← All articles

Advanced Cloud Cost Optimization Strategy Teams Miss

The single tactic most teams overlook

When engineers ask how can we lower our AWS bill without sacrificing performance, the answer often lands on rightsizing instances or deleting obvious orphaned volumes. The tactic that consistently slips under the radar is automated idle‑resource reclamation driven by AWS Compute Optimizer, a unified tagging scheme, and an EventBridge‑Lambda pipeline. By letting the platform continuously detect under‑utilized resources, tag them, and trigger safe shutdown or downsizing, you eliminate waste the moment it appears instead of waiting for a quarterly review.

1. Enable Compute Optimizer and collect actionable data

Compute Optimizer provides machine‑learning recommendations for EC2, Auto Scaling groups, EBS, and Lambda. The service works in read‑only mode, so you can enable it without changing any resources.

Step‑by‑step 1. Open the console: AWS Management Console → Services → Compute Optimizer. 2. Click Get started and select the resource types you want to analyze (EC2, Auto Scaling, EBS, Lambda). 3. Choose Enable. The service begins ingesting CloudWatch metrics for the past 14 days. 4. (Optional) Use the CLI to verify the status: bash aws compute-optimizer get-ec2-recommendation-summaries --region us-east-1 5. After 24 hours, pull the first set of recommendations: bash aws compute-optimizer get-ec2-instance-recommendations \ --region us-east-1 \ --max-results 100

The output includes utilizationMetrics, recommendedInstanceType, and a finding field (Underprovisioned, Overprovisioned, or Optimized). Focus on the Overprovisioned findings – those are the idle resources you can act on automatically.

2. Design a cost‑allocation tag hierarchy for automation

Tags are the glue between Compute Optimizer data and your remediation Lambda. A minimal yet powerful tag set includes:

Implementation steps 1. Create a tag policy in AWS Organizations → Tag Policies to enforce the four keys on all new resources. 2. Apply the policy to existing resources with a bulk tag operation: bash aws resourcegroupstaggingapi tag-resources \ --resource-arn-list $(aws ec2 describe-instances --query 'Reservations[].Instances[].InstanceArn' --output text) \ --tags AutoReclaim=true ReclaimAfter=7 3. Verify compliance: bash aws resourcegroupstaggingapi get-resources \ --tag-filters Key=AutoReclaim,Values=true

Only resources with AutoReclaim=true will be considered by the automation pipeline, giving you granular control.

3. Build an EventBridge‑driven reclamation pipeline

EventBridge can react to the daily Compute Optimizer export and launch a Lambda that evaluates each recommendation against your tags.

3.1 Create the EventBridge rule

aws events put-rule \
    --name ComputeOptimizerDailyExport \
    --schedule-expression "rate(24 hours)" \
    --description "Trigger reclamation Lambda after Compute Optimizer data is refreshed"

3.2 Write the Lambda function (Python 3.9 example)

import boto3, os, json

ec2 = boto3.client('ec2')
optimizer = boto3.client('compute-optimizer')

def lambda_handler(event, context):
    # Pull over‑provisioned EC2 recommendations
    resp = optimizer.get_ec2_instance_recommendations(
        filter={'finding': ['Overprovisioned']},
        maxResults=1000
    )
    for rec in resp.get('instanceRecommendations', []):
        instance_id = rec['instanceArn'].split('/')[-1]
        tags = ec2.describe_tags(Filters=[{'Name':'resource-id','Values':[instance_id]}])['Tags']
        tag_dict = {t['Key']: t['Value'] for t in tags}
        if tag_dict.get('AutoReclaim') != 'true':
            continue
        days = int(tag_dict.get('ReclaimAfter', '7'))
        # Check idle metric (CPUUtilization < 5% for `days` days)
        metrics = optimizer.get_ec2_instance_recommendations(
            instanceArns=[rec['instanceArn']],
            recommendationPreferences={'cpuUtilizationThreshold': 5}
        )
        # Simplified: if recommendation exists, stop the instance
        ec2.stop_instances(InstanceIds=[instance_id])
        print(f"Stopped idle instance {instance_id}")
    return {'status':'complete'}

3.3 Attach the Lambda to the rule

aws lambda create-function \
    --function-name ReclaimIdleResources \
    --runtime python3.9 \
    --role arn:aws:iam::123456789012:role/LambdaReclaimRole \
    --handler lambda_function.lambda_handler \
    --zip-file fileb://reclaim.zip

aws events put-targets \
    --rule ComputeOptimizerDailyExport \
    --targets Id=1,Arn=$(aws lambda get-function-configuration --function-name ReclaimIdleResources --query 'FunctionArn' --output text)

The pipeline runs once per day, stops any EC2 instance that meets the over‑provisioned criteria and respects the tag‑driven opt‑in.

4. Extend the pipeline to other services (EBS, RDS, Lambda)

Compute Optimizer also returns recommendations for EBS volumes and RDS instances. The same Lambda can be expanded with additional branches:

• EBS – If a volume is Idle and AutoReclaim=true, create a snapshot and delete the volume.
• RDS – For Overprovisioned DB instances, downsize the instance class or enable Stop for dev environments.
• Lambda – When ProvisionedConcurrency is higher than needed, reduce the allocation.

Sample snippet for EBS:

if rec['resourceType'] == 'EBSVolume' and tag_dict.get('AutoReclaim') == 'true':
    vol_id = rec['volumeArn'].split('/')[-1]
    ec2.create_snapshot(VolumeId=vol_id, Description='Automated snapshot before deletion')
    ec2.delete_volume(VolumeId=vol_id)
    print(f"Snapshot created and volume {vol_id} deleted")

By handling multiple services in a single function, you keep operational overhead low and achieve a holistic idle‑resource reclamation strategy.

5. Hook the process into CloudWatch Alarms and Budgets

Automation is only as safe as its guardrails. Add two layers of protection:

1. CloudWatch metric alarm – Monitor CPUUtilization and NetworkIn for each instance. If a stop action occurs, the alarm fires a SNS notification to the ops channel. bash aws cloudwatch put-metric-alarm \ --alarm-name "IdleInstanceStopped" \ --metric-name CPUUtilization \ --namespace AWS/EC2 \ --statistic Average \ --period 300 \ --threshold 5 \ --comparison-operator LessThanOrEqualToThreshold \ --dimensions Name=InstanceId,Value=i-0123456789abcdef0 \ --evaluation-periods 2 \ --alarm-actions arn:aws:sns:us-east-1:123456789012:OpsAlerts
2. Cost Budget – Set a monthly budget that triggers when savings exceed a threshold, confirming the pipeline is delivering value. bash aws budgets create-budget \ --account-id 123456789012 \ --budget file://budget.json (budget.json contains a BudgetLimit of your current spend and a Notification for ACTUAL_COST > 90% of the limit.)

These safeguards give you confidence to let the automation run unattended.

6. Validate impact with Cost Explorer and the free AWS waste finder

After the first week of automation, compare the before‑and‑after spend:

• Open Cost Explorer → Reports → Create report.
• Filter by tag AutoReclaim=true and by Service (EC2, EBS, RDS).
• Export the CSV and calculate the delta.

For a quick sanity check, run CloudBudgetMaster’s free AWS waste finder. The tool scans your account in read‑only mode and lists idle resources with an estimated dollar impact. Use the output to verify that the Lambda‑driven reclamation matches the tool’s findings.

7. Manual vs. automated reclamation – a quick comparison

The table makes it clear why most mature FinOps teams move from a manual process to an automated reclamation strategy.

Frequently asked questions

How does Compute Optimizer differ from Trusted Advisor?

Compute Optimizer focuses on utilization‑based recommendations using machine learning, while Trusted Advisor provides rule‑based checks (e.g., under‑utilized EBS snapshots). For automated reclamation, Compute Optimizer gives the granular usage data needed to trigger actions.

Will stopping an EC2 instance break my production workload?

Only resources tagged with AutoReclaim=true are eligible. Production workloads should be tagged Env=prod and typically not opt‑in to automated stop actions. Use the ReclaimAfter tag to set a longer idle window for production if you ever need it.

Can I apply this strategy to multiple AWS accounts?

Yes. Create the EventBridge rule and Lambda in a centralized security account, grant it read‑only access to member accounts via IAM roles, and enable Compute Optimizer in each account. The Lambda can assume a role in each member account to perform the stop/delete actions.

What if I need to keep an idle resource for compliance reasons?

Add a tag Compliance=true. The Lambda checks for this tag before taking any action and skips the resource, ensuring you stay audit‑ready.

Key takeaways

• Enable Compute Optimizer for all resource types and let it collect 14 days of metrics.
• Enforce a minimal tag set (CostCenter, Env, AutoReclaim, ReclaimAfter) to control which resources can be reclaimed.
• Use an EventBridge rule to trigger a Lambda that evaluates over‑provisioned recommendations against tags.
• Extend the Lambda to handle EBS, RDS, and Lambda concurrency, creating snapshots before deletion.
• Guard the pipeline with CloudWatch alarms and a cost budget to catch unintended stops.
• Validate savings with Cost Explorer and the free AWS waste finder tool.
• Automation turns a quarterly manual chore into a daily, low‑risk cost‑saving engine.

By automating idle‑resource reclamation, engineering teams free up budget for innovation while keeping the cloud environment lean and compliant. The approach scales with the organization, requires only a one‑time setup, and delivers measurable savings every month.

How CloudBudgetMaster helps – CloudBudgetMaster currently scans AWS accounts in read‑only mode, identifies idle and wasted resources, and reports the dollar impact of each finding. Support for GCP, Azure, and Snowflake is coming soon. To try the detection engine now, create a free account.