How it happens
An environment is spun up for a load test and never torn down. A database is sized for a launch spike that never came. Logs are retained forever because seven days felt risky and nobody chose a number. A NAT gateway quietly charges for traffic that could have gone through a VPC endpoint.
Each decision was reasonable. Nobody revisited any of them.
The afternoon review
We run this on every engagement we inherit, and it usually pays for itself the same day.
Tag everything, then group by tag. If you cannot attribute 90% of spend to a service or a team, that is the first problem, not the bill.
Find the environments nobody owns. Staging clusters, old preview deployments, forgotten snapshots. Ask in a channel: "we are deleting this on Friday unless someone objects."
Look at data transfer separately. Egress and cross-AZ traffic are the line items people forget exist, and the architecture change that fixes them is often small.
Check retention on everything that accumulates. Logs, metrics, backups, object versions. Choose a number deliberately, per system.
Right-size after measuring, not before. Instances chosen at launch are almost never the right size six months in — in either direction.
Make it visible where decisions happen
The lasting fix is not the audit; it is showing cost at the moment someone chooses an architecture. A rough monthly figure in the architecture document changes conversations. "This design costs about $1,800 a month, this one about $400" is a discussion a team can have.
Without that number, cost is only ever discovered afterwards — usually by finance, usually as a surprise.
What not to do
Do not chase savings that cost more engineering time than they return. Cutting $30 a month by migrating a service is a hobby, not a project. Fix the big line items, set retention deliberately, and go back to building.