Where cloud bills leak, and the four fixes that stop it

When a cloud bill doubles, the instinct is to look for a cheaper instance type. The saving there is real but small. The large numbers are almost always in four places, and all four are organisational problems wearing a technical costume.

1. Resources with no owner

Unattached storage volumes, old snapshots, load balancers pointing at nothing, idle databases from a project that ended, reserved addresses nobody released. This accumulates silently because deleting something you do not understand feels riskier than paying for it. Tag everything with an owner and a purpose at creation time, and treat an untagged resource as a defect.

2. Non-production environments running all night

• Development and staging running 24 hours a day for a team that works eight.
• Environments sized like production because it was easier to copy the configuration.
• Preview environments per branch that are never cleaned up.
• A schedule that shuts non-production down outside working hours is often the single biggest saving available, and it takes an afternoon.

3. Data transfer and storage tiers

Egress charges surprise people because they scale with success. Traffic between availability zones, data pulled repeatedly from object storage by a service that could cache it, logs shipped to a third-party platform at full volume. Similarly, storage left on the hottest tier when most of it has not been read in a year. Both are configuration changes rather than architecture changes.

4. Committed capacity nobody reviewed

Reserved instances and savings plans are excellent until the architecture moves and the commitment does not. Review commitments quarterly against actual usage, and never commit the full baseline — commit the portion you are confident about and buy the rest on demand.

Make it stick

• A cost alert per environment with a named recipient, not a shared inbox.
• Cost visible per team or per service, so the number has an owner who can act.
• A monthly fifteen-minute review of the top five line items and anything that moved more than a fifth.
• Deletion as a normal, scheduled activity rather than something done during an incident.

Done consistently this recovers a meaningful share of most cloud bills within a quarter, and — more usefully — keeps it from coming back.