← All articles

Advanced Cloud Cost Optimization Strategy Teams Overlook

The single tactic most teams miss: tag‑driven automated cleanup

If you want to stop paying for resources that nobody uses, the fastest way is to let the cloud clean up after itself. By combining a strict tag taxonomy, AWS Config rules, and a scheduled Lambda function you can automatically identify and terminate or snapshot idle resources, then see the dollar impact in minutes. This answer‑first intro tells you exactly why the tactic works and how to implement it step‑by‑step.

Why a tag‑driven cleanup strategy matters

• Visibility – Tags are the only native AWS attribute that can be queried across services with a single API (resourcegroupstaggingapi). Without a consistent tag set you cannot reliably separate production from test, cost‑center A from cost‑center B.
• Automation trigger – AWS Config records every configuration change. By creating custom Config rules that look for missing or stale tags you get a real‑time signal that a resource may be orphaned.
• Cost impact – An untagged EC2 instance, an unattached EBS volume, or an idle RDS instance can sit for weeks. When a Lambda function automatically stops or snapshots those resources you eliminate the recurring hourly charge without manual ticket churn.
• Auditability – Every action taken by the Lambda is logged to CloudWatch and can be exported to S3 for compliance reporting.

Prerequisites: IAM, AWS Config, Lambda, and CloudWatch

Before you start, make sure you have the following in place:

1. IAM permissions – A role that can read tags, evaluate Config rules, and invoke ec2:StopInstances, rds:ModifyDBInstance, elasticache:DeleteCacheCluster, etc. Example policy snippet: json { "Version": "2012-10-17", "Statement": [ {"Effect": "Allow", "Action": ["config:PutConfigRule","config:DescribeConfigRules"], "Resource": "*"}, {"Effect": "Allow", "Action": ["ec2:StopInstances","ec2:TerminateInstances"], "Resource": "*"}, {"Effect": "Allow", "Action": ["rds:ModifyDBInstance"], "Resource": "*"}, {"Effect": "Allow", "Action": ["lambda:InvokeFunction"], "Resource": "*"} ] }
2. AWS Config enabled – In the console go to Services → Config → Settings and enable recording for all resource types in the region you plan to clean up.
3. Lambda execution role – Attach the policy above plus AWSLambdaBasicExecutionRole.
4. CloudWatch Events (EventBridge) – You will need a rule that runs the Lambda on a schedule (daily is typical).

Step 1: Define a cost‑center tag taxonomy

A robust taxonomy is the foundation. Use two mandatory tags on every resource:

Create a tag policy to enforce the taxonomy:

aws resourcegroupstaggingapi tag-policy create --policy-name "CostCenterPolicy" \
  --policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"*","Resource":"*","Condition":{"StringNotEquals":{"aws:TagKeys":["CostCenter","Environment"]}}}]}'

If a resource is created without these tags, AWS Config will flag it (see next step).

Step 2: Enable AWS Config rules to detect untagged or stale resources

Create two custom Config rules:

1. UntaggedResourceRule – Flags any resource missing the mandatory tags.
2. StaleResourceRule – Flags resources whose LastModifiedDate is older than 30 days and whose tag Environment is not prod.

CLI example for the first rule:

aws configservice put-config-rule \
  --config-rule-name "UntaggedResourceRule" \
  --description "Detect resources missing CostCenter or Environment tags" \
  --scope "ComplianceResourceTypes=[\"AWS::EC2::Instance\",\"AWS::RDS::DBInstance\",\"AWS::EBS::Volume\"]" \
  --source "Owner=AWS,SourceIdentifier=RESOURCE_TAGS" \
  --input-parameters '{"tag1Key":"CostCenter","tag2Key":"Environment"}'

For the stale rule, use a Lambda‑backed custom rule that inspects aws:cloudformation:stack-id and the LastEventTime attribute. The Lambda code is provided in the next section.

Step 3: Build the cleanup Lambda function

The Lambda does three things:

1. Query Config – Pull the list of non‑compliant resources from the two rules.
2. Assess utilization – For EC2, call cloudwatch get-metric-statistics on CPUUtilization for the past 7 days; for RDS, check DatabaseConnections; for EBS, verify VolumeIdleTime (if you have CloudWatch Agent installed).
3. Take action – If utilization is below a threshold (e.g., <5 % CPU for 7 days) and the resource is not prod, stop or snapshot and then terminate.

Sample Python snippet (Python 3.9 runtime):

import boto3, os, datetime

ec2 = boto3.client('ec2')
cloudwatch = boto3.client('cloudwatch')
config = boto3.client('config')

THRESHOLD = 5  # percent CPU
DAYS = 7

def lambda_handler(event, context):
    # 1. Get non‑compliant resources from Config
    resp = config.get_compliance_details_by_config_rule(
        ConfigRuleName='UntaggedResourceRule',
        ComplianceTypes=['NON_COMPLIANT']
    )
    for result in resp['EvaluationResults']:
        arn = result['EvaluationResultIdentifier']['EvaluationResultQualifier']['ResourceId']
        if arn.startswith('i-'):  # EC2 instance
            check_ec2(arn)

def check_ec2(instance_id):
    end = datetime.datetime.utcnow()
    start = end - datetime.timedelta(days=DAYS)
    metrics = cloudwatch.get_metric_statistics(
        Namespace='AWS/EC2',
        MetricName='CPUUtilization',
        Dimensions=[{'Name':'InstanceId','Value':instance_id}],
        StartTime=start,
        EndTime=end,
        Period=86400,
        Statistics=['Average']
    )
    avg = sum(p['Average'] for p in metrics['Datapoints']) / len(metrics['Datapoints']) if metrics['Datapoints'] else 0
    if avg < THRESHOLD:
        ec2.stop_instances(InstanceIds=[instance_id])
        print(f"Stopped idle instance {instance_id} (avg CPU {avg:.1f}%)")

Deploy the function with the AWS CLI:

aws lambda create-function \
  --function-name "TagDrivenCleanup" \
  --runtime python3.9 \
  --role arn:aws:iam::123456789012:role/TagCleanupRole \
  --handler lambda_function.lambda_handler \
  --zip-file fileb://cleanup.zip

Add environment variables for thresholds if you want per‑team customization.

Step 4: Schedule the Lambda with EventBridge

Create a daily rule that triggers the function at 02:00 UTC (low‑traffic window):

aws events put-rule \
  --name "DailyTagCleanup" \
  --schedule-expression "cron(0 2 * * ? *)"

aws events put-targets \
  --rule "DailyTagCleanup" \
  --targets "Id"="1","Arn"="arn:aws:lambda:us-east-1:123456789012:function:TagDrivenCleanup"

aws lambda add-permission \
  --function-name TagDrivenCleanup \
  --statement-id "EventBridgeInvoke" \
  --action "lambda:InvokeFunction" \
  --principal events.amazonaws.com \
  --source-arn "arn:aws:events:us-east-1:123456789012:rule/DailyTagCleanup"

Now the cleanup runs automatically every night, stopping or terminating idle resources without human interaction.

Step 5: Verify impact and report dollar savings

After the first run, compare the AWS Cost Explorer view before and after. For a quick, zero‑cost audit you can also use CloudBudgetMaster's free AWS waste finder:

• Navigate to /tools/aws-waste-finder.
• Authenticate with read‑only IAM credentials.
• The tool scans your account, lists idle resources, and shows the estimated monthly dollar impact.

Export the CSV, import it into your finance spreadsheet, and attribute the savings to the “Tag‑driven cleanup” line item. Over time you will see a steady reduction in the “Idle/Unused” category.

Manual cleanup vs. tag‑driven automation

Frequently asked questions

How do I avoid accidentally stopping production resources?

The Lambda checks the Environment tag and only acts on resources where Environment is set to dev, staging, or is missing. You can also add a whitelist of instance IDs in an environment variable.

Can this strategy work for serverless services like Lambda or Fargate?

Yes. You can extend the Config rule set to include AWS::Lambda::Function and AWS::ECS::Service. For Lambda, look at InvocationCount in CloudWatch; for Fargate, evaluate CPUUtilization on the task definition.

What if my organization uses multiple AWS accounts?

Deploy the same Lambda function in each account, or use AWS Organizations to create a centralized Config aggregator. The aggregator can feed a single cross‑account Lambda that performs the cleanup across all member accounts.

Does this increase my AWS bill because of extra Config and Lambda invocations?

Config charges are based on recorded configuration items; the incremental cost is negligible compared to the waste you eliminate. Lambda runs for a few seconds per day, costing fractions of a cent.

Key takeaways

• A strict tag taxonomy (CostCenter, Environment) gives you the data needed for automated cleanup.
• AWS Config rules surface untagged or stale resources in real time.
• A scheduled Lambda can evaluate utilization metrics and safely stop or terminate idle resources.
• Automation removes manual ticket churn, reduces error risk, and scales across accounts.
• Use CloudBudgetMaster’s free AWS waste finder to quantify the dollar impact of the cleanup.

CloudBudgetMaster automates this workflow by scanning your AWS account with read‑only permissions, detecting idle and wasted resources, and reporting the exact dollar impact. GCP, Azure and Snowflake support are coming soon. To try it now, create a free account and start saving.