
  --output text | tr '\t' '\n' | head -n -3 | while read ver; do
  echo "Deleting version $ver"
  aws lambda delete-function \
    --function-name $function_name \
    --qualifier $ver
done

Typical savings: $5-50/month

4. Orphaned Secrets Manager Secrets

Each secret costs $0.40/month. Old secrets add up.

List all secrets:

aws secretsmanager list-secrets \
  --query 'SecretList[*].[Name,CreatedDate,LastAccessedDate]' \
  --output table

Delete unused secrets:

aws secretsmanager delete-secret \
  --secret-id my-unused-secret \
  --recovery-window-in-days 30

Typical savings: $5-20/month

5. Unused KMS Keys

Active KMS keys cost $1/month each.

List KMS keys:

aws kms list-keys \
  --query 'Keys[*].KeyId' \
  --output text | while read key; do
  aws kms describe-key --key-id $key \
    --query 'KeyMetadata.{ID:KeyId,State:KeyState,Created:CreationDate}' \
    --output text
done

Disable unused keys (can re-enable later):

aws kms disable-key --key-id arn:aws:kms:us-east-1:123456789012:key/xxxxx

Schedule key deletion (7-30 day waiting period):

aws kms schedule-key-deletion \
  --key-id arn:aws:kms:us-east-1:123456789012:key/xxxxx \
  --pending-window-in-days 30

Typical savings: $5-20/month

6. ECR Untagged Images

Untagged images from old builds accumulate.

Find untagged images:

aws ecr list-images \
  --repository-name my-repo \
  --filter tagStatus=UNTAGGED \
  --query 'imageIds[*]' \
  --output json

Delete untagged images:

repo="my-repo"

aws ecr list-images \
  --repository-name $repo \
  --filter tagStatus=UNTAGGED \
  --query 'imageIds[*]' \
  --output json | \
  jq -r '.[] | .imageDigest' | while read digest; do
  echo "Deleting $digest"
  aws ecr batch-delete-image \
    --repository-name $repo \
    --image-ids imageDigest=$digest
done

Typical savings: $5-50/month

Summary: Total Hidden Cost Potential

Total potential savings: $50-440/month = $600-5,280/year

Next Steps

Start with CloudWatch Logs and S3 versioning - they typically have the biggest impact for the least effort.

Share the output of the audit commands and I’ll help you prioritize what to clean up first.