A $12,000 Monthly AWS Bill Cut in Half Within One Month
A client's AWS bill reached $12,000 per month while CPU utilization on most instances stayed below 5%. Cost Explorer revealed anomalies: an EC2 m5.4xlarge running at 3% CPU for six months, an RDS db.r5.2xlarge without Read Replica handling only 12 concurrent connections out of 5000, and a NAT Gateway for outbound traffic costing $2,000 monthly because S3 calls went through it instead of a VPC Gateway Endpoint. This is not a fictional scenario — this is how infrastructures look when they grow organically without architectural oversight. We are a team of certified AWS engineers with 10+ years of experience and 50+ successful projects, offering comprehensive AWS cloud technologies services from audit to implementation. Our experience shows that after a comprehensive audit and implementation of recommendations, typical savings range from 40–60% off the current bill. Contact us to assess your project within two days.
How IAM Becomes a Vulnerability and What to Do About It
IAM is the most underestimated part of AWS. AdministratorAccess for all developers and ACCESS_KEY_ID in .env files — classic scenarios that end in an incident or unexpected billing. Instead of key-based users, we use Roles. EC2 gets temporary credentials via Instance Profile (metadata service) — no persistent keys. For EKS — IRSA: the pod gets AWS permissions through a ServiceAccount annotation, without storing credentials in Secrets:
apiVersion: v1 kind: ServiceAccount metadata: name: s3-reader annotations: eks.amazonaws.com/role-arn: arn:aws:iam::123456789:role/s3-read-role A pod with this ServiceAccount automatically receives a temporary token for the s3-read-role, which rotates every 15 minutes.
Permission Boundaries — a limiter for developers who create their own IAM roles (e.g., for Lambda). The boundary profile sets a ceiling on permissions: even if a developer creates a role with AdministratorAccess, actual rights are limited by the boundary.
SCPs in AWS Organizations block actions at the account level. Prohibiting resource creation outside specific regions — no user or role can launch an instance in ap-southeast-1, even with AdministratorAccess. Prohibiting CloudTrail disabling, mandatory MFA for root — all configured for the client. The entire IAM audit and least privilege enforcement takes 3–5 days.
Why Does AWS Bill Spike Unexpectedly?
Unexpected spikes usually come from three sources: orphaned resources (unused EBS volumes, Elastic IPs), data transfer costs (especially NAT Gateway egress), and overprovisioned instances. A common pattern: a developer launches a test environment and forgets to terminate it. Without proper tagging and Cost Explorer alerts, these costs accumulate silently. Our audit identifies all such leaks and provides a prioritized remediation plan.
Why Karpenter Is Better Than Cluster Autoscaler
EKS — managed Kubernetes on AWS. Control plane managed by AWS, you pay per hour per cluster plus nodes. Worker nodes are regular EC2 or Fargate.
Cluster Autoscaler works through Auto Scaling Groups, takes 3–5 minutes to make decisions, and does not efficiently select instance types. Karpenter rewrites the scenario: it watches pending pods, analyzes requests, selects the optimal instance type via EC2 Fleet API, and launches a node in 30–60 seconds. Configuration via NodePool and EC2NodeClass:
apiVersion: karpenter.sh/v1 kind: NodePool metadata: name: default spec: template: spec: requirements: - key: karpenter.sh/capacity-type operator: In values: ["spot", "on-demand"] - key: node.kubernetes.io/instance-type operator: In values: ["m5.xlarge", "m5.2xlarge", "m6i.xlarge", "m6i.2xlarge"] limits: cpu: "200" disruption: consolidationPolicy: WhenEmptyOrUnderutilized consolidateAfter: 1m consolidationPolicy: WhenEmptyOrUnderutilized — actively consolidates load: moves pods to fewer nodes and deletes empty ones. This directly impacts the bill. For production workloads, we use a mix of spot/on-demand via weighted NodePools: 70% spot, 30% on-demand. Spot is interrupted by AWS with a 2-minute warning — handled via PodDisruptionBudget and graceful shutdown.
RDS: Performance and Availability
Multi-AZ — synchronous replication to a standby in another AZ. Failover automatic, 60–120 seconds. Not to be confused with Read Replica: Multi-AZ for HA, Read Replica for read offloading.
Parameter Group — custom engine parameters. For PostgreSQL: max_connections, shared_buffers, work_mem, checkpoint_completion_target. RDS does not provide direct access to postgresql.conf — everything via Parameter Group. Changes to static parameters require instance reboot (maintenance window).
RDS Proxy solves connection pooling for serverless workloads. Lambda functions opening thousands of connections to the database under scale — RDS Proxy aggregates them into a pool. Especially critical for Aurora Serverless.
Performance Insights — built-in query analysis tool. Shows top 10 SQL by db load, wait events (cpu, io, lock). Cheaper and faster than manual pg_stat_statements setup.
S3: Not Just Storage
VPC Gateway Endpoint for S3 — traffic between EC2/EKS and S3 goes through AWS internal network, bypassing NAT Gateway. Creating a Gateway Endpoint is free, saves significant amounts at high volumes. Same for DynamoDB.
S3 Lifecycle Policies — automatic movement of objects between storage classes:
| Object Age | Storage Class | Savings vs Standard |
|---|---|---|
| Fresh data | S3 Standard | – |
| 30+ days | S3 Infrequent Access | 40% |
| 90+ days | S3 Glacier Instant Retrieval | 68% |
| 365+ days | S3 Glacier Deep Archive | 95% |
For backups and logs, a proper lifecycle policy pays for itself in the first month.
S3 Object Lock (WORM) — for compliance requirements. When Compliance mode is enabled, not even the root user can delete an object before the retention period expires.
Lambda and Event-Driven Architecture
Lambda is suitable for tasks with unpredictable or low RPS: S3 event processing, SQS triggers, scheduled tasks via EventBridge. At sustained loads above 1M invocations/month — ECS or EKS is cheaper.
Cold start — Lambda's main pain point. For Python/Node.js — 100–500ms, for Java — up to 3 seconds. Mitigations:
- Provisioned Concurrency — keeps N instances "warm" (costs money)
- Snap Start (Java) — saves a snapshot of the initialized function
- Lambda SnapStart on Java 21 functions — cold start <1 second
Lambda Layers — for reusable dependencies. A layer with numpy/pandas shared across functions, reduces deployment package size, cached in execution environment.
CloudFront: CDN and More
Origin Shield — intermediate cache between CloudFront PoPs and origin. Reduces origin load for a global audience: request goes PoP → Origin Shield → Origin, instead of each PoP contacting origin separately.
CloudFront Functions vs Lambda@Edge — the former executes at viewer request/response, latency <1ms, limited JavaScript runtime — suitable for URL rewrites, header manipulation, A/B redirects. The latter — full Lambda at origin request/response, allowing access to DynamoDB and other AWS services for personalization.
WAF on CloudFront — blocking at CDN level. Managed rules from AWS (OWASP Top 10, known bad inputs) plus custom rules for IP, rate limiting, geo-blocking.
How to Reduce AWS Costs Without Performance Loss?
A typical optimization audit pays for itself within the first month. Below is a step‑by‑step approach we use:
- Analyze Cost Explorer and Trusted Advisor to identify idle resources, oversized instances, and data transfer spikes.
- Eliminate orphaned resources — unattached EBS volumes, unused Elastic IPs, stale snapshots.
- Right‑size EC2 and RDS instances based on actual utilization metrics.
- Implement Savings Plans (1‑ or 3‑year) or Reserved Instances for predictable workloads.
- Configure auto‑scaling and Karpenter for dynamic bin‑packing and spot instance usage.
- Set up S3 Lifecycle Policies and VPC Endpoints to slash storage and network costs.
- Monitor with budgets and alerts to prevent future drift.
Typical savings after our intervention:
| Method | Typical Savings |
|---|---|
| Spot Instances for stateless workloads | 60–80% vs on‑demand |
| Savings Plans (1–3 years) | 30–66% vs on‑demand |
| Reserved Instances for RDS | 40–60% vs on‑demand |
| S3 Lifecycle Policies | 40–90% for cold data |
| VPC Endpoints (S3, DynamoDB) | Eliminates NAT Gateway costs |
| Karpenter bin‑packing | 20–40% on EC2 |
We provide a transparent report with priorities and timelines. Get a consultation to start saving.
What Our Services Include (Deliverables)
- Complete infrastructure audit based on the Well‑Architected Framework (IAM, network, EKS, RDS, S3, Lambda, CloudFront) — documented with AWS Well‑Architected Tool findings.
- Architecture design that balances security, performance, and cost.
- Turnkey implementation using Terraform/Ansible, GitOps, and CI/CD pipelines, handed over with full documentation.
- Runbook, diagrams, and operational procedures.
- Team training and access transfer (AWS Organization, Terraform state).
- 30‑day guarantee on implemented changes — if something goes wrong, we fix it for free.
Example from practice: a client with a $12,000 monthly bill. After audit and implementation of VPC Endpoint, Karpenter, S3 Lifecycle, and Reserved Instances, the bill dropped to $6,000 within one month. Order the same result — contact us via email or the form on our website for a consultation on your AWS infrastructure.
Typical Timelines and How to Order
| Task | Timeline |
|---|---|
| IAM audit and least privilege enforcement | 3–5 days |
| EKS cluster with Karpenter | 1–2 weeks |
| RDS HA configuration with monitoring | 3–5 days |
| CloudFront + WAF for production | 2–4 days |
| Cost optimization audit + implementation | 1–3 weeks |
| Full AWS architecture from scratch | 4–10 weeks |
Pricing is calculated individually after an audit of your infrastructure. To get a project estimate, contact us — you send Cost Explorer data and current configs, and we propose a plan and accurate estimate. Get a consultation right now — write to us or order a comprehensive AWS audit today.