A 30-Minute AWS Cost Audit Checklist

Before running a full cost and security audit, I always start with a handful of quick checks that tend to surface the biggest wins fastest.

Compute

Look for EC2 instances running 24/7 that could be scheduled or right-sized.
Check whether workloads can move to Graviton (ARM) instances. Most run there at a lower cost with no code changes for supported runtimes.
Confirm Savings Plans or Reserved Instances cover steady-state workloads.

Check for unattached EBS volumes.
Confirm unused EBS and RDS snapshots are actually being deleted, not just accumulating. Automated lifecycle rules (Data Lifecycle Manager, backup retention policies) handle this; manual snapshots often don't have either.
Look for gp2 volumes that could move to gp3. It has a cheaper baseline and no downtime to switch.
Check S3 lifecycle policies: old logs and backups often sit in Standard storage indefinitely.
Look for buckets with versioning enabled but no lifecycle rule cleaning up old versions.

Are RDS/Aurora instances rightsized for their actual CPU and memory usage, not just provisioned for a peak that rarely happens?
Check for Multi-AZ enabled on non-production databases. Dev and staging often inherit prod's setting and pay double for redundancy nobody needs there.
Confirm Reserved Instances or Savings Plans cover database workloads too. Teams often set these up for EC2 and forget RDS entirely.

NAT Gateway data processing charges are an easy one to miss: check if VPC endpoints could replace some of that traffic.
Look for load balancers (ALB/NLB) with zero registered targets. Cheap to create, easy to forget, and they bill around the clock.
Check for unattached Elastic IPs. AWS bills for these once they're not attached to a running instance.

None of this replaces a full Well-Architected review, but it's a fast way to know whether an account is worth digging into further.