AWSCost · the checks
Every check the scan runs, in full.
33 checks across every region your account has switched on. Each one prices what it finds at the live rate for that region, and says what changing it would cost you.
AWS’s own tools find 18 of them, and every one of those says so below. The other 15 nothing at AWS looks for.
This is what the scanner looks for - not what it will find. A check only runs when that service had spend in your last 30 days, and anything it could not read is named on the report instead of being left out of the total.
Networking
Elastic IPs attached to nothing
An unattached Elastic IP bills $0.005/hour - about $3.65/month each in us-east-1.
Fixing it: Permanent. Nothing goes offline, and nothing comes back. Check twice before you delete.
Also in Trusted Advisor - Needs Business Support+, from $29/month.
How this charge works →Public IPv4 addresses you pay for by the hour
Every public IPv4 address bills $0.005/hour whether anything reaches it or not - about $3.65/month per address in us-east-1.
Fixing it: Interrupts something running. The resource stops, restarts, or loses a path it had.
No AWS tool checks this
How this charge works →NAT gateways passing no traffic
A NAT gateway that moved no bytes for 14 days still bills its hourly charge - about $32.85/month in us-east-1, before per-GB processing.
Fixing it: Interrupts something running. The resource stops, restarts, or loses a path it had.
Also in Compute Optimizer
How this charge works →Interface VPC endpoints nothing calls
An interface endpoint bills per subnet it lives in - about $7.30/month each in us-east-1 - with or without traffic.
Fixing it: Interrupts something running. The resource stops, restarts, or loses a path it had.
No AWS tool checks this
How this charge works →Client VPN endpoints nobody connects to
A Client VPN bills $0.10/hour per associated subnet - about $73/month in us-east-1 - at zero connected clients.
Fixing it: Interrupts something running. The resource stops, restarts, or loses a path it had.
No AWS tool checks this
How this charge works →Transit Gateway attachments carrying nothing
Each attachment bills $36.50/month in us-east-1, traffic or no traffic.
Fixing it: Interrupts something running. The resource stops, restarts, or loses a path it had.
No AWS tool checks this
How this charge works →Site-to-Site VPN connections with both tunnels down
A VPN connection bills $36.50/month in us-east-1 while it exists, whether or not either tunnel is up.
Fixing it: Interrupts something running. The resource stops, restarts, or loses a path it had.
No AWS tool checks this
How this charge works →Load balancers with no healthy targets
An ALB or NLB with nothing behind it still bills its hourly charge - roughly $16 to $22/month before capacity units.
Fixing it: Interrupts something running. The resource stops, restarts, or loses a path it had.
Also in Trusted Advisor - Needs Business Support+, from $29/month.
How this charge works →Where your data transfer charges come from
Splits the transfer bill into NAT processing, cross-AZ, cross-region and internet egress, and names the parts worth attacking.
Fixing it: Advisory. Nothing to apply here - it shows you where the money goes.
Also in Cost Explorer - Only if you know which usage types to group by.
How this charge works →
Compute
EC2 instances doing nothing
An instance averaging under 5% CPU for 14 days, priced at what its type costs to run - plus stopped instances still billing for disk.
Fixing it: Interrupts something running. The resource stops, restarts, or loses a path it had.
Also in Compute Optimizer
How this charge works →EC2 instances bigger than their workload
Headroom the instance never touches, priced at the gap down to a smaller type.
Fixing it: Interrupts something running. The resource stops, restarts, or loses a path it had.
Also in Compute Optimizer - Theirs reads 93 days and Datadog metrics. Ours reads 14 days.
How this charge works →Instances AWS sells cheaper today, same specs
Same memory, at least the vCPUs, lower price: t2.micro to t3a.micro saves $1.90/month and m4.xlarge to m6a.xlarge $24.09/month in eu-central-1.
Fixing it: Interrupts something running. The resource stops, restarts, or loses a path it had.
Also in Compute Optimizer
How this charge works →EKS clusters with no nodes
An abandoned control plane bills $73/month flat in every region, with nothing running on it.
Fixing it: Permanent. Nothing goes offline, and nothing comes back. Check twice before you delete.
No AWS tool checks this
How this charge works →Fargate services nobody uses
A service whose peak CPU never passed 5% in 14 days, priced at task size times desired count - $36.04/month for one 1 vCPU / 2 GB task in us-east-1.
Fixing it: Reversible. Change it, change it back. Nothing stops.
Also in Compute Optimizer
How this charge works →Lambda memory you configured and never use
Functions holding memory far above their measured peak, where Lambda Insights is switched on to measure it.
Fixing it: Reversible. Change it, change it back. Nothing stops.
Also in Compute Optimizer - Theirs works without Lambda Insights. Ours needs it switched on.
How this charge works →
Storage
EBS volumes nothing is using
Volumes attached to nothing, and volumes whose only instance is stopped - both bill in full, $0.10/GiB-month for gp2 in us-east-1.
Fixing it: Permanent. Nothing goes offline, and nothing comes back. Check twice before you delete.
Also in Compute Optimizer
How this charge works →EBS volumes still on gp2
gp3 costs $0.08/GiB-month against gp2's $0.10 in us-east-1 - about 20% less at the same size, migrated live.
Fixing it: Reversible. Change it, change it back. Nothing stops.
Also in Compute Optimizer
How this charge works →Snapshots of volumes that no longer exist
Orphaned snapshots, and snapshots older than 180 days, at $0.05/GiB-month in us-east-1.
Fixing it: Permanent. Nothing goes offline, and nothing comes back. Check twice before you delete.
No AWS tool checks this
How this charge works →AMIs nobody launches
Images nothing has launched in months, priced at the EBS snapshots behind them - $0.05/GiB-month in us-east-1.
Fixing it: Permanent. Nothing goes offline, and nothing comes back. Check twice before you delete.
No AWS tool checks this
How this charge works →EFS file systems nothing reads or writes
A file system left behind after a migration bills every byte it holds - $0.30/GiB-month on Standard in us-east-1, whether or not anything mounts it.
Fixing it: Permanent. Nothing goes offline, and nothing comes back. Check twice before you delete.
No AWS tool checks this
How this charge works →Container images nobody pulls
Years of CI builds sit in ECR at $0.10/GiB-month. We price the layers deleting them would actually free, counting a shared layer once - not once per image.
Fixing it: Permanent. Nothing goes offline, and nothing comes back. Check twice before you delete.
No AWS tool checks this
How this charge works →S3 uploads that failed and still bill
Multipart uploads that never finished keep billing and show up nowhere in the console, and buckets with no lifecycle rule keep them forever.
Fixing it: Reversible. Change it, change it back. Nothing stops.
Also in S3 Storage Lens - A metric on a dashboard, not a recommendation.
How this charge works →S3 objects sitting in the wrong storage class
Cold data parked in Standard that Infrequent Access or Glacier would hold for a fraction of the price.
Fixing it: Reversible. Change it, change it back. Nothing stops.
Also in S3 Storage Lens - The tier that recommends this is paid.
How this charge works →
Databases
RDS databases nobody queries
Near-zero CPU and connections over 14 days, plus stopped databases that keep billing for storage.
Fixing it: Interrupts something running. The resource stops, restarts, or loses a path it had.
Also in Compute Optimizer - MySQL and PostgreSQL only.
How this charge works →RDS instances bigger than their load
An instance class above what the measured load needs, priced at the gap down.
Fixing it: Interrupts something running. The resource stops, restarts, or loses a path it had.
Also in Compute Optimizer - MySQL and PostgreSQL only.
How this charge works →Manual RDS snapshots that never expire
Automated backups age out on their own; manual snapshots do not, at $0.095/GiB-month in us-east-1.
Fixing it: Permanent. Nothing goes offline, and nothing comes back. Check twice before you delete.
No AWS tool checks this
How this charge works →Aurora Serverless v2 minimum capacity
The cluster never scales below the floor you configured - one unused ACU is $87.60/month in us-east-1.
Fixing it: Reversible. Change it, change it back. Nothing stops.
No AWS tool checks this
How this charge works →ElastiCache nodes with no connections
A cache.t3.small is $24.82/month in us-east-1, and a cache group is usually several nodes.
Fixing it: Interrupts something running. The resource stops, restarts, or loses a path it had.
Also in Compute Optimizer - Redis and Valkey only.
How this charge works →OpenSearch domains nobody searches
Priced across data, master and warm nodes - three r5.large.search nodes are $407.34/month in us-east-1.
Fixing it: Permanent. Nothing goes offline, and nothing comes back. Check twice before you delete.
No AWS tool checks this
How this charge works →DynamoDB capacity you provisioned and do not consume
Provisioned read and write units far above what the table actually uses.
Fixing it: Reversible. Change it, change it back. Nothing stops.
Also in Compute Optimizer
How this charge works →
Observability
Log groups keeping everything forever
A log group with no retention set stores every line for good, at $0.03/GiB-month in us-east-1.
Fixing it: Permanent. Nothing goes offline, and nothing comes back. Check twice before you delete.
No AWS tool checks this
How this charge works →Logs ingested at the expensive class
High-volume groups on Standard ingest at $0.50/GB where Infrequent Access is $0.25 in us-east-1.
Fixing it: Reversible. Change it, change it back. Nothing stops.
No AWS tool checks this
How this charge works →
Commitments
On-demand spend with no Savings Plan behind it
Steady baseline usage paying the on-demand rate, and commitment you already bought but do not use.
Fixing it: A commitment you cannot cancel. Nothing stops and nothing is deleted, but the term runs one to three years.
Also in Cost Explorer
How this charge works →
Want to know which of these your account is paying for? Connect it read-only and see the total, in real dollars, before you pay anything.
The role can only read - Get, Describe, List, nothing else. Read every permission it asks for before you connect, and delete the stack whenever you want. The scan adds about $0.10 to your own bill.
Frequently asked questions
How many checks does the scan run?
+
33 today, and the number moves - seven landed in the eight days to 11 August 2026. This page is built from the same list the scanner runs, and a test fails if a check is added without appearing here, so it cannot quietly fall behind.
Why not just use Compute Optimizer or Cost Optimization Hub?
+
For 18 of the 33 checks, do - they are free, and each of those checks names the AWS tool that finds it. Cost Optimization Hub adds no checks of its own; it is a dashboard over Compute Optimizer and Cost Explorer. The other 15 have no AWS equivalent, because AWS builds its recommendations from CloudWatch utilization and these resources publish none - an interface VPC endpoint, a Transit Gateway attachment or a log group with no retention bills a flat rate and reports nothing to read. Speed is the other difference: Compute Optimizer has to be switched on, then takes up to 24 hours to analyse the CloudWatch data it already holds - and it skips any resource less than 30 hours old. This reads your account live and reports in minutes.
Does every check run on my account?
+
No. A check runs only when the service it reads had spend in your last 30 days. An account with no OpenSearch spend does not pay for OpenSearch calls, and the report tells you which checks were skipped and why.
What happens to services that are not on this list?
+
The report names them. If your bill has spend on a service no check reads, it appears in a plain "no check for this yet" list with the amount, rather than being quietly left out of the total. The same goes for anything a check tried to read and could not - a denied permission or a switched-off feature is stated, never guessed around.
Can any of this change my account?
+
No. The role you deploy only reads - there is no write action anywhere in it, so AWSCost has no way to change, delete or move anything. Every permission it asks for is listed on the permissions page, and you can delete the role whenever you like.
Do the findings tell me what the fix costs?
+
Yes, and that is deliberate. Deleting a Transit Gateway attachment severs every route through it; an idle-looking cache may be a deliberate warm standby; dropping an Aurora capacity floor means a colder start. Each finding carries the trade-off next to the dollar figure, because a report that reads as free money is not one you can act on.
What does it cost to see what it found?
+
The scan and the total are free. The full report - every finding, the evidence and the trade-offs - is a one-time $49, $99 or $149, banded off your measured AWS bill. You see the total found before you decide.
Run these checks yourself · An example report · What the report costs · AWS cost breakdowns