AWS cost optimization: find the waste, then the fix

• unused_ec2Starter
  Checks for EC2 instances running at under 5% average CPU over 14 days — running, billed, and doing effectively nothing.
• oversized_ec2Starter
  Checks for EC2 instances whose sustained CPU and memory utilisation is low enough to right-size to a smaller instance type.
• ec2_stopped_with_ebsStarter
  Checks for stopped EC2 instances that are still billing for their attached EBS volumes — compute is off, storage is not free.
• ec2_on_demand_convertiblePro
  Checks for steady-state on-demand instances running longer than 30 days that would be cheaper on a Reserved Instance or Savings Plan.
• lambda_unusedPro
  Checks for Lambda functions with zero invocations in 30 days — dead code still carrying storage and configuration overhead.

• unused_ebsStarter
  Checks for unattached EBS volumes — provisioned, billed by the GB-month, and attached to nothing.
• gp2_to_gp3_ebsMax
  Checks for gp2 EBS volumes that would deliver the same performance at lower cost as gp3.
• old_snapshotsStarter
  Checks for EBS snapshots older than 90 days that are likely stale and quietly accumulating storage cost.
• old_amisStarter
  Checks for AMIs older than 180 days whose backing snapshots keep billing long after the image is used.
• ebs_iops_wastePro
  Checks for io1/io2 volumes whose peak IOPS stays under 50% of what is provisioned — you are paying for headroom you never use.
• s3_incomplete_multipartStarter
  Checks for incomplete multipart uploads older than 7 days — orphaned upload parts that keep billing until a lifecycle rule aborts them.
• cloudwatch_expensive_logsPro
  Checks for CloudWatch log groups larger than 5 GB with no retention policy — ingestion and storage cost that grows without bound.
• ecr_no_lifecycleMax
  Checks for ECR repositories with no lifecycle policy, so untagged and superseded image layers accumulate indefinitely.

• idle_nat_gwStarter
  Checks for NAT gateways passing under 1 GB in 30 days — an hourly charge for a gateway carrying almost no traffic.
• unattached_eipStarter
  Checks for Elastic IPs that are allocated but not associated — AWS bills an unattached EIP by the hour.
• data_transfer_cross_regionMax
  Checks for cross-region VPC peering carrying meaningful data transfer, where a same-region design would avoid the inter-region rate.

• idle_rdsStarter
  Checks for RDS instances with zero database connections over 7 days — a live, billed database nobody is talking to.
• oversized_rdsStarter
  Checks for RDS instances whose sustained CPU and memory are low enough to right-size to a smaller class.
• rds_idle_connectionsPro
  Checks for RDS instances whose peak connection count stays under 5 over 14 days — over-provisioned for the load they carry.
• rds_multi_az_devMax
  Checks for Multi-AZ RDS in non-production environments, where the standby doubles cost for redundancy dev/test rarely needs.
• elb_idlePro
  Checks for load balancers serving under 100 requests per day over 7 days — an hourly charge for a balancer with almost no work.
• idle_elbMax
  Checks for load balancers with effectively no traffic over 30 days — a stronger idle signal for cleanup.
• idle_elasticache_clusterMax
  Checks for ElastiCache clusters with effectively no connections over 30 days — a billed cache serving nothing.
• elasticache_reserved_unusedMax
  Checks for ElastiCache reserved nodes with no matching running node — a commitment you are paying for but not consuming.
• unused_security_groupsStarter
  Checks for security groups referenced by nothing — no cost by themselves, but the housekeeping signal of drift and orphaned infrastructure.

• no_savings_planMax
  Checks for steady compute spend with no active Savings Plan, where a commitment would discount usage you are already paying full on-demand rates for.
• ri_underutilizationMax
  Checks for Reserved Instances used under 80% — a prepaid commitment burning off without matching usage.
• untagged_cost_ownerPro
  Checks for resources with no owner or cost-allocation tag, so spend cannot be attributed and orphaned resources hide.
• s3_request_pricingMax
  Checks for S3 buckets serving more than a million requests per day, where request-tier pricing or a caching layer may cut the bill.

• bedrock_provisioned_throughput_burnMax
  Checks for a Bedrock Provisioned Throughput running with no commitment term — billed hourly at the full rate whether or not the model is invoked.
• rag_vector_store_costMax
  Checks for a Bedrock knowledge base on OpenSearch Serverless paying the minimum-OCU floor, where a smaller-footprint vector store is usually far cheaper.
• idle_sagemaker_endpointMax
  Checks for a SageMaker real-time endpoint with almost no invocations over 30 days — billed 24/7 for compute it barely uses.

• connectA read-only IAM role with an ExternalId — the same connection every CloudArq audit uses. No keys to paste, no agents to install.
• storeCloudArq never stores your credentials, application data, database contents, or S3 objects. The audit reads configuration and CloudWatch metrics, nothing more.
• estimateEach finding’s potential monthly cost is estimated live from that resource’s own AWS metadata and the relevant public price — grounded in your configuration, not a precomputed global figure.
• fixDetection plus the remediation steps — never auto-fix. Each finding shows the exact CLI command or console path; you apply the change and stay in control.
• no-capNo spend cap and nothing is ever stopped or throttled. CloudArq surfaces the waste and the fix; it never risks your workloads with a hard stop.

Illustrative only — sample rows, not a real account; the est. column is masked. Each real finding shows a per-resource estimate and ships with remediation steps.