AWSCostAWSCost · the checks
Every check the scan runs, in full.
32 checks across every region your account has switched on. Each one prices what it finds at the live rate for that region, and says what changing it would cost you.
This is what the scanner looks for - not what it will find. A check only runs when that service had spend on your last full month's bill, and anything it could not read is named on the report instead of being left out of the total.
Networking
Elastic IPs attached to nothing
An unattached Elastic IP bills $0.005/hour - about $3.65/month each in us-east-1.
How this charge works →Public IPv4 addresses you pay for by the hour
Every public IPv4 address bills $0.005/hour whether anything reaches it or not - about $3.65/month per address in us-east-1.
How this charge works →NAT gateways passing no traffic
A NAT gateway that moved no bytes for 14 days still bills its hourly charge - about $32.85/month in us-east-1, before per-GB processing.
How this charge works →Interface VPC endpoints nothing calls
An interface endpoint bills per subnet it lives in - about $7.30/month each in us-east-1 - with or without traffic.
How this charge works →Client VPN endpoints nobody connects to
A Client VPN bills $0.10/hour per associated subnet - about $73/month in us-east-1 - at zero connected clients.
Transit Gateway attachments carrying nothing
Each attachment bills $36.50/month in us-east-1, traffic or no traffic.
Site-to-Site VPN connections with both tunnels down
A VPN connection bills $36.50/month in us-east-1 while it exists, whether or not either tunnel is up.
Load balancers with no healthy targets
An ALB or NLB with nothing behind it still bills its hourly charge - roughly $16 to $22/month before capacity units.
How this charge works →Where your data transfer charges come from
Splits the transfer bill into NAT processing, cross-AZ, cross-region and internet egress, and names the parts worth attacking.
How this charge works →
Compute
EC2 instances doing nothing
An instance averaging under 5% CPU for 14 days, priced at what its type costs to run - plus stopped instances still billing for disk.
How this charge works →EC2 instances bigger than their workload
Headroom the instance never touches, priced at the gap down to a smaller type.
How this charge works →Instances AWS sells cheaper today, same specs
Same memory, at least the vCPUs, lower price: t2.micro to t3a.micro saves $1.90/month and m4.xlarge to m6a.xlarge $24.09/month in eu-central-1.
EKS clusters with no nodes
An abandoned control plane bills $73/month flat in every region, with nothing running on it.
How this charge works →Fargate services nobody uses
A service whose peak CPU never passed 5% in 14 days, priced at task size times desired count - $36.04/month for one 1 vCPU / 2 GB task in us-east-1.
How this charge works →Lambda memory you configured and never use
Functions holding memory far above their measured peak, where Lambda Insights is switched on to measure it.
How this charge works →
Storage
EBS volumes nothing is using
Volumes attached to nothing, and volumes whose only instance is stopped - both bill in full, $0.10/GiB-month for gp2 in us-east-1.
How this charge works →EBS volumes still on gp2
gp3 costs $0.08/GiB-month against gp2's $0.10 in us-east-1 - about 20% less at the same size, migrated live.
How this charge works →Snapshots of volumes that no longer exist
Orphaned snapshots, and snapshots older than 180 days, at $0.05/GiB-month in us-east-1.
How this charge works →AMIs nobody launches
Images nothing has launched in months, priced at the EBS snapshots behind them - $0.05/GiB-month in us-east-1.
How this charge works →S3 uploads that failed and still bill
Multipart uploads that never finished keep billing and show up nowhere in the console, and buckets with no lifecycle rule keep them forever.
How this charge works →S3 objects sitting in the wrong storage class
Cold data parked in Standard that Infrequent Access or Glacier would hold for a fraction of the price.
How this charge works →
Databases
RDS databases nobody queries
Near-zero CPU and connections over 14 days, plus stopped databases that keep billing for storage.
How this charge works →RDS instances bigger than their load
An instance class above what the measured load needs, priced at the gap down.
How this charge works →RDS storage still on gp2
The same swap as EBS, about 20% cheaper per GiB, applied online.
How this charge works →Manual RDS snapshots that never expire
Automated backups age out on their own; manual snapshots do not, at $0.095/GiB-month in us-east-1.
How this charge works →Aurora Serverless v2 minimum capacity
The cluster never scales below the floor you configured - one unused ACU is $87.60/month in us-east-1.
How this charge works →ElastiCache nodes with no connections
A cache.t3.small is $24.82/month in us-east-1, and a cache group is usually several nodes.
OpenSearch domains nobody searches
Priced across data, master and warm nodes - three r5.large.search nodes are $407.34/month in us-east-1.
DynamoDB capacity you provisioned and do not consume
Provisioned read and write units far above what the table actually uses.
How this charge works →
Observability
Log groups keeping everything forever
A log group with no retention set stores every line for good, at $0.03/GiB-month in us-east-1.
How this charge works →Logs ingested at the expensive class
High-volume groups on Standard ingest at $0.50/GB where Infrequent Access is $0.25 in us-east-1.
How this charge works →
Commitments
On-demand spend with no Savings Plan behind it
Steady baseline usage paying the on-demand rate, and commitment you already bought but do not use.
How this charge works →
Want to know which of these your account is paying for? Connect it read-only and see the total, in real dollars, before you pay anything.
The role can only read - Get, Describe, List, nothing else. Read the exact permissions before you deploy it, and delete the stack whenever you want.
Frequently asked questions
How many checks does the scan run?+
32 today, and the number moves - seven landed in the eight days to 11 August 2026. This page is built from the same list the scanner runs, and a test fails if a check is added without appearing here, so it cannot quietly fall behind.
Does every check run on my account?+
No. A check runs only when the service it reads had spend on your last full month's bill. An account with no OpenSearch spend does not pay for OpenSearch calls, and the report tells you which checks were skipped and why.
What happens to services that are not on this list?+
The report names them. If your bill has spend on a service no check reads, it appears in a plain "no check for this yet" list with the amount, rather than being quietly left out of the total. The same goes for anything a check tried to read and could not - a denied permission or a switched-off feature is stated, never guessed around.
Can any of this change my account?+
No. The role you deploy grants Get, Describe and List calls only - no wildcards, no write actions. AWSCost reports what it finds and has no way to change, delete or move anything. You can read the exact permissions in the template before you deploy it, and delete the role whenever you like.
Do the findings tell me what the fix costs?+
Yes, and that is deliberate. Deleting a Transit Gateway attachment severs every route through it; an idle-looking cache may be a deliberate warm standby; dropping an Aurora capacity floor means a colder start. Each finding carries the trade-off next to the dollar figure, because a report that reads as free money is not one you can act on.
What does it cost to see what it found?+
The scan and the total are free. The full report - every finding, the evidence and the trade-offs - is a one-time $49, $99 or $149, banded off your measured AWS bill. You see the total found before you decide.