AWS Builder Center

Builder Center

Your Cloud Bill Is Full of Zombies. Here’s How I Hunt Them Down.

Your Cloud Bill Is Full of Zombies. Here’s How I Hunt Them Down.

By Asif Muzammi AWS Community Builder (Containers) | AWS Certified Solutions Architect | CKAD

Asif

Empowering Cloud Adoption with AWS, DevOps & Kubernetes
Whether you operate on AWS, Microsoft Azure, or Google Cloud (GCP), every cloud engineer has shared that same sinking feeling on the 1st of the month:
You open your billing dashboard, expecting a quiet staging bill, only to find a shocking budget spike. The knee-jerk reaction is almost universal: "The cloud provider is overcharging me!"
As a cloud engineer and AWS Community Builder, I challenge that assumption. In most cases:
The cloud provider is not responsible for your high bill. The cloud did exactly what you asked it to do.
The bill is simply the cumulative total of everything provisioned and never cleaned up. Under the spirit of the Shared Responsibility Model, cloud providers maintain the underlying infrastructure 24/7/365, but we, as engineers, own resource lifecycle hygiene and the Cost Optimization Pillar of the Well-Architected Framework.
To be fair, a few hyperscaler defaults make this easy to miss:
  • Non-root EBS storage volumes can easily outlive the EC2 instance they were attached to.
  • Since 2024, AWS charges for all public IPv4 addresses ($0.005/hour), making unassociated Elastic IPs quiet budget drains.
  • Test VPCs and Kubernetes clusters often leave highly available NAT Gateways running in the background.
Across every cloud provider, silent budget killers known as Zombie Resources bleed organizations 24/7:
  • In AWS: Idle VPC NAT Gateways ($32.40/mo each), detached EBS volumes ($0.08–$0.125/GB/mo), unassociated Elastic IPs ($3.65/mo each), and untagged ECR container images.
  • In Azure: Orphaned Managed Disks and unattached Static Public IPs lingering post-VM deletion.
  • In Google Cloud: Dangling Persistent Disks and idle Cloud NAT gateways incurring fixed hourly tariffs.


Where the Quiet Waste Hides

Zombie Resource
Typical Cost (us-east-1)
How It Happens
Orphaned EBS Volume
~$0.08 / GB-mo (gp3) → 100 GB is ~$8.00/mo
EC2 instance terminated, but non-root attached volume is retained
Idle VPC NAT Gateway
~$0.045 / hour → ~$32.40/mo (+ data fees)
EKS cluster, ECS VPC, or test environment deleted, but NAT left behind
Unassociated Elastic IP
$0.005 / hour → ~$3.65/mo
Public IPv4 allocated and forgotten (billed since 2024 IPv4 pricing update)
Untagged Dangling ECR Images
~$0.10 / GB-mo
CI/CD container pipelines pushing layers without automated lifecycle policies
Note: Prices vary by region and change over time. Always verify against official AWS pricing pages.
None of these look terrifying in isolation. But multiply them across multiple regions, multiple staging/dev accounts, and 12 billing cycles, and they quickly become a substantial line item that nobody owns.
The problem is not the cloud: Fast-moving development teams lack a simple, safe way to audit lifecycle hygiene regularly.


Why Start with AWS?

While cloud financial waste is an industry-wide epidemic across all hyperscalers, as an AWS Community Builder (Containers), I decided to solve this problem for the ecosystem I know and love the most: The AWS Community.
My goal was simple:
Build a zero-knowledge, 100% read-only waste auditor that any engineer can run in under 30 seconds with zero security friction.
That is how CostGuard Cloud (AWS Edition) 🛡️ was born.


The Zero-Trust Architecture: Why Engineers Love It

Most FinOps tools suffer from massive onboarding friction. They require intrusive SaaS agents, long sales calls, or write access to your cloud account.
CostGuard is built on four core architectural principles:

1. Audit, Don't Destroy (Human in the Loop)

CostGuard never auto-deletes anything. It identifies dormant resources and outputs the exact, reviewable AWS CLI remediation commands so a human engineer remains in full control.

2. Strictly Read-Only (Mathematical Safety)

CostGuard relies exclusively on AWS  Describe*  and  Get*  APIs (or the AWS-managed SecurityAudit  policy). It has zero delete or modify permissions.

3. All You Need is Docker (Zero Dependencies)

No Python virtual environments, no pip installs, and no local dependency conflicts. If you have Docker running (Linux, macOS, or Windows), you can run a complete multi-region audit with a single command.

4. Local & Transparent (Zero Telemetry)

The audit runs locally on your machine, produces zero telemetry (no external analytics pings), and the source code is 100% open for you to inspect.


30-Second Quickstart

If you have Docker and your AWS CLI configured, run:
Bash
docker run --rm -it \
  -v ~/.aws:/root/.aws:ro \
  -v $(pwd)/costguard-report:/app/output \
  ghcr.io/asifmuzammil/costguard:latest scan

💡 A Note on  :ro : The  :ro  flag mounts your  ~/.aws  folder in strictly read-only mode, ensuring the container cannot modify your credential files at the OS level. However, read-only does not mean unreadable. If you are security-conscious, use the disposable identity pattern below.


"Paranoid Mode": A Disposable Read-Only Identity

Don't want to mount your everyday credentials? Create a temporary, disposable IAM user with AWS's official  SecurityAudit  policy, run the scan, and tear it down completely:

1. Create a disposable read-only IAM user

Bash
aws iam create-user --user-name costguard-audit
aws iam attach-user-policy --user-name costguard-audit
--policy-arn arn:aws:iam::aws:policy/SecurityAudit
aws iam create-access-key --user-name costguard-audit

2. Save the returned keys into a temporary profile

aws configure --profile costguard-audit
Bash
3. Run the 30-second audit
docker run --rm -it
-v ~/.aws:/root/.aws:ro
-v $(pwd)/costguard-report:/app/output
ghcr.io/asifmuzammil/costguard:latest scan --profile costguard-audit

4. Clean up completely (Zero footprint left behind)

Bash
aws iam delete-access-key --user-name costguard-audit --access-key-id<ACCESS_KEY_ID>
aws iam detach-user-policy --user-name costguard-audit
--policy-arn arn:aws:iam::aws:policy/SecurityAudit
aws iam delete-user --user-name costguard-audit
Finally, remove [costguard-audit] from your ~/.aws/credentials file


The Deliverable: Instant Executive Report

In under 30 to 60 seconds, CostGuard delivers:
  1. Real-Time Terminal Output: A clear, colorized breakdown of wasted resources, monthly cost penalties, and 1-click CLI remediation commands.
  1. Interactive HTML Dashboard: Saved locally in  ./costguard-report/index.html . It features clean charts, cost summaries, and an Export / Print to PDF option that engineers can hand directly to their CTO or engineering manager.
(Cost figures are conservative estimates designed to help you prioritize cleanup, not an official AWS invoice).

How CostGuard Differs from Native AWS Tools

AWS provides powerful built-in tools like AWS Cost Explorer, Compute Optimizer, and AWS Trusted Advisor.
However, many of Trusted Advisor's actionable cost optimization checks require a Business or Enterprise Support plan (which starts at $100+/month minimum). CostGuard Cloud brings that visibility to every developer, freelancer, startup, and sandbox account for 100% free with zero setup inside the account.

The Roadmap: Multi-Cloud is Coming 🚀

While Version 1.0 is engineered specifically for AWS workloads, the name is CostGuard Cloud for a reason. Scanners currently in active development include:
  • Azure Edition: Orphaned Managed Disks, Unassociated NICs, Idle App Service Plans.
  • GCP Edition: Unused Persistent Disks, Idle Cloud NATs, Unattached Static IPs.

Try It Today on Your AWS Account

CostGuard Cloud is 100% free, open-source, and has zero telemetry.

Bash
docker run --rm -it \
  -v ~/.aws:/root/.aws:ro \
  -v $(pwd)/costguard-report:/app/output \
  ghcr.io/asifmuzammil/costguard:latest scan
Test it on your sandbox or staging account today, and drop a comment below with how much monthly waste you uncovered! A star on GitHub helps other cloud engineers discover it. ⭐

Connect with Me




What are your thoughts?

What are your favorite ways to audit cloud waste? Drop a comment below with your strategies, or let me know if you would like me to share a breakdown of the AWS tags and IAM permissions used.
# cost-savings# cost-control-automation# shared-responsibility# aws-cloud-financial-management# finops
Any opinions in this article are those of the individual author and may not reflect the opinions of AWS.
Enjoyed reading this content? Let the author know!

Your likes, comments, shares, and saves help creators reach more builders.

Loading recommendations

Loading article