Every cloud cost review we run finds the same five categories of waste. The mix differs; the categories are stable. Across the last twelve engagements — spanning AWS, Azure and a single GCP — net annual savings ran between 18% and 34% of monthly spend, with payback under three months in every case. This article is the playbook.
The pre-work that decides everything
Before we look at any bill, we insist on three things:
- Read access to the cost-management console (Cost Explorer, Cost Management, Billing), with the last twelve months available.
- A tagging baseline — at minimum, environment, service, and owner. Clients without tagging get a one-week detour to fix it; otherwise the savings plan is guesswork.
- A named technical sponsor who can action changes. Without one, the review produces a report nobody lands.
Category 1 — right-sizing
Across our engagements, 30–55% of compute is over-provisioned by more than 2× sustained utilisation. Right-sizing is the largest single lever. Two patterns:
- Static over-provisioning. VMs chosen at launch, never revisited. Trivial to fix with a right-sizing report and a maintenance window.
- Peak-justified over-provisioning. Sized for a peak that happens 2% of the time. Fix with autoscaling, scheduled scaling, or a mix.
Category 2 — commitment coverage
Reserved Instances, Savings Plans, Azure Reservations. Typical mid-market coverage on a first review: 0–40% of baseline. Our target: 60–85% of baseline, with on-demand on top for variable load. Mechanical, predictable win; 15–30% savings on covered compute.
A note on three-year commitments. For stable workloads (databases, always-on services), three-year pays off. For anything in flight — migration, re-platform, feature in flux — one-year is the right default.
Category 3 — storage lifecycles
S3, Blob Storage, Cloud Storage — every client has terabytes of data on the hottest tier that has not been read in 18 months. Lifecycle policies move this automatically to cool and archive tiers. Savings of 40–80% on the moved data. No application change; purely operational.
Category 4 — idle and forgotten resources
Every engagement finds them. Orphaned EBS volumes, idle NAT gateways in unused regions, load balancers with no targets, forgotten dev environments, snapshots from decommissioned systems. Individually small; cumulatively 3–8% of bill. A one-week cleanup campaign is almost always worth running.
Category 5 — data egress and architecture
The subtlest category. Cross-AZ traffic, cross-region replication that nobody audited, NAT gateway egress for things that could use VPC endpoints. Often requires a small architectural change, but the savings can be dramatic — we have seen 40% off a monthly bill by introducing three PrivateLink endpoints.
What a review looks like in weeks
Week 1 — instrumentation and baseline
Read-only access, tagging audit, baseline dashboards, conversation with owners about workload shape.
Week 2 — analysis
Right-sizing report, commitment coverage analysis, storage lifecycle audit, idle-resource sweep, egress map. Every finding is sized and ranked.
Week 3 — ranked plan and landing
A ranked plan — lever, saving, effort, risk, owner. We sit with the technical sponsor and land the top five immediately (usually right-sizing and commitments). The rest is scheduled.
The report, not the slideware
The client gets: a spreadsheet of every resource, its current cost, its recommended action, and the projected saving; a commitment coverage plan; a lifecycle policy YAML; a short narrative report. No 60-slide deck. The review exists to save money, not to be presented.
What we do not do
- Migration. We are not here to move you off the cloud, or between clouds, on the back of a review.
- Re-platforming. We will flag architecture opportunities but not insist on them.
- Third-party tools. Some are excellent; most mid-market estates are better served by the native billing tools plus discipline. Do not buy a tool before doing the first review.
The post-review practice
One review, one-time savings. A FinOps practice, ongoing savings. We hand over a monthly review cadence, a simple "finding register", and a discipline of reviewing commitments quarterly. Most mid-market firms don't need a FinOps team; they need a named owner, an hour a month, and a short checklist.