← All articles

Advanced Cloud Cost Optimization Strategy Teams Overlook

Quick answer: The most overlooked cost‑saving tactic is an automated, pull‑request‑driven rightsizing loop that pulls Compute Optimizer data, updates your infrastructure‑as‑code (IaC) templates, and lets version control enforce the change. The loop runs without human intervention, guarantees auditability, and reports the dollar impact of every stopped or downsized resource.

Why manual rightsizing fails at scale

Most teams run a quarterly "find‑and‑delete" sprint. They open the Cost Explorer console, filter for "Under‑utilized" instances, and manually terminate or resize them. This approach breaks down for three reasons:

1. Data latency – Compute Optimizer updates recommendations every 12 hours. By the time a spreadsheet is reviewed, the workload may have changed.
2. Human error – Copy‑pasting instance IDs into the console is error‑prone and can lead to accidental downtime.
3. Lack of audit trail – Manual actions are rarely recorded in a change‑management system, making it hard to prove compliance.

An automated workflow eliminates these gaps. It treats rightsizing as code, stores every change in Git, and uses CI/CD pipelines to apply only approved modifications.

Prerequisites: Enable services and set up the foundation

Enabling Compute Optimizer

aws compute-optimizer enable-recognition \
  --service-types EC2 AutoScaling Lambda RDS \
  --region us-east-1

The command takes a few minutes. Verify with:

aws compute-optimizer get-recommendation-summaries --region us-east-1

You should see a JSON block with recommendationPreferences for each service.

Setting up a minimal IAM policy

Create a policy JSON file optimizer-policy.json:

{
  "Version": "2012-10-17",
  "Statement": [
    {"Effect": "Allow", "Action": ["compute-optimizer:*"], "Resource": "*"},
    {"Effect": "Allow", "Action": ["ec2:Describe*","rds:Describe*","autoscaling:Describe*"], "Resource": "*"},
    {"Effect": "Allow", "Action": ["s3:*"], "Resource": "*"}
  ]
}

Attach the policy to a role named CostOptimizerAutomation and grant the role to your CI runner.

Step‑by‑step: Building the automated rightsizing pipeline

1. Export recommendations to S3

Create a bucket cost‑optimizer‑reports and configure lifecycle rules to delete objects after 30 days.

aws s3 mb s3://cost-optimizer-reports --region us-east-1

Add a scheduled Lambda (or a cron job on your CI server) that runs daily:

aws compute-optimizer get-recommendations \
  --service EC2 \
  --output json \
  --query 'recommendations[*]' \
  > /tmp/ec2-recs.json
aws s3 cp /tmp/ec2-recs.json s3://cost-optimizer-reports/ec2-$(date +%F).json

Repeat for AutoScaling, Lambda, and RDS.

2. Parse recommendations and map to IaC resources

A Python script generate_changes.py reads the JSON, matches each recommendation to a resource defined in your IaC, and writes a diff file.

import json, pathlib, subprocess

bucket = 'cost-optimizer-reports'
date = subprocess.check_output(['date', '+%F']).decode().strip()
path = f'/tmp/ec2-{date}.json'
# Assume the file is already downloaded locally
with open(path) as f:
    recs = json.load(f)

changes = []
for rec in recs:
    instance_id = rec['instanceArn'].split('/')[-1]
    current_type = rec['currentInstanceType']
    suggested = rec['recommendationOptions'][0]['instanceType']
    if current_type != suggested:
        changes.append({
            'id': instance_id,
            'from': current_type,
            'to': suggested
        })

# Write a simple markdown table for the PR description
md = "| Instance ID | Current Type | Suggested Type |
|---|---|---|
"
for c in changes:
    md += f"| {c['id']} | {c['from']} | {c['to']} |
"
path_md = f'changes-{date}.md'
path_md = pathlib.Path('/tmp') / path_md
path_md.write_text(md)
print('Generated', path_md)

The script can be extended to handle Auto Scaling groups, RDS instance classes, and Lambda memory settings.

3. Generate IaC diff

If you use Terraform, the script can modify the .tf files directly:

import re

def update_tf(file_path, instance_id, new_type):
    txt = pathlib.Path(file_path).read_text()
    pattern = rf'(resource "aws_instance" "{instance_id}"[\s\S]*?instance_type\s*=\s*")([^"]+)(")'
    new_txt = re.sub(pattern, rf'\1{new_type}\3', txt)
    pathlib.Path(file_path).write_text(new_txt)

Run this for each change, then execute terraform fmt to keep formatting consistent.

4. Open a pull request automatically

A GitHub Action can commit the changes and open a PR:

name: Rightsize PR
on:
  schedule:
    - cron: '0 2 * * *'   # runs daily at 02:00 UTC
jobs:
  rightsize:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: '3.11'
      - name: Install deps
        run: pip install boto3
      - name: Run generator
        run: python generate_changes.py
      - name: Commit changes
        run: |
          git config user.name 'cost‑bot'
          git config user.email 'cost-bot@example.com'
          git add .
          git commit -m "Automated rightsizing recommendations $(date +%F)"
          git push origin HEAD:refs/heads/rightsizing-$(date +%F)
      - name: Create PR
        uses: peter-evans/create-pull-request@v5
        with:
          branch: rightsizing-${{ github.run_id }}
          title: "Automated rightsizing $(date +%F)"
          body: "See attached markdown for the list of instance changes."

The PR appears in the repository, ready for review. Teams can add required reviewers, run terraform plan in a CI job, and merge only after approval.

5. Apply changes after merge

A second workflow triggers on pull_request_target merge events:

name: Apply Rightsizing
on:
  push:
    branches:
      - main
jobs:
  apply:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Terraform Init
        run: terraform init
      - name: Terraform Plan
        run: terraform plan -out=plan.out
      - name: Terraform Apply
        if: github.event_name == 'push'
        run: terraform apply -auto-approve plan.out

The pipeline guarantees that every rightsizing action is versioned, reviewed, and auditable.

Manual vs. automated rightsizing: a side‑by‑side comparison

The table shows why the automated approach scales for growing organizations.

Integrating budget alerts and anomaly detection

Even with rightsizing, unexpected spikes happen. Pair the pipeline with AWS Budgets to catch anomalies early.

aws budgets create-budget \
  --account-id 123456789012 \
  --budget file://budget.json

budget.json example:

{
  "Budget": {
    "BudgetName": "Monthly EC2 Rightsizing",
    "BudgetLimit": {"Amount": "5000", "Unit": "USD"},
    "TimeUnit": "MONTHLY",
    "BudgetType": "COST",
    "CostFilters": {"Service": ["Amazon Elastic Compute Cloud - Compute"]}
  },
  "NotificationsWithSubscribers": [
    {
      "Notification": {
        "NotificationType": "ACTUAL",
        "ComparisonOperator": "GREATER_THAN",
        "Threshold": 80,
        "ThresholdType": "PERCENTAGE"
      },
      "Subscribers": [{"SubscriptionType": "EMAIL", "Address": "finops@example.com"}]
    }
  ]
}

When spend exceeds 80 % of the budget, an email alerts the team. The alert can also trigger a Slack webhook that runs the rightsizing pipeline a second time, ensuring the latest recommendations are applied.

Extending the strategy to other AWS services

The core loop works for any Compute Optimizer‑supported service.

Auto Scaling groups

• Recommendation type: desiredCapacity vs. maxSize.
• Script change: adjust the aws_autoscaling_group resource max_size and desired_capacity fields.

RDS instances

• Recommendation type: db.t3.medium → db.t3.small.
• Use the aws_db_instance resource instance_class attribute.

Lambda functions

• Recommendation type: memory size reduction.
• Update the aws_lambda_function resource memory_size.

For each service, add a parsing block in generate_changes.py and a corresponding IaC update function. The PR template can include a section that lists affected services, making review straightforward.

Using the free AWS waste finder for quick validation

Before you commit to a full automation pipeline, run CloudBudgetMaster's free AWS waste finder. The tool scans your account in read‑only mode and returns a CSV of idle resources with an estimated dollar impact. It helps you verify that the recommendations you will automate are realistic and not based on transient load spikes.

Common pitfalls and how to avoid them

Frequently asked questions

How often should the rightsizing pipeline run?

A daily cadence balances data freshness with API rate limits. For very dynamic workloads you can schedule the Lambda to run every 6 hours.

Does the automation handle Spot Instance interruptions?

The pipeline only changes instance types or sizes. Spot interruption handling remains a separate concern; use EC2 Spot Fleet with capacity‑rebalancing to maintain availability.

Can this workflow be used with CloudFormation instead of Terraform?

Yes. Replace the Terraform file edits with aws cloudformation update-stack commands that reference a modified template stored in S3. The PR still contains the updated YAML/JSON template.

What if a recommendation would break a licensing agreement?

Compute Optimizer does not consider software license constraints. Add a pre‑flight check in the script that reads a custom tag LicenseRestricted=true and skips those resources.

Key takeaways

• Automated rightsizing turns cost recommendations into code, eliminating manual errors.
• Compute Optimizer provides near real‑time utilization data for EC2, Auto Scaling, Lambda, and RDS.
• A CI/CD pipeline can generate, review, and apply IaC changes via pull requests, giving full auditability.
• Pair the workflow with AWS Budgets to catch cost anomalies instantly.
• Start with the free AWS waste finder to validate the biggest idle resources before scaling the automation.

Closing note

CloudBudgetMaster automates this process for AWS today. It scans your account in read‑only mode, pulls Compute Optimizer data, and reports the dollar impact of idle or oversized resources. Support for GCP, Azure, and Snowflake is coming soon. To try the automation, create a free account and start cleaning up waste now.