Cloud cost audit: where the 30–50% usually hides

The seven usual suspects

1. Non-production environments running 24×7. Staging, QA and demo instances that are used during working hours and billed for all 168 of them. Scheduling them off is often the single biggest line.
2. Instances sized for a launch that never happened. Someone provisioned for the traffic the pitch deck promised. Right-sizing against a month of real metrics is safe and immediate.
3. Databases provisioned for the peak. Managed databases are usually the largest single item on a bill and the least examined. Peaks that last minutes do not justify capacity billed by the hour.
4. Storage with no owner. Old snapshots, orphaned volumes, logs with no retention policy, backups of systems that no longer exist. It accumulates quietly and forever.
5. Egress. Data leaving the cloud is charged, and architectures that shuttle data between regions or providers pay for every trip. Sometimes the fix is a CDN; sometimes it is moving two services next to each other.
6. On-demand pricing for steady workloads. Anything that runs permanently should not be billed at the flexible rate — committed use or reserved pricing is a discount for stating the obvious.
7. Forgotten managed services. The queue, the search cluster, the analytics service enabled for a spike three quarters ago and never turned off.

How the audit runs

1. Pull a month of billing data and tag every line to a service and an owner. Anything untaggable is already a finding.
2. Compare provisioned capacity against actual utilisation, not against what someone remembers configuring.
3. List every resource with no traffic in thirty days.
4. Model committed-use pricing against the workloads that are genuinely permanent.
5. Rank everything by saving against effort and risk, then implement from the top.

What it is worth

On an account nobody has reviewed, 30–50% is a realistic range, and the first two findings usually cover the cost of the audit. On an account already managed by an experienced team, expect single digits — and that is a good outcome to confirm rather than a wasted week.

Keeping it from coming back

• A tagging policy enforced at creation, so every resource has an owner from birth.
• Budget alerts per environment, not one alert for the whole account.
• Retention policies on logs, snapshots and backups, set once.
• Non-production schedules — off in the evening, on in the morning.
• A quarterly fifteen-minute review of the top ten line items. That is the whole discipline.