Right-Size EBS Volume and Save Money 💸

# modules/ebs-monitor/main.tf

resource "aws_lambda_function" "ebs_analyzer" {
filename = data.archive_file.analyzer.output_path
function_name = "ebs-rightsizing-analyzer"
role = aws_iam_role.analyzer.arn
handler = "index.handler"
runtime = "python3.12"
timeout = 300
source_code_hash = data.archive_file.analyzer.output_base64sha256

environment {
variables = {
SNS_TOPIC_ARN = aws_sns_topic.ebs_alerts.arn
LOOKBACK_DAYS = "14"
USAGE_THRESHOLD = "50" # Flag if <50% utilized
}
}
}

data "archive_file" "analyzer" {
type = "zip"
output_path = "${path.module}/analyzer.zip"

source {
content = <<-PYTHON
import boto3
import os
from datetime import datetime, timedelta

ec2 = boto3.client('ec2')
cw = boto3.client('cloudwatch')
sns = boto3.client('sns')

def get_metric_max(volume_id, metric_name, days):
"""Get max value of a CloudWatch metric over N days."""
response = cw.get_metric_statistics(
Namespace='AWS/EBS',
MetricName=metric_name,
Dimensions=[{'Name': 'VolumeId', 'Value': volume_id}],
StartTime=datetime.utcnow() - timedelta(days=days),
EndTime=datetime.utcnow(),
Period=3600,
Statistics=['Maximum']
)
points = response.get('Datapoints', [])
return max((p['Maximum'] for p in points), default=0)

def handler(event, context):
days = int(os.environ['LOOKBACK_DAYS'])
threshold = int(os.environ['USAGE_THRESHOLD'])

volumes = ec2.describe_volumes(
Filters=[{'Name': 'status', 'Values': ['in-use']}]
)['Volumes']

recommendations = []

for vol in volumes:
vol_id = vol['VolumeId']
vol_type = vol['VolumeType']
size_gb = vol['Size']
provisioned_iops = vol.get('Iops', 0)
provisioned_tp = vol.get('Throughput', 0)

# Get peak usage over lookback period
peak_read_ops = get_metric_max(vol_id, 'VolumeReadOps', days)
peak_write_ops = get_metric_max(vol_id, 'VolumeWriteOps', days)
peak_iops = (peak_read_ops + peak_write_ops) / 3600 # Convert to per-second

peak_read_bytes = get_metric_max(vol_id, 'VolumeReadBytes', days)
peak_write_bytes = get_metric_max(vol_id, 'VolumeWriteBytes', days)
peak_throughput = (peak_read_bytes + peak_write_bytes) / 3600 / 1024 / 1024 # MB/s

savings = []

# Check IOPS utilization
if provisioned_iops > 3000 and peak_iops < provisioned_iops * (threshold / 100):
recommended_iops = max(3000, int(peak_iops * 1.3)) # 30% headroom
iops_savings = (provisioned_iops - recommended_iops) * 0.005
if vol_type == 'io2':
iops_savings = (provisioned_iops - recommended_iops) * 0.065
savings.append(f" IOPS: {provisioned_iops} → {recommended_iops} (save ${iops_savings:.2f}/mo)")

# Check if io2 can downgrade to gp3
if vol_type in ('io1', 'io2') and peak_iops < 16000 and peak_throughput < 1000:
current_cost = size_gb * 0.125 + provisioned_iops * 0.065
gp3_iops = max(3000, int(peak_iops * 1.3))
gp3_cost = size_gb * 0.08 + max(0, gp3_iops - 3000) * 0.005
type_savings = current_cost - gp3_cost
if type_savings > 5:
savings.append(f" Type: {vol_type} → gp3 (save ${type_savings:.2f}/mo)")

# Check throughput utilization (gp3 only)
if vol_type == 'gp3' and provisioned_tp > 125:
if peak_throughput < provisioned_tp * (threshold / 100):
recommended_tp = max(125, int(peak_throughput * 1.3))
tp_savings = (provisioned_tp - recommended_tp) * 0.04
savings.append(f" Throughput: {provisioned_tp} → {recommended_tp} MB/s (save ${tp_savings:.2f}/mo)")

if savings:
# Get instance name
attachments = vol.get('Attachments', [])
instance_id = attachments[0]['InstanceId'] if attachments else 'detached'

tags = {t['Key']: t['Value'] for t in vol.get('Tags', [])}
name = tags.get('Name', vol_id)

recommendations.append(
f"{name} ({vol_id}) - attached to {instance_id}\n"
f" Current: {size_gb}GB {vol_type}, {provisioned_iops} IOPS\n"
f" Peak IOPS: {peak_iops:.0f}, Peak Throughput: {peak_throughput:.1f} MB/s\n"
+ "\n".join(savings)
)

if recommendations:
total_recs = len(recommendations)
message = (
f"EBS Right-Sizing Report ({total_recs} volumes need attention)\n"
f"Lookback period: {days} days\n\n"
+ "\n\n".join(recommendations)
)

sns.publish(
TopicArn=os.environ['SNS_TOPIC_ARN'],
Subject=f'EBS Right-Sizing: {total_recs} volumes over-provisioned',
Message=message
)

return {'volumes_analyzed': len(volumes), 'recommendations': len(recommendations)}
PYTHON
filename = "index.py"
}
}

# Run weekly
resource "aws_cloudwatch_event_rule" "weekly_ebs_check" {
name = "ebs-rightsizing-check"
schedule_expression = "rate(7 days)"
}

resource "aws_cloudwatch_event_target" "ebs_analyzer" {
rule = aws_cloudwatch_event_rule.weekly_ebs_check.name
arn = aws_lambda_function.ebs_analyzer.arn
}

resource "aws_lambda_permission" "allow_eventbridge" {
action = "lambda:InvokeFunction"
function_name = aws_lambda_function.ebs_analyzer.function_name
principal = "events.amazonaws.com"
source_arn = aws_cloudwatch_event_rule.weekly_ebs_check.arn
}

resource "aws_sns_topic" "ebs_alerts" {
name = "ebs-rightsizing-alerts"
}

resource "aws_iam_role" "analyzer" {
name = "ebs-rightsizing-analyzer-role"

assume_role_policy = jsonencode({
Version = "2012-10-17"
Statement = [{
Action = "sts:AssumeRole"
Effect = "Allow"
Principal = { Service = "lambda.amazonaws.com" }
}]
})
}

resource "aws_iam_role_policy" "analyzer" {
name = "ebs-rightsizing-analyzer-policy"
role = aws_iam_role.analyzer.id

policy = jsonencode({
Version = "2012-10-17"
Statement = [
{
Effect = "Allow"
Action = ["ec2:DescribeVolumes"]
Resource = "*"
},
{
Effect = "Allow"
Action = [
"cloudwatch:GetMetricStatistics"
]
Resource = "*"
},
{
Effect = "Allow"
Action = ["sns:Publish"]
Resource = aws_sns_topic.ebs_alerts.arn
},
{
Effect = "Allow"
Action = [
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents"
]
Resource = "arn:aws:logs:*:*:*"
}
]
})
}