80 findings across 37 kinds of waste, on a test account.

Why it is waste. This table has had no reads or writes in 14 days. Provisioned capacity charges continue regardless of usage.

Fix. Delete or switch to on-demand billing.

Risk. Verify no applications depend on this table. Check DynamoDB Streams consumers. If keeping, switch to on-demand to avoid idle costs.

Why it is waste. AWS charges for Elastic IPs that are allocated but not associated with a running instance. This EIP was likely left behind after an instance was terminated.

Fix. Release this Elastic IP if no longer needed.

aws ec2 release-address --allocation-id <Elastic IP A>

Risk. Releasing an EIP is permanent: the IP address cannot be recovered. If DNS records or allowlists reference this IP, update them first.

Why it is waste. Without auto-scaling, provisioned capacity is fixed 24/7. Auto-scaling adjusts capacity based on traffic, reducing cost during low-activity periods.

Fix. Enable auto-scaling or switch to on-demand billing.

aws application-autoscaling register-scalable-target --service-namespace dynamodb --resource-id table/<DynamoDB table B> --scalable-dimension dynamodb:table:ReadCapacityUnits --min-capacity 1 --max-capacity 10

Risk. Auto-scaling has a brief delay when scaling up. Set appropriate minimum capacities for baseline traffic. Consider on-demand mode as an alternative.

Why it is waste. Abnormal growth often indicates runaway logging, build artifacts, or misconfigured data pipelines. Without lifecycle rules, this growth continues unchecked.

Fix. S3 bucket 'S3 bucket D' grew from under 0.1 GB to 12.0 GB in 30 days (+12.0 GB). Investigate source of growth. Consider adding lifecycle rules to expire old objects or transition to cheaper storage classes.

Risk. Investigate the source of growth before adding lifecycle rules. Use S3 Storage Lens or S3 Inventory to identify which prefixes are growing.

Why it is waste. This volume is not attached to any instance. It was likely left behind after an instance was terminated or a snapshot was restored.

Fix. Delete this volume if no longer needed.

aws ec2 delete-volume --volume-id <EBS volume A>

Risk. Verify no data on this volume is needed before deleting. Consider creating a snapshot first as a safety net.

Why it is waste. Even small log groups grow over time. Without retention, storage costs only increase.

Fix. Set a retention policy to automatically delete old logs.

aws logs put-retention-policy --log-group-name '<Log group F>' --retention-in-days 30

Risk. Low risk: setting a retention policy is a best practice. Choose a window that matches your debugging needs.

Why it is waste. Untagged images are typically superseded builds. Old images beyond your rollback window serve no purpose.

Fix. Delete old images or set up lifecycle policy.

Risk. Verify no running tasks reference these images. Keep the latest tagged images needed for production and rollback.

Why it is waste. This snapshot references volume (masked) which has been deleted. Incremental snapshot chains are broken: this snapshot is now a standalone copy.

Fix. Delete this orphaned snapshot if no longer needed for standalone restore.

aws ec2 delete-snapshot --snapshot-id <EBS snapshot A>

Risk. This may still contain data needed for compliance or disaster recovery. Verify before deleting.

Why it is waste. Untagged images are created when a new image is pushed with the same tag, replacing the old manifest. The old image loses its tag but remains stored. These orphaned layers accumulate and increase storage costs.

Fix. Delete untagged images or add a lifecycle policy to expire them automatically.

aws ecr batch-delete-image --repository-name <ECR repository C> --image-ids "$(aws ecr list-images --repository-name <ECR repository C> --filter tagStatus=UNTAGGED --query 'imageIds[*]' --output json)"

Risk. Untagged images cannot be pulled by tag. They are only referenced by digest. Verify no Fargate tasks or Kubernetes pods reference images by SHA digest before deleting.

Why it is waste. This function has not been invoked in 30 days. It may be leftover from a decommissioned feature or a one-time migration.

Fix. Delete this function if it's no longer needed.

aws lambda delete-function --function-name <Lambda function C>

Risk. Check if this function is triggered by scheduled events, S3 notifications, or other async invocations before deleting.

Why it is waste. Without mount targets, no EC2 instance or container can access this filesystem. It's paying for storage that cannot be read or written.

Fix. Delete this filesystem.

aws efs delete-file-system --file-system-id <EFS file system A>

Risk. Verify the filesystem is not in the process of being set up. Back up data with AWS Backup or DataSync before deleting.

Why it is waste. An excessive timeout means a stuck invocation burns Lambda compute for 900s instead of failing fast. This is a cost-risk and operational-reliability finding.

Fix. Reduce timeout from 900s to 10s (3× the longest observed invocation).

aws lambda update-function-configuration --function-name <Lambda function A> --timeout 10

Risk. The longest invocation in the last 30 days took 20ms; the recommended 10s is at least 3× that. Rarer, longer invocations outside this window would fail at the new timeout.

Why it is waste. Deprecated runtimes no longer receive security patches from AWS. EOL 2025-12-15. Migrate to python3.13.

Fix. Update the runtime. EOL 2025-12-15. Migrate to python3.13.

Risk. Runtime migration may require code changes. Test thoroughly in a staging environment. Check for deprecated API usage in your function code.

Fix. Enable deletion protection to prevent accidental table deletion.

aws dynamodb update-table --table-name <DynamoDB table A> --deletion-protection-enabled

Risk. None: enabling deletion protection is non-destructive.

Why it is waste. Without a lifecycle policy, old and unused container images accumulate indefinitely, consuming ECR storage.

Fix. Add a lifecycle policy to automatically clean old images.

aws ecr put-lifecycle-policy --repository-name <ECR repository A> --lifecycle-policy-text '{"rules":[{"rulePriority":1,"description":"Keep only last 10 images","selection":{"tagStatus":"any","countType":"imageCountMoreThan","countNumber":10},"action":{"type":"expire"}}]}'

Risk. Review how many image versions your deployment process needs before setting the policy. Keep at least the last N images needed for rollback.

Why it is waste. Empty log groups are typically orphaned from deleted services and add unnecessary clutter.

Fix. Delete this empty log group to reduce clutter and free quota.

aws logs delete-log-group --log-group-name '<Log group A>'

Risk. Safe to delete. If a service recreates the log group, CloudWatch will create a new one automatically.

Why it is waste. Incomplete multipart uploads consume storage but are not usable. They are typically left behind by failed or interrupted uploads.

Fix. Abort the stale multipart uploads, and add a lifecycle rule (AbortIncompleteMultipartUpload after 7 days) so new ones are cleaned up.

Risk. Aborting a stale upload is safe; uploads under 7 days old are not flagged, since they may still be in progress. A lifecycle rule prevents future accumulation.

Fix. Enable point-in-time recovery or add this table to an AWS Backup plan.

Risk. Low: verify no other backup strategy covers this table before acting.

Why it is waste. This bucket has been empty for 234 days. It may have been created for testing or by a deployment tool and never used.

Fix. S3 bucket 'S3 bucket A' has been empty for 234 days. Consider deleting it to reduce console clutter and simplify IAM policies.

Risk. Verify no applications or scripts reference this bucket name before deleting. S3 bucket names are globally unique: once deleted, the name may be claimed by someone else.

Fix. Create a new encrypted EFS filesystem and migrate data with DataSync.

Risk. EFS encryption is set at creation time. Migration requires DataSync or rsync to a new filesystem.