When an AWS bill looks too high, the first instinct is to shrink the servers. In my experience, server size is rarely the main problem. These are the things a proper audit usually finds first, and several of them are risks as well as costs.
1. End-of-life software with a support surcharge
Managed databases on old engine versions can move onto paid extended support. The instance looks the same and keeps working, but the bill quietly goes up. Check the engine version of every RDS instance against AWS’s support calendar. Upgrading usually removes the charge and gets you a supported, faster version, but plan it: the application decides how far you can go, so test on staging first.
2. Things nobody switched off
- Retired websites still running on their own instances.
- Orphaned databases, snapshots and unattached storage volumes.
- Old environments created for a project and never removed.
Before deleting anything, prove it’s unused: when it last saw real data activity, whether any DNS still points at it, and whether anything connects to it. Take a final backup, then remove it.
3. Staging sized like production
Staging needs to behave like production, not to have the same capacity. It is often the easiest right-sizing win, and it can usually be scheduled to scale down out of hours.
4. Environments that aren’t really separate
This is the one that matters most. A staging deployment configured against the production database means testing can change live data. It’s a risk, not just a configuration oddity, and it should be fixed before anything else.
5. Old instance generations
Newer instance families are often faster for the same price or cheaper for the same performance. Moving to a current generation is usually a low-risk change during a maintenance window.
How I run an audit
- Start from the bill: Cost Explorer grouped by service and usage type shows where the money actually goes.
- List every resource in every region in use, and match each one to an owner and a purpose.
- Collect evidence for each finding (dates, metrics, DNS), so recommendations are facts, not opinions.
- Order the recommendations by risk first, then cost, and include how each one will be tested and rolled back.
The best outcome of an audit isn’t only a smaller bill. It’s an account you understand, where everything running has a reason to be there.
