← All articles

Advanced Cloud Cost Optimization Strategy Teams Miss

Why a tag‑driven automation strategy matters

Most engineering and platform teams treat tags as a reporting afterthought. They add a few cost‑allocation tags, run a monthly report, and assume the rest of the bill is under control. In reality, tags can be the trigger for real‑time, automated remediation of idle or oversized resources. By coupling a strict tagging policy with AWS Config rules and Lambda functions, you create a feedback loop that continuously discovers waste, takes corrective action, and records the dollar impact. The result is a self‑healing environment where cost‑inefficiencies disappear before they appear on the invoice.

Build a tagging foundation that fuels cost control

A reliable automation pipeline starts with a consistent tagging schema. The schema should be enforced at creation time, stored in a central document, and include at least the following keys:

• Environment – prod, stage, dev
• Owner – IAM user or team name
• CostCenter – internal chargeback code
• AutoShutdown – true or false (indicates whether the resource can be stopped outside business hours)
• RetentionDays – numeric value for temporary resources (e.g., test instances, snapshots)

Step‑by‑step: enforce tags with Service Catalog

1. Open the AWS Service Catalog console.
2. Create a Portfolio for each environment (Prod, Stage, Dev).
3. Under Products, add a launch constraint that references an IAM role with the aws:RequestTag/${TagKey} condition.
4. In the TagOptions tab, define the required keys listed above.
5. Associate the portfolio with the appropriate AWS accounts.

When a user launches an EC2 instance, RDS database, or EFS file system through Service Catalog, the console will refuse the request unless all required tags are supplied. For resources created outside Service Catalog (e.g., via CloudFormation), you can still enforce tags using AWS Config (see next section).

Detect cost‑inefficient resources with AWS Config Rules

AWS Config continuously records the configuration of supported resources and can evaluate custom rules written in Lambda. The following built‑in rules are useful out of the box:

• required-tags – ensures every resource has the mandatory tag set.
• ec2-instance-managed-by-ssm – helps you identify instances that can be controlled via SSM.
• rds-instance-public-access-check – flags publicly accessible databases.

Create a custom rule to spot idle compute

Below is a minimal Lambda function that checks EC2 instances for low CPU utilization over the past 7 days. If the average CPU is below 5 % and the AutoShutdown tag is true, the rule marks the resource NON_COMPLIANT.

import boto3, datetime, json

def lambda_handler(event, context):
    ec2 = boto3.client('ec2')
    cloudwatch = boto3.client('cloudwatch')
    evaluation_results = []
    now = datetime.datetime.utcnow()
    start = now - datetime.timedelta(days=7)
    # List all instances with the AutoShutdown tag set to true
    filters = [{"Name": "tag:AutoShutdown", "Values": ["true"]}]
    reservations = ec2.describe_instances(Filters=filters)['Reservations']
    for reservation in reservations:
        for instance in reservation['Instances']:
            instance_id = instance['InstanceId']
            metrics = cloudwatch.get_metric_statistics(
                Namespace='AWS/EC2',
                MetricName='CPUUtilization',
                Dimensions=[{'Name':'InstanceId','Value':instance_id}],
                StartTime=start,
                EndTime=now,
                Period=86400,
                Statistics=['Average']
            )
            avg_cpu = sum(p['Average'] for p in metrics['Datapoints']) / len(metrics['Datapoints']) if metrics['Datapoints'] else 0
            compliance_type = 'NON_COMPLIANT' if avg_cpu < 5 else 'COMPLIANT'
            evaluation_results.append({
                'ComplianceResourceType': 'AWS::EC2::Instance',
                'ComplianceResourceId': instance_id,
                'ComplianceType': compliance_type,
                'Annotation': f'Average CPU {avg_cpu:.1f}% over 7d'
            })
    config = boto3.client('config')
    config.put_evaluations(
        Evaluations=evaluation_results,
        ResultToken=event['resultToken']
    )
    return {'statusCode': 200}

Deploy the rule

1. Save the code as idle-ec2-detector.zip (include any dependencies).
2. In the AWS Config console, choose Rules → Add rule.
3. Select Custom Lambda rule, give it a name like idle-ec2-detector, and upload the zip.
4. Set the Trigger type to Configuration changes and Periodic (7‑day interval).
5. Choose the IAM role that grants ec2:DescribeInstances, cloudwatch:GetMetricStatistics, and config:PutEvaluations.

AWS Config will now flag any instance that meets the idle criteria, providing a reliable source of truth for the next remediation step.

Remediate automatically with Lambda and EventBridge

Once Config marks a resource as NON_COMPLIANT, you can automatically remediate it. The typical remediation actions are:

• Stop idle EC2 instances.
• Delete unattached EBS volumes older than RetentionDays.
• Snapshot and delete old RDS snapshots.
• Release unused Elastic IPs.

Example: Lambda that stops idle instances

import boto3, json

def lambda_handler(event, context):
    ec2 = boto3.client('ec2')
    for record in event['detail']['configurationItemDiff']:
        if record['changeType'] == 'NON_COMPLIANT' and record['resourceType'] == 'AWS::EC2::Instance':
            instance_id = record['resourceId']
            ec2.stop_instances(InstanceIds=[instance_id])
            print(f'Stopped idle instance {instance_id}')
    return {'statusCode': 200}

Wire the Lambda to EventBridge

1. Open the Amazon EventBridge console.
2. Create a Rule named AutoStopIdleEC2.
3. Set the Event pattern to match Config NON_COMPLIANT findings: json { "source": ["aws.config"], "detail-type": ["Config Rules Evaluation Result"], "detail": {"newEvaluationResult": {"complianceType": ["NON_COMPLIANT"]}, "resourceType": ["AWS::EC2::Instance"]} }
4. Choose the Lambda function from the previous step as the target.
5. Enable the rule.

With this pipeline, any EC2 instance that stays idle for a week will be stopped automatically, without human intervention.

Cleaning up other resources

You can reuse the same pattern for EBS volumes, snapshots, and Elastic IPs. The key is to read the RetentionDays tag (if present) and compare it to the resource's creation date. Below is a snippet for deleting old, unattached EBS volumes:

import boto3, datetime

def clean_volumes(event, context):
    ec2 = boto3.client('ec2')
    now = datetime.datetime.utcnow()
    vols = ec2.describe_volumes(Filters=[{'Name':'status','Values':['available']}])['Volumes']
    for vol in vols:
        tags = {t['Key']: t['Value'] for t in vol.get('Tags', [])}
        retention = int(tags.get('RetentionDays', '0'))
        create_time = vol['CreateTime'].replace(tzinfo=None)
        age = (now - create_time).days
        if retention and age > retention:
            ec2.delete_volume(VolumeId=vol['VolumeId'])
            print(f'Deleted volume {vol["VolumeId"]} after {age} days')
    return {'statusCode': 200}

Deploy this function the same way as the EC2 stopper and trigger it on a scheduled EventBridge rule (cron(0 2 * * ? *)) to run nightly.

Quantify savings and iterate

Automation is only valuable if you can see the dollar impact. Follow these steps after the first week of remediation:

1. Export Config findings – In the AWS Config console, choose Resources → Export and download a CSV of NON_COMPLIANT resources.
2. Run the free AWS waste finder – Visit the free AWS waste finder and upload the CSV. The tool parses the list, matches each resource to its pricing API, and returns an estimated monthly waste amount.
3. Record baseline vs. post‑automation – Store the numbers in a simple spreadsheet or a Cost Explorer custom report. Look for trends such as “stopped instances saved $X per month”.
4. Adjust thresholds – If you notice that stopping instances after 7 days is too aggressive, change the Config rule period to 14 days.
5. Close the loop – Add a weekly Slack notification (via an EventBridge target) that posts the latest waste report. This keeps the team aware and encourages continuous improvement.

By turning raw configuration data into a clear monetary figure, you can justify the engineering effort and prioritize further optimizations.

Comparison of cleanup approaches

The table shows why the tag‑driven strategy, despite a larger upfront investment, delivers the most consistent, automated savings.

Frequently asked questions

How do I avoid accidentally stopping production instances?

Include the AutoShutdown tag set to false on any resource that must stay running. Your Config rule should filter on AutoShutdown = true before marking an instance as NON_COMPLIANT.

Can this strategy work for serverless services like Lambda?

Serverless functions are billed per‑invocation, so idle time is not a cost driver. However, you can still tag functions and use Config to enforce reserved concurrency limits that prevent over‑provisioning.

What IAM permissions are required for the Lambda remediation functions?

At minimum: ec2:StopInstances, ec2:DeleteVolume, rds:DeleteDBSnapshot, elasticloadbalancing:DeregisterTargets, config:PutEvaluations, and read‑only ec2:Describe*, rds:Describe*, cloudwatch:GetMetricStatistics.

Is there a risk of data loss when automatically deleting snapshots?

Only delete snapshots that have a RetentionDays tag indicating they are temporary. Keep long‑term backups untagged or tagged with a high retention value.

Key takeaways

• A strict, organization‑wide tagging schema is the cornerstone of automated cost control.
• AWS Config rules provide a reliable source of truth for idle or mis‑tagged resources.
• Lambda functions triggered by EventBridge can remediate waste in real time without manual steps.
• Exporting Config findings to the free AWS waste finder turns technical data into clear dollar savings.
• Compared with manual audits or generic SaaS tools, tag‑driven automation yields higher savings and lower ongoing effort.

By implementing this strategy, teams turn cost optimization from a periodic chore into a continuous, self‑correcting process. To see the approach in action, try the free AWS waste finder and then create a free account to let CloudBudgetMaster automate the detection of idle and wasted resources. Today the platform scans AWS in read‑only mode and reports the dollar impact of each idle asset; support for GCP, Azure and Snowflake is coming soon.