In most monthly reviews, the same argument comes back: "we already cleaned up last week, why is the bill still high?" The answer is usually a set of resources that look harmless but keep billing quietly. These are the five leaks we see most often in audits.
1. The "Idle" NAT Gateway
Developers often spin up a private VPC with a NAT Gateway for a quick test. When they delete the EC2 instances, they often forget the NAT Gateway.
The Trap: AWS charges an hourly rate for NAT Gateways even if zero traffic flows through them. If you have 5 dev environments, that’s $165/month wasted on absolute silence.
2. The "Stopped" Elastic IP
Most people know that unattached IPs cost money. But did you know that an IP attached to a stopped instance also costs money?
AWS treats IPv4 addresses as a scarce resource. If you aren't using it (because your VM is off), they penalize you. Our scanner specifically checks for this "Attached-but-Stopped" state.
3. The Zombie RDS
We often find RDS instances that are "Available" (running) but haven't had a single connection in weeks. These are usually leftovers from a feature branch or a POC.
Our Solution: We query CloudWatch metrics for `DatabaseConnections`. If the max connection count is 0 for 7 days, it's a zombie. Kill it.
4. Old AMIs & Snapshots
Every time your CI/CD pipeline builds a new image, it creates an AMI and a Snapshot. Fast forward a year, and you have 2,000 old images storing terabytes of data.
Manual cleanup is terrifying because you might delete the base image for Production. Cloud Waste Scanner cross-references running instances to ensure we never touch an active AMI.
5. The Low-Traffic EC2
Just because an instance is "Running" doesn't mean it's useful. We frequently see `m5.large` instances with 0.1% CPU utilization.
Simple scripts miss these because they read state, not behavior. We correlate low CPU and low network activity to catch machines that are technically alive but operationally empty.
How to use this list
Use these five checks as a monthly review baseline, then confirm each item with exports the team can actually discuss. A useful review is not a tour of the bill. It is a short list of findings that somebody can close.
For deeper root-cause patterns behind these checks, read Deep FinOps Anatomy. If you want incident-style examples for team onboarding, use Cloud Waste Horror Stories.