# AWS Cost Audit Checklist

By Tanuj Garg · https://tanujgarg.com · Based on: https://tanujgarg.com/blog/finops-audit-checklist-reduce-aws-spend

Work through the steps in order. Do not resize or delete anything until step 1 is done, otherwise you are guessing.

Mark each item: [ ] not checked · [x] checked · [!] problem found

## 1. Make the bill explainable (attribution)

- [ ] Every resource is tagged with service, environment and owner.
- [ ] Cost allocation groups match how the system is actually split (API, workers, data pipelines, staging vs production).
- [ ] You can break spend down by region and by time window.
- [ ] You know the top cost categories: compute, storage, NAT / data transfer, managed services.
- [ ] You can answer: which service changed, which environment grew, and in which time window did the increase start?

If you cannot answer the last question, stop here and fix attribution first.

## 2. Rightsize compute using production metrics

- [ ] Compared average vs peak utilisation (p90 / p99), not only daily averages.
- [ ] Autoscaling thresholds checked against real traffic patterns.
- [ ] Consistently underused instances listed.
- [ ] Background workers and async pipelines checked for oversizing.
- [ ] Newer or cheaper instance families considered where compatible.

## 3. Clean up orphaned and abandoned resources

- [ ] Unattached volumes and old snapshots / images.
- [ ] Elastic IPs not attached to anything.
- [ ] NAT gateways and network paths nobody uses.
- [ ] Staging or test environments with no real traffic.
- [ ] Lifecycle policies and time-to-live rules added so cleanup does not need repeating.

## 4. Database efficiency

- [ ] Top queries by frequency and total time identified.
- [ ] Indexes checked against real query patterns.
- [ ] Repeated-query (N+1) patterns found and fixed.
- [ ] Timeouts and retries reviewed so failures do not multiply load.

## 5. Caching and data access

- [ ] Read-heavy endpoints that are safe to cache identified.
- [ ] Cache invalidation and authorisation rules written down.

## 6. Data transfer and network

- [ ] Cross-AZ traffic between internal services reviewed.
- [ ] Unnecessary egress to other regions or the internet reviewed.
- [ ] Log and metric shipping volume reviewed against how often it is used.

## 7. Guardrails so costs do not creep back

- [ ] Budgets and anomaly alerts per service or tag group.
- [ ] Tagging enforced on new resources.
- [ ] A recurring review (monthly is enough) with a named owner.

## Output: ranked fix list

| # | Finding | Estimated saving | Effort | Risk | Owner |
|---|---------|------------------|--------|------|-------|
|   |         |                  |        |      |       |

Rank by saving per unit of effort, then by risk. Do the safe, cheap items first.

---

Want a second pair of eyes? Book a free 30-minute technical review: https://cal.com/tanujgarg/30min