Day two of the audit: CloudWatch went from $2,400 to $380

Continuing from where we left off with the B2B SaaS account

Day three: we started making changes. We had the map. We had the findings. We had write access. We had a rollback plan for each change and a monitoring window defined in advance

First change: delete the unused OpenSearch cluster

Confirmed with the CTO that nobody was using it and nobody planned to use it. Deleted. Immediate: $800 a month gone

Second change: set retention policies on CloudWatch log groups

43 log groups. Most had no retention policy. We set 30 days on application logs, 90 days on infrastructure logs, 365 days on audit logs. Deleted three log groups receiving data from services that no longer existed. Reduced the data volume on two log groups by changing log levels from debug to info

CloudWatch went from $2,400 to $380 a month

Third change: RDS rightsizing

Two of the three RDS instances were running at under 20 percent CPU and under 30 percent memory. We moved both from db.r5.2xlarge to db.r5.large. Scheduled maintenance windows, ran the resize, monitored for 48 hours each

No issues. RDS went from $3,100 to $1,400 a month

Fourth change: S3 lifecycle policies

Set up policies across 11 buckets. Objects over 90 days old move to Standard-IA. Objects over 365 days old move to Glacier Instant Retrieval. Two buckets containing data that hadn't been accessed in two years moved entirely to Glacier Deep Archive

S3 went from $1,100 to $420 a month

End of week one. No EC2 changes yet. No data transfer work yet

Already saved: $5,100 a month from four changes

The CTO was quiet for a moment when I showed him the numbers. Then he said: why has nobody looked at this before?

I didn't have a good answer. It's the same account I see everywhere. Not neglect. Not incompetence. Just nobody whose job it was to look