{"id":32226,"date":"2026-09-22T13:30:56","date_gmt":"2026-09-22T08:00:56","guid":{"rendered":"https:\/\/opstree.com\/blog\/?p=32226"},"modified":"2026-09-22T13:30:56","modified_gmt":"2026-09-22T08:00:56","slug":"aws-defaults-problem-finops-playbook","status":"publish","type":"post","link":"https:\/\/opstree.com\/blog\/aws-defaults-problem-finops-playbook\/","title":{"rendered":"AWS Defaults Problem: A FinOps Playbook for Engineering Teams"},"content":{"rendered":"<p><span data-contrast=\"auto\">AWS\u00a0doesn&#8217;t\u00a0have a pricing problem. It has a\u00a0<\/span><b><span data-contrast=\"auto\">defaults\u00a0problem<\/span><\/b><span data-contrast=\"auto\">.<\/span><span data-ccp-props=\"{&quot;134245417&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:140,&quot;335559740&quot;:276}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Every default in AWS is chosen for day-one convenience &#8211; get the resource up, get the demo working, ship the feature . Nobody is paged when a default quietly compounds into a five-figure line item\u00a0eight months later.\u00a0That&#8217;s\u00a0the pattern behind\u00a0almost every\u00a0&#8220;why is our bill so high&#8221; investigation:<\/span><span data-ccp-props=\"{&quot;134245417&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:140,&quot;335559740&quot;:276}\">\u00a0<\/span><\/p>\n<ul>\n<li><span data-contrast=\"auto\">T3 and T4g instances default to\u00a0<\/span><b><span data-contrast=\"auto\">Unlimited credit mode<\/span><\/b><span data-contrast=\"auto\"> &#8211; an undersized workload bursts past its baseline and racks up surplus charges no one is watching for.<\/span><span data-ccp-props=\"{&quot;134245417&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:140,&quot;335559740&quot;:276,&quot;335559991&quot;:283,&quot;469777462&quot;:[709,709],&quot;469777927&quot;:[0,0],&quot;469777928&quot;:[0,1]}\">\u00a0<\/span><\/li>\n<li><b><span data-contrast=\"auto\">Auto-assign public IP<\/span><\/b><span data-contrast=\"auto\"> is on by default, leaving a ~$3.65\/month charge on every instance whether it&#8217;s actually reachable\u00a0from the internet or not.<\/span><span data-ccp-props=\"{&quot;134245417&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:140,&quot;335559740&quot;:276,&quot;335559991&quot;:283,&quot;469777462&quot;:[709,709],&quot;469777927&quot;:[0,0],&quot;469777928&quot;:[0,1]}\">\u00a0<\/span><\/li>\n<li><span data-contrast=\"auto\">S3 buckets provisioned without a lifecycle policy keep cold, unread data at hot-storage rates indefinitely.<\/span><span data-ccp-props=\"{&quot;134245417&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:140,&quot;335559740&quot;:276,&quot;335559991&quot;:283,&quot;469777462&quot;:[709,709],&quot;469777927&quot;:[0,0],&quot;469777928&quot;:[0,1]}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-contrast=\"auto\">None of these are AWS &#8220;gotchas.&#8221;\u00a0They&#8217;re\u00a0reasonable defaults for a proof of concept that nobody revisited once the workload became production.<\/span><span data-ccp-props=\"{&quot;134245417&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:140,&quot;335559740&quot;:276}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">This playbook covers the full FinOps discipline &#8211; visibility, rightsizing, commitments, Spot, storage and data transfer and closes with a deep dive into the single cleanest example of the pattern: CPU credits.<\/span><span data-ccp-props=\"{&quot;134245417&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:140,&quot;335559740&quot;:276}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Everything below rests on one premise:\u00a0<\/span><b><span data-contrast=\"auto\">you cannot\u00a0optimize\u00a0what you cannot see.<\/span><\/b><\/p>\n<h3><b><span data-contrast=\"auto\">Tagging: The Price of Visibility<\/span><\/b><span data-ccp-props=\"{&quot;134245417&quot;:false,&quot;134245418&quot;:true,&quot;335559738&quot;:200,&quot;335559739&quot;:120,&quot;335559991&quot;:0}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">An untagged resource is\u00a0invisible\u00a0waste. Nobody owns\u00a0it,\u00a0nobody\u00a0deletes\u00a0it, and it bills the account every month, potentially for years.<\/span><span data-ccp-props=\"{&quot;134245417&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:140,&quot;335559740&quot;:276}\">\u00a0<\/span><\/p>\n<p><b><span data-contrast=\"auto\">Do this:<\/span><\/b><span data-ccp-props=\"{&quot;134245417&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:140,&quot;335559740&quot;:276}\">\u00a0<\/span><\/p>\n<ul>\n<li><span data-contrast=\"auto\">Define a\u00a0<\/span><b><span data-contrast=\"auto\">mandatory tag schema<\/span><\/b><span data-contrast=\"auto\"> &#8211;\u00a0<\/span><span data-contrast=\"auto\">Environment<\/span><span data-contrast=\"auto\">,\u00a0<\/span><span data-contrast=\"auto\">Team<\/span><span data-contrast=\"auto\">,\u00a0<\/span><span data-contrast=\"auto\">Application<\/span><span data-contrast=\"auto\">,\u00a0<\/span><span data-contrast=\"auto\">Owner<\/span><span data-contrast=\"auto\">,\u00a0<\/span><span data-contrast=\"auto\">CostCenter<\/span><span data-contrast=\"auto\">. Five tags, not fifty.<\/span><span data-ccp-props=\"{&quot;134245417&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:140,&quot;335559740&quot;:276,&quot;335559991&quot;:283,&quot;469777462&quot;:[709,709],&quot;469777927&quot;:[0,0],&quot;469777928&quot;:[0,1]}\">\u00a0<\/span><\/li>\n<li><span data-contrast=\"auto\">Enforce it with\u00a0<\/span><b><span data-contrast=\"auto\">Organizations\u00a0tag\u00a0policies<\/span><\/b><span data-contrast=\"auto\">\u00a0and SCP conditions on supported resource types.<\/span><span data-ccp-props=\"{&quot;134245417&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:140,&quot;335559740&quot;:276,&quot;335559991&quot;:283,&quot;469777462&quot;:[709,709],&quot;469777927&quot;:[0,0],&quot;469777928&quot;:[0,1]}\">\u00a0<\/span><\/li>\n<li><span data-contrast=\"auto\">Kill drift at the source with an\u00a0<\/span><b><span data-contrast=\"auto\">EventBridge\u00a0+ Lambda auto-tagger<\/span><\/b><span data-contrast=\"auto\">\u00a0that stamps every new resource with creator, date, and account at creation time.<\/span><span data-ccp-props=\"{&quot;134245417&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:140,&quot;335559740&quot;:276,&quot;335559991&quot;:283,&quot;469777462&quot;:[709,709],&quot;469777927&quot;:[0,0],&quot;469777928&quot;:[0,1]}\">\u00a0<\/span><\/li>\n<li><span data-contrast=\"auto\">Track\u00a0<\/span><span data-contrast=\"auto\">untagged%<\/span><span data-contrast=\"auto\">\u00a0as a weekly KPI. Under 2% is healthy. Above 10% means your cost allocation is fiction.<\/span><span data-ccp-props=\"{&quot;134245417&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:140,&quot;335559740&quot;:276,&quot;335559991&quot;:283,&quot;469777462&quot;:[709,709],&quot;469777927&quot;:[0,0],&quot;469777928&quot;:[0,1]}\">\u00a0<\/span><\/li>\n<\/ul>\n<h3 aria-level=\"2\"><b><span data-contrast=\"auto\">Build the Visibility Pipeline First<\/span><\/b><span data-ccp-props=\"{&quot;134245417&quot;:false,&quot;134245418&quot;:true,&quot;335559738&quot;:200,&quot;335559739&quot;:120,&quot;335559991&quot;:0}\">\u00a0<\/span><\/h3>\n<ul>\n<li><span data-contrast=\"auto\">Ingest the\u00a0<\/span><b><span data-contrast=\"auto\">Cost &amp; Usage Report (CUR)<\/span><\/b><span data-contrast=\"auto\"> into your own store &#8211; Athena or ClickHouse. Cost Explorer is built for humans clicking around; the CUR is built for automation.<\/span><span data-ccp-props=\"{&quot;134245417&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:140,&quot;335559740&quot;:276,&quot;335559991&quot;:283,&quot;469777462&quot;:[709,709],&quot;469777927&quot;:[0,0],&quot;469777928&quot;:[0,1]}\">\u00a0<\/span><\/li>\n<li><span data-contrast=\"auto\">Use\u00a0<\/span><b><span data-contrast=\"auto\">AWS Budgets<\/span><\/b><span data-contrast=\"auto\">\u00a0as tripwires and\u00a0<\/span><b><span data-contrast=\"auto\">anomaly detection<\/span><\/b><span data-contrast=\"auto\">\u00a0as the real alarm. Budgets tell you at month-end. Anomaly detection tells you on day two.<\/span><span data-ccp-props=\"{&quot;134245417&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:140,&quot;335559740&quot;:276,&quot;335559991&quot;:283,&quot;469777462&quot;:[709,709],&quot;469777927&quot;:[0,0],&quot;469777928&quot;:[0,1]}\">\u00a0<\/span><\/li>\n<li><span data-contrast=\"auto\">Distinguish\u00a0<\/span><b><span data-contrast=\"auto\">one-time spikes<\/span><\/b><span data-contrast=\"auto\">\u00a0(a\u00a0pentest, a migration) from\u00a0<\/span><b><span data-contrast=\"auto\">step changes<\/span><\/b><span data-contrast=\"auto\">\u00a0(a new resource class, a rightsizing miss that never gets corrected). Spikes are\u00a0noise. Step changes compound.<\/span><span data-ccp-props=\"{&quot;134245417&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:140,&quot;335559740&quot;:276,&quot;335559991&quot;:283,&quot;469777462&quot;:[709,709],&quot;469777927&quot;:[0,0],&quot;469777928&quot;:[0,1]}\">\u00a0<\/span><\/li>\n<\/ul>\n<h3 aria-level=\"2\"><b><span data-contrast=\"auto\">Rightsizing: Profile Before You Pick<\/span><\/b><span data-ccp-props=\"{&quot;134245417&quot;:false,&quot;134245418&quot;:true,&quot;335559738&quot;:200,&quot;335559739&quot;:120,&quot;335559991&quot;:0}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">The most common EC2 mistake\u00a0isn&#8217;t\u00a0choosing the wrong\u00a0instance\u00a0family \u2014\u00a0it&#8217;s\u00a0sizing off a bad sample. A workload profiled for ten minutes on a random Tuesday gets permanently sized for that Tuesday&#8217;s peak, then runs 24\/7 at 15%\u00a0utilization\u00a0for the next two years.<\/span><span data-ccp-props=\"{&quot;134245417&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:140,&quot;335559740&quot;:276}\">\u00a0<\/span><\/p>\n<ul>\n<li><span data-contrast=\"auto\">Review average vs. peak CPU\/network on a rolling 30-day window,\u00a0<\/span><b><span data-contrast=\"auto\">every month<\/span><\/b><span data-contrast=\"auto\">. Below ~20% average CPU on a fixed-performance instance is a signal to downsize one or two sizes.<\/span><span data-ccp-props=\"{&quot;134245417&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:140,&quot;335559740&quot;:276,&quot;335559991&quot;:283,&quot;469777462&quot;:[709,709],&quot;469777927&quot;:[0,0],&quot;469777928&quot;:[0,1]}\">\u00a0<\/span><\/li>\n<li><span data-contrast=\"auto\">Consistently above baseline on a burstable instance means the wrong\u00a0<\/span><b><span data-contrast=\"auto\">family<\/span><\/b><span data-contrast=\"auto\"> was chosen, not the wrong size &#8211; see the CPU credits deep dive below.<\/span><span data-ccp-props=\"{&quot;134245417&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:140,&quot;335559740&quot;:276,&quot;335559991&quot;:283,&quot;469777462&quot;:[709,709],&quot;469777927&quot;:[0,0],&quot;469777928&quot;:[0,1]}\">\u00a0<\/span><\/li>\n<li><span data-contrast=\"auto\">Graviton-compatible workloads get\u00a0<\/span><b><span data-contrast=\"auto\">up to ~40% better\u00a0price-performance<\/span><\/b><span data-contrast=\"auto\">. Default new deployments to <\/span><span data-contrast=\"auto\">t4g<\/span><span data-contrast=\"auto\">\u00a0\/\u00a0<\/span><span data-contrast=\"auto\">m6g<\/span><span data-contrast=\"auto\">\u00a0\/\u00a0<\/span><span data-contrast=\"auto\">c6g<\/span><span data-contrast=\"auto\">\u00a0\/\u00a0<\/span><span data-contrast=\"auto\">r6g<\/span><span data-contrast=\"auto\">\u00a0unless\u00a0there&#8217;s\u00a0a hard x86 dependency.<\/span><span data-ccp-props=\"{&quot;134245417&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:140,&quot;335559740&quot;:276,&quot;335559991&quot;:283,&quot;469777462&quot;:[709,709],&quot;469777927&quot;:[0,0],&quot;469777928&quot;:[0,1]}\">\u00a0<\/span><\/li>\n<\/ul>\n<h3 aria-level=\"2\"><b><span data-contrast=\"auto\">Commitments: Pay Less for What You Already Do<\/span><\/b><span data-ccp-props=\"{&quot;134245417&quot;:false,&quot;134245418&quot;:true,&quot;335559738&quot;:200,&quot;335559739&quot;:120,&quot;335559991&quot;:0}\">\u00a0<\/span><\/h3>\n<ul>\n<li><b><span data-contrast=\"auto\">Savings Plans<\/span><\/b><span data-contrast=\"auto\">\u00a0should cover\u00a0roughly\u00a0<\/span><b><span data-contrast=\"auto\">70\u201380% of your stable baseline<\/span><\/b><span data-contrast=\"auto\"> \u2014 the always-on floor of your compute. Let commitments cover the floor; let autoscaling \u2014 not over-provisioning \u2014 handle the variance above it.<\/span><span data-ccp-props=\"{&quot;134245417&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:140,&quot;335559740&quot;:276,&quot;335559991&quot;:283,&quot;469777462&quot;:[709,709],&quot;469777927&quot;:[0,0],&quot;469777928&quot;:[0,1]}\">\u00a0<\/span><\/li>\n<li><span data-contrast=\"auto\">Track both\u00a0<\/span><b><span data-contrast=\"auto\">coverage<\/span><\/b><span data-contrast=\"auto\">\u00a0and\u00a0<\/span><b><span data-contrast=\"auto\">utilization<\/span><\/b><span data-contrast=\"auto\">\u00a0on every commitment. An unconsumed commitment is worse than no commitment at all.<\/span><span data-ccp-props=\"{&quot;134245417&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:140,&quot;335559740&quot;:276,&quot;335559991&quot;:283,&quot;469777462&quot;:[709,709],&quot;469777927&quot;:[0,0],&quot;469777928&quot;:[0,1]}\">\u00a0<\/span><\/li>\n<li><span data-contrast=\"auto\">Start broad with 1-year Compute Savings Plans, then layer 3-year EC2 Instance Savings Plans onto your most predictable, stable workloads.<\/span><span data-ccp-props=\"{&quot;134245417&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:140,&quot;335559740&quot;:276,&quot;335559991&quot;:283,&quot;469777462&quot;:[709,709],&quot;469777927&quot;:[0,0],&quot;469777928&quot;:[0,1]}\">\u00a0<\/span><\/li>\n<\/ul>\n<h3 aria-level=\"2\"><b><span data-contrast=\"auto\">Spot for Anything That Can Die Gracefully<\/span><\/b><span data-ccp-props=\"{&quot;134245417&quot;:false,&quot;134245418&quot;:true,&quot;335559738&quot;:200,&quot;335559739&quot;:120,&quot;335559991&quot;:0}\">\u00a0<\/span><\/h3>\n<ul>\n<li><span data-contrast=\"auto\">Stateless web tiers, batch processing, CI runners, EKS\/Karpenter workloads &#8211; all strong Spot candidates at <\/span><b><span data-contrast=\"auto\">60\u201390% off<\/span><\/b><span data-contrast=\"auto\">\u00a0on-demand pricing.<\/span><span data-ccp-props=\"{&quot;134245417&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:140,&quot;335559740&quot;:276,&quot;335559991&quot;:283,&quot;469777462&quot;:[709,709],&quot;469777927&quot;:[0,0],&quot;469777928&quot;:[0,1]}\">\u00a0<\/span><\/li>\n<li><span data-contrast=\"auto\">Diversify instance families and capacity pools, and design workloads for interruption (checkpointing, graceful drain) rather than trying to design around it.<\/span><span data-ccp-props=\"{&quot;134245417&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:140,&quot;335559740&quot;:276,&quot;335559991&quot;:283,&quot;469777462&quot;:[709,709],&quot;469777927&quot;:[0,0],&quot;469777928&quot;:[0,1]}\">\u00a0<\/span><\/li>\n<li><b><span data-contrast=\"auto\">Critical:<\/span><\/b><span data-contrast=\"auto\">\u00a0run\u00a0Spot-backed burstable instances in\u00a0<\/span><b><span data-contrast=\"auto\">Standard<\/span><\/b><span data-contrast=\"auto\"> credit mode. Short-lived Spot instances never live long enough to earn credits before bursting &#8211; more on why this matters below.<\/span><span data-ccp-props=\"{&quot;134245417&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:140,&quot;335559740&quot;:276,&quot;335559991&quot;:283,&quot;469777462&quot;:[709,709],&quot;469777927&quot;:[0,0],&quot;469777928&quot;:[0,1]}\">\u00a0<\/span><\/li>\n<\/ul>\n<h3 aria-level=\"2\"><b><span data-contrast=\"auto\">Storage Hygiene: The Compounding Leak<\/span><\/b><span data-ccp-props=\"{&quot;134245417&quot;:false,&quot;134245418&quot;:true,&quot;335559738&quot;:200,&quot;335559739&quot;:120,&quot;335559991&quot;:0}\">\u00a0<\/span><\/h3>\n<p><b><span data-contrast=\"auto\">EBS<\/span><\/b><span data-ccp-props=\"{&quot;134245417&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:140,&quot;335559740&quot;:276}\">\u00a0<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"8\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559991&quot;:283,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;start&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-contrast=\"auto\">Default to\u00a0<\/span><b><span data-contrast=\"auto\">gp3<\/span><\/b><span data-contrast=\"auto\">\u00a0\u2014\u00a0roughly 20%\u00a0cheaper than gp2, with 3,000 IOPS \/ 125 MB\/s included at no extra charge.<\/span><span data-ccp-props=\"{&quot;134245417&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:140,&quot;335559740&quot;:276,&quot;335559991&quot;:283,&quot;469777462&quot;:[709,709],&quot;469777927&quot;:[0,0],&quot;469777928&quot;:[0,1]}\">\u00a0<\/span><\/li>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"8\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559991&quot;:283,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;start&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span class=\"TextRun SCXW4408749 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW4408749 BCX0\" data-ccp-parastyle=\"Body Text\">Run a weekly sweep for\u00a0<\/span><\/span><span class=\"TextRun SCXW4408749 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW4408749 BCX0\" data-ccp-parastyle=\"Body Text\">unattached volumes<\/span><\/span><span class=\"TextRun SCXW4408749 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW4408749 BCX0\" data-ccp-parastyle=\"Body Text\">. A stopped instance&#8217;s disk keeps billing forever if nobody notices.<\/span><\/span><span class=\"EOP Selected SCXW4408749 BCX0\" data-ccp-props=\"{&quot;134245417&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:140,&quot;335559740&quot;:276,&quot;335559991&quot;:283,&quot;469777462&quot;:[709,709],&quot;469777927&quot;:[0,0],&quot;469777928&quot;:[0,1]}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><b><span data-contrast=\"auto\">S3<\/span><\/b><span data-ccp-props=\"{&quot;134245417&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:140,&quot;335559740&quot;:276}\">\u00a0<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"9\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559991&quot;:283,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;start&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-contrast=\"auto\">Every bucket needs a lifecycle policy or\u00a0<\/span><b><span data-contrast=\"auto\">Intelligent-Tiering<\/span><\/b><span data-contrast=\"auto\">\u00a0from day one. &#8220;We&#8217;ll script it later&#8221; turns into two years of Standard-rate storage on data nobody reads.<\/span><span data-ccp-props=\"{&quot;134245417&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:140,&quot;335559740&quot;:276,&quot;335559991&quot;:283,&quot;469777462&quot;:[709,709],&quot;469777927&quot;:[0,0],&quot;469777928&quot;:[0,1]}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><b><span data-contrast=\"auto\">Snapshots<\/span><\/b><span data-ccp-props=\"{&quot;134245417&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:140,&quot;335559740&quot;:276}\">\u00a0<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"10\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559991&quot;:283,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;start&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-contrast=\"auto\">Orphaned AMIs and old snapshots are the classic audit finding &#8211; both financially and as a data-exposure risk. Put them on an archive-or-delete schedule.<\/span><span data-ccp-props=\"{&quot;134245417&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:140,&quot;335559740&quot;:276,&quot;335559991&quot;:283,&quot;469777462&quot;:[709,709],&quot;469777927&quot;:[0,0],&quot;469777928&quot;:[0,1]}\">\u00a0<\/span><\/li>\n<\/ul>\n<h3 aria-level=\"2\"><b><span data-contrast=\"auto\">Data Transfer: The Line Item Nobody Owns<\/span><\/b><span data-ccp-props=\"{&quot;134245417&quot;:false,&quot;134245418&quot;:true,&quot;335559738&quot;:200,&quot;335559739&quot;:120,&quot;335559991&quot;:0}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">This shows up on the bill as &#8220;EC2-Other&#8221; or &#8220;Data Transfer,&#8221; and it rarely has a clear owner:<\/span><span data-ccp-props=\"{&quot;134245417&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:140,&quot;335559740&quot;:276}\">\u00a0<\/span><\/p>\n<div style=\"overflow-x: auto; width: 100%; margin: 25px 0; -webkit-overflow-scrolling: touch;\">\n<table style=\"width: 100%; min-width: 750px; border-collapse: collapse; font-family: Arial,Helvetica,sans-serif; font-size: 14px; line-height: 1.6; color: #374151;\">\n<thead>\n<tr style=\"background: #f5f7fa;\">\n<th style=\"border: 1px solid #ddd; padding: 12px; text-align: left;\">Pattern<\/th>\n<th style=\"border: 1px solid #ddd; padding: 12px; text-align: left;\">Cost<\/th>\n<th style=\"border: 1px solid #ddd; padding: 12px; text-align: left;\">Fix<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">Instances \u2192 S3\/DynamoDB via NAT Gateway<\/td>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">~$0.045\/GB processing + ~$32\/mo\/NAT<\/td>\n<td style=\"border: 1px solid #ddd; padding: 12px;\"><strong>Gateway VPC endpoints \u2014 free<\/strong><\/td>\n<\/tr>\n<tr style=\"background: #fafafa;\">\n<td style=\"border: 1px solid #ddd; padding: 12px;\">Cross-AZ chatter<\/td>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">$0.01\/GB each direction<\/td>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">AZ-aware routing<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">EC2 egress to internet<\/td>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">~$0.09\/GB<\/td>\n<td style=\"border: 1px solid #ddd; padding: 12px;\"><strong>CloudFront<\/strong> \u2014 caching cuts origin bytes at equal-or-better egress rates<\/td>\n<\/tr>\n<tr style=\"background: #fafafa;\">\n<td style=\"border: 1px solid #ddd; padding: 12px;\">Public IPv4 per instance<\/td>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">~$0.005\/hr<\/td>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">Kill auto-assign; use private subnets + endpoints<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<p><span class=\"TextRun SCXW264820739 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW264820739 BCX0\" data-ccp-parastyle=\"Body Text\">A chatty microservice pushing 100 GB\/day through a NAT Gateway to reach S3 costs\u00a0<\/span><span class=\"NormalTextRun SCXW264820739 BCX0\" data-ccp-parastyle=\"Body Text\">roughly\u00a0<\/span><\/span><span class=\"TextRun SCXW264820739 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW264820739 BCX0\" data-ccp-parastyle=\"Body Text\">$135\/month<\/span><\/span><span class=\"TextRun SCXW264820739 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW264820739 BCX0\" data-ccp-parastyle=\"Body Text\">\u00a0for traffic a free Gateway endpoint would carry for nothing. Multiply that by every service running the same pattern.<\/span><\/span><span class=\"EOP Selected SCXW264820739 BCX0\" data-ccp-props=\"{&quot;134245417&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:140,&quot;335559740&quot;:276}\">\u00a0<\/span><\/p>\n<h3><span class=\"TextRun SCXW57559323 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW57559323 BCX0\" data-ccp-parastyle=\"heading 2\">Where Cost, Security and Performance Overlap<\/span><\/span><span class=\"EOP Selected SCXW57559323 BCX0\" data-ccp-props=\"{&quot;134245417&quot;:false,&quot;134245418&quot;:true,&quot;335559738&quot;:200,&quot;335559739&quot;:120,&quot;335559991&quot;:0}\">\u00a0<\/span><\/h3>\n<p><span class=\"TextRun SCXW141155935 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW141155935 BCX0\" data-ccp-parastyle=\"Body Text\">Some decisions pay off in more than one domain at once. These are worth prioritizing first:<\/span><\/span><span class=\"EOP Selected SCXW141155935 BCX0\" data-ccp-props=\"{&quot;134245417&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:140,&quot;335559740&quot;:276}\">\u00a0<\/span><\/p>\n<div style=\"overflow-x: auto; width: 100%; margin: 25px 0; -webkit-overflow-scrolling: touch;\">\n<table style=\"width: 100%; min-width: 950px; border-collapse: collapse; font-family: Arial,Helvetica,sans-serif; font-size: 14px; line-height: 1.6; color: #374151;\">\n<thead>\n<tr style=\"background: #f5f7fa;\">\n<th style=\"border: 1px solid #ddd; padding: 12px; text-align: left;\">Decision<\/th>\n<th style=\"border: 1px solid #ddd; padding: 12px; text-align: left;\">Cost<\/th>\n<th style=\"border: 1px solid #ddd; padding: 12px; text-align: left;\">Security<\/th>\n<th style=\"border: 1px solid #ddd; padding: 12px; text-align: left;\">Performance<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">Gateway VPC endpoints<\/td>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">NAT fees \u2192 $0<\/td>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">Traffic stays on the AWS backbone<\/td>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">More consistent latency<\/td>\n<\/tr>\n<tr style=\"background: #fafafa;\">\n<td style=\"border: 1px solid #ddd; padding: 12px;\">Kill the bastion, use SSM<\/td>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">\u22121 EC2 instance<\/td>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">No open port 22; sessions logged<\/td>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">Faster incident access<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">Private subnets, no auto-assign public IP<\/td>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">\u2212$3.65\/mo\/instance<\/td>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">Sharply reduced attack surface<\/td>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">\u2014<\/td>\n<\/tr>\n<tr style=\"background: #fafafa;\">\n<td style=\"border: 1px solid #ddd; padding: 12px;\">CloudFront in front of origin<\/td>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">Cheaper egress, lower origin load<\/td>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">Shield + WAF integration<\/td>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">Global edge caching<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">Delete idle assets<\/td>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">Direct savings<\/td>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">Smaller exposure surface<\/td>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">Cleaner inventory<\/td>\n<\/tr>\n<tr style=\"background: #fafafa;\">\n<td style=\"border: 1px solid #ddd; padding: 12px;\">Graviton defaults<\/td>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">20\u201340% better price-performance<\/td>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">\u2014<\/td>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">Often better absolute performance<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">Tagging enforcement<\/td>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">Cost allocation<\/td>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">Ownership for incident response<\/td>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">Inventory accuracy<\/td>\n<\/tr>\n<tr style=\"background: #fafafa;\">\n<td style=\"border: 1px solid #ddd; padding: 12px;\">Autoscaling<\/td>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">Pay for load, not peak<\/td>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">Smaller footprint<\/td>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">Scales ahead of pain<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<p><em><span class=\"TextRun SCXW54742706 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW54742706 BCX0\" data-ccp-parastyle=\"Body Text\">Our companion post covers the security and performance side of these same decisions in depth: &#8220;AWS Security &amp; Performance: The SecOps + Engineering Playbook.&#8221;<\/span><\/span><span class=\"EOP Selected SCXW54742706 BCX0\" data-ccp-props=\"{&quot;134245417&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:140,&quot;335559740&quot;:276}\">\u00a0<\/span>\u00a0<\/em><\/p>\n<h3><b><span data-contrast=\"auto\">\u00a0Dive: CPU Credits \u2014 The Default That Bills You Later<\/span><\/b><span data-ccp-props=\"{&quot;134245417&quot;:false,&quot;134245418&quot;:true,&quot;335559738&quot;:200,&quot;335559739&quot;:120,&quot;335559991&quot;:0}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">This is the cleanest example of the whole\u00a0playbook&#8217;s\u00a0thesis in miniature: a reasonable default, a silent failure mode, and a fix that takes minutes once you know which metrics to watch.<\/span><span data-ccp-props=\"{&quot;134245417&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:140,&quot;335559740&quot;:276}\">\u00a0<\/span><\/p>\n<h4><b><span data-contrast=\"auto\">The mechanism<\/span><\/b><span data-ccp-props=\"{&quot;134245417&quot;:false,&quot;134245418&quot;:true,&quot;335559738&quot;:140,&quot;335559739&quot;:120,&quot;335559991&quot;:0}\">\u00a0<\/span><\/h4>\n<p><span data-contrast=\"auto\">Burstable instances \u2014 T2, T3, T3a, T4g, across EC2, RDS, and DAX \u2014\u00a0trade a low hourly price for a capped <\/span><b><span data-contrast=\"auto\">baseline <\/span><\/b><span data-contrast=\"auto\">CPU allocation per vCPU. Run below baseline and the instance earns credits. Run above baseline and it\u00a0spends\u00a0them. One credit\u00a0equals\u00a0one vCPU at 100%\u00a0utilization\u00a0for one minute. A t3a.medium with a 20% baseline gets\u00a0roughly 0.4 vCPUs of\u00a0<\/span><i><span data-contrast=\"auto\">sustained<\/span><\/i><span data-contrast=\"auto\">\u00a0capacity; everything beyond that is financed in bursts.<\/span><span data-ccp-props=\"{&quot;134245417&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:140,&quot;335559740&quot;:276}\">\u00a0<\/span><\/p>\n<h4><b><span data-contrast=\"auto\">The two credit modes<\/span><\/b><span data-ccp-props=\"{&quot;134245417&quot;:false,&quot;134245418&quot;:true,&quot;335559738&quot;:140,&quot;335559739&quot;:120,&quot;335559991&quot;:0}\">\u00a0<\/span><\/h4>\n<ul>\n<li><b><span data-contrast=\"auto\">Standard<\/span><\/b><span data-contrast=\"auto\"> &#8211; burst only while credits are banked; once the balance hits zero, the instance throttles to baseline. This isn&#8217;t\u00a0a crash, which is what makes it dangerous \u2014 it shows up as cascading timeouts that are hard to trace back to the actual cause. T2 defaults to this mode.<\/span><span data-ccp-props=\"{&quot;134245417&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:140,&quot;335559740&quot;:276,&quot;335559991&quot;:283,&quot;469777462&quot;:[709,709],&quot;469777927&quot;:[0,0],&quot;469777928&quot;:[0,1]}\">\u00a0<\/span><\/li>\n<li><b><span data-contrast=\"auto\">Unlimited<\/span><\/b><span data-contrast=\"auto\"> &#8211; burst indefinitely on borrowed &#8220;surplus&#8221; credits. This is free within a 24-hour rolling window, but once average utilization\u00a0exceeds baseline, surplus is\u00a0<\/span><b><span data-contrast=\"auto\">billed at\u00a0roughly $0.05\/vCPU-hour<\/span><\/b><span data-contrast=\"auto\"> (T3, us-east-1). T3, T3a, and T4g all default to Unlimited and that default is the hidden cost this section is about.<\/span><span data-ccp-props=\"{&quot;134245417&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:140,&quot;335559740&quot;:276,&quot;335559991&quot;:283,&quot;469777462&quot;:[709,709],&quot;469777927&quot;:[0,0],&quot;469777928&quot;:[0,1]}\">\u00a0<\/span><\/li>\n<\/ul>\n<h4 aria-level=\"3\"><b><span data-contrast=\"auto\">The metrics that\u00a0actually matter<\/span><\/b><span data-ccp-props=\"{&quot;134245417&quot;:false,&quot;134245418&quot;:true,&quot;335559738&quot;:140,&quot;335559739&quot;:120,&quot;335559991&quot;:0}\">\u00a0<\/span><\/h4>\n<ul>\n<li><span data-contrast=\"auto\">CPUCreditBalance<\/span><span data-contrast=\"auto\"> &#8211; credits currently banked<\/span><span data-ccp-props=\"{&quot;134245417&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:140,&quot;335559740&quot;:276,&quot;335559991&quot;:283,&quot;469777462&quot;:[709,709],&quot;469777927&quot;:[0,0],&quot;469777928&quot;:[0,1]}\">\u00a0<\/span><\/li>\n<li><span data-contrast=\"auto\">CPUCreditUsage<\/span><span data-contrast=\"auto\"> &#8211; credits spent<\/span><span data-ccp-props=\"{&quot;134245417&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:140,&quot;335559740&quot;:276,&quot;335559991&quot;:283,&quot;469777462&quot;:[709,709],&quot;469777927&quot;:[0,0],&quot;469777928&quot;:[0,1]}\">\u00a0<\/span><\/li>\n<li><span data-contrast=\"auto\">CPUSurplusCreditBalance<\/span><span data-contrast=\"auto\"> &#8211; credits borrowed and not yet paid off<\/span><span data-ccp-props=\"{&quot;134245417&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:140,&quot;335559740&quot;:276,&quot;335559991&quot;:283,&quot;469777462&quot;:[709,709],&quot;469777927&quot;:[0,0],&quot;469777928&quot;:[0,1]}\">\u00a0<\/span><\/li>\n<li><span data-contrast=\"auto\">CPUSurplusCreditsCharged<\/span><span data-contrast=\"auto\"> &#8211; the one that maps directly to dollars<\/span><span data-ccp-props=\"{&quot;134245417&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:140,&quot;335559740&quot;:276,&quot;335559991&quot;:283,&quot;469777462&quot;:[709,709],&quot;469777927&quot;:[0,0],&quot;469777928&quot;:[0,1]}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-contrast=\"auto\">A rising trend on that last metric means the instance has outgrown the burstable category entirely.<\/span><span data-ccp-props=\"{&quot;134245417&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:140,&quot;335559740&quot;:276}\">\u00a0<\/span><\/p>\n<h4><b><span data-contrast=\"auto\">Four classic traps<\/span><\/b><span data-ccp-props=\"{&quot;134245417&quot;:false,&quot;134245418&quot;:true,&quot;335559738&quot;:140,&quot;335559739&quot;:120,&quot;335559991&quot;:0}\">\u00a0<\/span><\/h4>\n<ol>\n<li><b><span data-contrast=\"auto\">Undersized in Unlimited mode.<\/span><\/b><span data-contrast=\"auto\">\u00a0Baseline price plus a steady stream of surplus fees, which often ends up costing more than a properly sized M- or C-family instance would have in the first place.<\/span><span data-ccp-props=\"{&quot;134245417&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:140,&quot;335559740&quot;:276,&quot;335559991&quot;:283,&quot;469777462&quot;:[709,709],&quot;469777927&quot;:[0,0],&quot;469777928&quot;:[0,1]}\">\u00a0<\/span><\/li>\n<li><b><span data-contrast=\"auto\">&#8220;Idle&#8221; instances that\u00a0aren&#8217;t.<\/span><\/b><span data-contrast=\"auto\"> Cron jobs, log shipping, and health checks that burn just enough CPU to prevent credit accumulation before real traffic even arrives.<\/span><span data-ccp-props=\"{&quot;134245417&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:140,&quot;335559740&quot;:276,&quot;335559991&quot;:283,&quot;469777462&quot;:[709,709],&quot;469777927&quot;:[0,0],&quot;469777928&quot;:[0,1]}\">\u00a0<\/span><\/li>\n<li><b><span data-contrast=\"auto\">Spot in Unlimited mode.<\/span><\/b><span data-contrast=\"auto\">\u00a0Short-lived Spot instances burst almost\u00a0immediately and never accumulate a credit balance, they go straight to surplus billing. Use Standard mode for anything running on Spot.<\/span><span data-ccp-props=\"{&quot;134245417&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:140,&quot;335559740&quot;:276,&quot;335559991&quot;:283,&quot;469777462&quot;:[709,709],&quot;469777927&quot;:[0,0],&quot;469777928&quot;:[0,1]}\">\u00a0<\/span><\/li>\n<li><b><span data-contrast=\"auto\">Stop\/start cycles.<\/span><\/b><span data-contrast=\"auto\">\u00a0Credits persist for about seven days after an instance stops, then vanish. A restart after that window begins at a zero balance, with no burst capacity until credits rebuild.<\/span><span data-ccp-props=\"{&quot;134245417&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:140,&quot;335559740&quot;:276,&quot;335559991&quot;:283,&quot;469777462&quot;:[709,709],&quot;469777927&quot;:[0,0],&quot;469777928&quot;:[0,1]}\">\u00a0<\/span><\/li>\n<\/ol>\n<h4 aria-level=\"3\"><b><span data-contrast=\"auto\">The fix<\/span><\/b><span data-ccp-props=\"{&quot;134245417&quot;:false,&quot;134245418&quot;:true,&quot;335559738&quot;:140,&quot;335559739&quot;:120,&quot;335559991&quot;:0}\">\u00a0<\/span><\/h4>\n<p><span data-contrast=\"auto\">Alarm on\u00a0<\/span><span data-contrast=\"auto\">CPUSurplusCreditsCharged<\/span><span data-contrast=\"auto\">\u00a0per instance. Compare baseline against actual average\u00a0utilization monthly &#8211; consistently running above baseline is a signal to change instance <\/span><i><span data-contrast=\"auto\">family<\/span><\/i><span data-contrast=\"auto\">, not just size. Use Unlimited deliberately for customer-facing production workloads, and Standard for Spot, batch, and anything short-lived. Tag burstable instances separately so surplus charges show up as their own visible line item. For new workloads, default to T4g &#8211; same mechanics, cheaper baseline.<\/span><span data-ccp-props=\"{&quot;134245417&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:140,&quot;335559740&quot;:276}\">\u00a0<\/span><\/p>\n<h3><span class=\"TextRun SCXW251048763 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW251048763 BCX0\" data-ccp-parastyle=\"heading 2\">The Cost Priority List<\/span><\/span><span class=\"EOP Selected SCXW251048763 BCX0\" data-ccp-props=\"{&quot;134245417&quot;:false,&quot;134245418&quot;:true,&quot;335559738&quot;:200,&quot;335559739&quot;:120,&quot;335559991&quot;:0}\">\u00a0<\/span><\/h3>\n<div style=\"overflow-x: auto; width: 100%; margin: 25px 0; -webkit-overflow-scrolling: touch;\">\n<table style=\"width: 100%; min-width: 900px; border-collapse: collapse; font-family: Arial,Helvetica,sans-serif; font-size: 14px; line-height: 1.6; color: #374151;\">\n<thead>\n<tr style=\"background: #f5f7fa;\">\n<th style=\"border: 1px solid #ddd; padding: 12px; text-align: left;\">#<\/th>\n<th style=\"border: 1px solid #ddd; padding: 12px; text-align: left;\">Action<\/th>\n<th style=\"border: 1px solid #ddd; padding: 12px; text-align: left;\">Effort<\/th>\n<th style=\"border: 1px solid #ddd; padding: 12px; text-align: left;\">Why<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">1<\/td>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">Tag policy + EventBridge auto-tagging<\/td>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">1 day<\/td>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">Unlocks everything else<\/td>\n<\/tr>\n<tr style=\"background: #fafafa;\">\n<td style=\"border: 1px solid #ddd; padding: 12px;\">2<\/td>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">Idle-asset sweep \u2014 volumes, EIPs, old snapshots, idle load balancers<\/td>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">2 hrs<\/td>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">Pure savings<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">3<\/td>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">S3 lifecycle policy \/ Intelligent-Tiering on every bucket<\/td>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">1 hr<\/td>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">Permanent savings<\/td>\n<\/tr>\n<tr style=\"background: #fafafa;\">\n<td style=\"border: 1px solid #ddd; padding: 12px;\">4<\/td>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">Alarm on CPUSurplusCreditsCharged; Standard mode for Spot<\/td>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">30 min<\/td>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">Catches the default trap live<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">5<\/td>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">Gateway VPC endpoints (S3, DynamoDB)<\/td>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">30 min<\/td>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">Free; eliminates NAT fees<\/td>\n<\/tr>\n<tr style=\"background: #fafafa;\">\n<td style=\"border: 1px solid #ddd; padding: 12px;\">6<\/td>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">Graviton + gp3 as deployment defaults<\/td>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">Policy change<\/td>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">Compounds forever<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">7<\/td>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">Savings Plans to 70\u201380% of baseline, tracked monthly<\/td>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">Ongoing<\/td>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">Biggest single line-item reduction<\/td>\n<\/tr>\n<tr style=\"background: #fafafa;\">\n<td style=\"border: 1px solid #ddd; padding: 12px;\">8<\/td>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">S3 Bucket Keys on KMS-encrypted buckets<\/td>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">10 min<\/td>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">Up to 99% off KMS request charges<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">9<\/td>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">CloudFront for egress-heavy workloads<\/td>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">Half-day<\/td>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">Cheaper egress + free Shield\/WAF<\/td>\n<\/tr>\n<tr style=\"background: #fafafa;\">\n<td style=\"border: 1px solid #ddd; padding: 12px;\">10<\/td>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">Autoscaling with target tracking<\/td>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">Ongoing<\/td>\n<td style=\"border: 1px solid #ddd; padding: 12px;\">Pay for load, not peak<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<h2><b><span data-contrast=\"auto\">The Bottom Line<\/span><\/b><span data-ccp-props=\"{&quot;134245417&quot;:false,&quot;134245418&quot;:true,&quot;335559738&quot;:200,&quot;335559739&quot;:120,&quot;335559991&quot;:0}\">\u00a0<\/span><\/h2>\n<p><span data-contrast=\"auto\">AWS\u00a0doesn&#8217;t have a cost problem, it has a <\/span><b><span data-contrast=\"auto\">defaults\u00a0problem<\/span><\/b><span data-contrast=\"auto\">. Every default is reasonable on day one and wrong by day two hundred. The teams with tight unit economics aren&#8217;t smarter or better funded than everyone else; they&#8217;ve simply built the habit of converting defaults into decisions, every tag enforced, every credit mode chosen deliberately, every idle resource deleted before it becomes background noise on the bill.<\/span><span data-ccp-props=\"{&quot;134245417&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:140,&quot;335559740&quot;:276}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">That surface area is too wide to watch manually. It&#8217;s why we built\u00a0<\/span><b><span data-contrast=\"auto\">UnitEconPro<\/span><\/b><span data-contrast=\"auto\">: it ingests usage and inventory continuously, flags surplus-credit creep, idle assets, and rightsizing misses, and tracks every change that moves your bill, so the default trap catches itself before it becomes next month&#8217;s surprise line item.<\/span><span data-ccp-props=\"{&quot;134245417&quot;:false,&quot;201341983&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:140,&quot;335559740&quot;:276}\">\u00a0<\/span><\/p>\n<h3><span data-ccp-props=\"{}\">Related Searches<\/span><\/h3>\n<ul>\n<li><a href=\"https:\/\/opstree.com\/blog\/leading-telecom-enterprise-transformed-enterprise-analytics-fractal-gpt\/\" target=\"_blank\" rel=\"noopener\">How Leading Telecom Enterprise Transformed Enterprise Analytics with Fractal GPT<\/a><\/li>\n<li><a href=\"https:\/\/opstree.com\/blog\/real-time-banking-ai-mule-detection-confluent\/\" target=\"_blank\" rel=\"noopener\">Real-Time Banking Data And AI-Powered Mule Detection with Confluent Platform<\/a><\/li>\n<li><a href=\"https:\/\/opstree.com\/blog\/data-integration-with-azure-event\/\" target=\"_blank\" rel=\"noopener\">Modernizing Healthcare Data Integration with Azure Event Hubs \u2013 OpsTree<\/a><\/li>\n<li><a href=\"https:\/\/opstree.com\/blog\/generative-ai-development-companies\/\" target=\"_blank\" rel=\"noopener\">Top Generative AI Development Companies<\/a><\/li>\n<\/ul>\n<h3>Related Solutions<\/h3>\n<ul>\n<li><a href=\"https:\/\/opstree.com\/services\/database-and-data-engineering\/\" target=\"_blank\" rel=\"noopener\">Scalable data lakehouse architecture services<\/a><\/li>\n<li><a href=\"https:\/\/opstree.com\/services\/devops-and-devsecops-services\/\" target=\"_blank\" rel=\"noopener\">DevSecOps implementation partner for GCC<\/a><\/li>\n<li><a href=\"https:\/\/buildpiper.io\/kubeops-kubernetes-management\/\" target=\"_blank\" rel=\"noopener\">Kubernetes managed services for GCC<\/a><\/li>\n<li><a href=\"https:\/\/opstree.com\/services\/application-platform-security-management\/\" target=\"_blank\" rel=\"noopener\">GCC platform engineering partner<\/a><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>AWS\u00a0doesn&#8217;t\u00a0have a pricing problem. It has a\u00a0defaults\u00a0problem.\u00a0 Every default in AWS is chosen for day-one convenience &#8211; get the resource up, get the demo working, ship the feature . Nobody is paged when a default quietly compounds into a five-figure line item\u00a0eight months later.\u00a0That&#8217;s\u00a0the pattern behind\u00a0almost every\u00a0&#8220;why is our bill so high&#8221; investigation:\u00a0 T3 and [&hellip;]<\/p>\n","protected":false},"author":244582734,"featured_media":32228,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_coblocks_attr":"","_coblocks_dimensions":"","_coblocks_responsive_height":"","_coblocks_accordion_ie_support":"","jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false},"version":2}},"categories":[36349927],"tags":[768739727,768739730,768739729,768739322,768739728],"class_list":["post-32226","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-aws-2","tag-aws-cost-management","tag-aws-cost-reduction","tag-aws-cpu-credit-optimization","tag-aws-finops","tag-aws-finops-best-practices"],"blocksy_meta":[],"jetpack_publicize_connections":[],"acf":[],"jetpack_featured_media_url":"https:\/\/opstree.com\/blog\/wp-content\/uploads\/2026\/09\/AWS-Defaults-Problem.webp","jetpack_likes_enabled":true,"jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/pfDBOm-8nM","jetpack-related-posts":[],"_links":{"self":[{"href":"https:\/\/opstree.com\/blog\/wp-json\/wp\/v2\/posts\/32226","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/opstree.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/opstree.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/opstree.com\/blog\/wp-json\/wp\/v2\/users\/244582734"}],"replies":[{"embeddable":true,"href":"https:\/\/opstree.com\/blog\/wp-json\/wp\/v2\/comments?post=32226"}],"version-history":[{"count":2,"href":"https:\/\/opstree.com\/blog\/wp-json\/wp\/v2\/posts\/32226\/revisions"}],"predecessor-version":[{"id":32229,"href":"https:\/\/opstree.com\/blog\/wp-json\/wp\/v2\/posts\/32226\/revisions\/32229"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/opstree.com\/blog\/wp-json\/wp\/v2\/media\/32228"}],"wp:attachment":[{"href":"https:\/\/opstree.com\/blog\/wp-json\/wp\/v2\/media?parent=32226"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/opstree.com\/blog\/wp-json\/wp\/v2\/categories?post=32226"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/opstree.com\/blog\/wp-json\/wp\/v2\/tags?post=32226"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}