# unusd.cloud Product: read-only AWS scans across 30+ services and every region. Weekly digest by email. Full report in the app. Waste followed per resource over time. 51+ detections. 5-minute setup. Made by ZOPH.IO (SIREN 880 003 322), a French SASU. Product data stays in AWS eu-west-1. People with access to production are in the EU. DPA on request. Consulting under the zoph.io brand is a separate practice of the same company. unusd.cloud is the product. Paid plans are on AWS Marketplace. - Home: https://unusd.cloud/ - About: https://unusd.cloud/about - Community: https://unusd.cloud/community - Security / DPA: https://unusd.cloud/security - For consultancies: https://unusd.cloud/for-aws-consultancies - Blog index: https://unusd.cloud/blog - Sign in: https://app.unusd.cloud/auth/signin - Start free scan: https://app.unusd.cloud/auth/signup - AWS Marketplace: https://aws.amazon.com/marketplace/pp/prodview-tbt4lnvfo6ycy ## Blog posts (full text) ### You cannot optimize AI spend you cannot see URL: https://unusd.cloud/blog/you-cannot-optimize-ai-spend-you-cannot-see Date: 2026-10-10T14:00:00Z A year ago the Bedrock line was a proof of concept. Someone in a sandbox tried a model, showed a demo, and turned it off. That is no longer the shape of the bill. Inference is in the product now. A support bot. A document pass. A nightly summary. An agent that retries when the first answer is thin. Prompt caching got turned on because the second call felt faster. The same workflow landed in a second account, then a third. Finance sees one number going up. The team that owns the prompts sees a console they open when something breaks. Between those two views, the month is gone. The tools were built for a different bill AI usage grew into a standing cost, and the monitoring most companies already trust was built for EC2, S3, and data transfer. A Bedrock charge often shows up as its own service name per model. The token mix sits in usage-type strings: input, output, cache read, cache write. Cost Explorer could total the spend. It could not say which model, and which kind of token, took it. On 8 October 2026, AWS added Bedrock product attributes to Cost Explorer, Budgets, and Dashboards, for usage from 1 September 2026. Model and token type are labels now, not something you reconstruct from a usage type. That gap is why so many teams are stuck. They know AI spend is up. They cannot say whether the dollars are a large model, a flood of output tokens, or a cache that writes on every call and almost never gets read. A chart of "Bedrock, up" is a worry. It is not a decision. You cannot optimize what you cannot see. "Move to a smaller model" is a guess until you know the large model took most of the account, and that a third of the dollars were cache writes. A cache that writes and barely reads is a different fix from a model that is too big for the task. Both used to look identical on the invoice. What the scan shows now When an account's Bedrock bill is at least $10 this month, or was at least $10 last month, the account report carries a card: Bedrock, where it went. The model, its share, and the token type. The executive digest lists every account whose current month is at least $10, with the model and the token types next to the org total. Example account, October month to date. Bedrock $1,840. Claude Opus 5 is 78 percent, $1,436. Sonnet 4.6 is $312. Haiku 4.5 is $92. Output tokens $980, cache writes $620, input tokens $200, cache reads $40. Recoverable savings on this card: $0. The figure is an example account. The shape is the point. Opus took most of the month. Output tokens took about half of the dollars. Cache writes took another third, and cache reads were almost nothing. That is a prompt rebuilding its cache, or a cache that never gets a second hit. You can see it on the weekly report, and you can go look. Recoverable waste on this card is $0. A detached volume is a resource you can delete. A Bedrock charge is usage that already happened. We will not invent a savings number for switching models. The waste rules stay the waste rules. This card is the picture of the AI bill, in the same report as the idle resources. What is still off the card Model and token type are on the bill. The application, and the person who called it, are not. Those show up after a cost allocation tag is active on an application inference profile, a Bedrock project, or the IAM principal. Tags count from the day you enable them. Last month stays unlabeled. On-demand, batch, provisioned throughput, and the reranker are a real split in the same AWS data. This card uses model and token type, which is where the tokens went. SageMaker, and the rest of your AI spend, stay on the service list. They are outside this card. See it on the next scan If Bedrock is already on the invoice, the next scan puts the split on the account report. When the current month is at least $10, the executive digest names that account too. Under $10, the card stays off. A demo that cost a few dollars does not need a paragraph. Run a scan. Then open the account that actually calls the model. Related: Cost Explorer shows the total. A scan names the idle resource. Catch spend drift before the invoice. --- ### The scan forgot the volume we deleted URL: https://unusd.cloud/blog/finding-ledger-when-unused-aws-resources-clear Date: 2026-09-23T11:00:00Z The second audit was always the awkward one. I would come back a month later. The volumes were gone. The new sheet was shorter. Finance would ask what we had actually saved. I had last month's spreadsheet if I had remembered to save it, and a Slack thread if I had not. The resource id was the only way to know it was the same volume. Once it left AWS, a fresh export could not see it. A scan is a photograph. It shows what is unused today. It does not remember March. What we keep We keep a ledger of the findings, not a second copy of the account. For each one: the resource id, the ARN, the account, the region, the monthly estimate, and whether it is still open. The next complete scan looks that row up. If the resource is no longer a finding, it cleared. You deleted it, you attached it, or you whitelisted it. Same signal. You decided. We record that the finding closed. If a scan does not finish a region, we do not mark the missing ones cleared. A failed pass is not a cleanup. A spreadsheet used to do the same trick: the rows that never loaded looked like savings. Timeline of one volume in the finding ledger. Scan 1 finds it. Scan 2 still sees it. You delete it. Scan 3 skips eu-west-1, so the finding stays open. Scan 4 is complete and marks it cleared: $44 a month realized. What you can tell finance The first email is potential. Realized savings are the findings that cleared. Slack and Teams say how many cleared since the last complete scan. In the app, the trend stays on that resource, so the volume from March is still a line you can point at after it is gone. Cost Explorer may show the bill dipping. It will not name the volume. We do not store your inventory. No user-data, no bucket contents, no second CMDB. The ledger is the identity of the finding, so the story survives the next Monday. Related: the bill that grew while nobody was looking. Run a scan, delete one thing you already meant to delete, and look at the next report. That is the whole demo. --- ### The account form dies around account 40 URL: https://unusd.cloud/blog/public-api-to-register-aws-accounts Date: 2026-09-23T10:00:00Z I have watched a platform lead add accounts by hand. Friendly name. Schedule. Who gets the email. Next account. Around the fifteenth one, the tab and the person are both tired. Account 40 sits in a spreadsheet and never gets added. Then someone asks why the org scan missed a sandbox in ap-southeast-2. It was not a detection gap. Nobody registered the account. Two different jobs The role is the part you should still read. CloudFormation, Terraform, or StackSets. You inspect the template. We assume it with an ExternalId that belongs to your org. Nothing in the account changes. A scan does not start until that role exists. The form is the other job. It only tells us which account to scan, when, and where to send the digest. Clicking it a hundred times does not make the scan more careful. It makes the list incomplete. What the API is for On Startup and above, an admin creates a key in Team settings. It expires. You copy the secret once. We store a hash of it, not the secret. Then a script does what the form did. PUT each 12-digit account id with the name, the schedule, the recipients, the tags. POST when you want a scan now, and poll until that account finishes. Omitted fields stay as they were, so you are not resending the whole config to change a tag. Individual stays on the dashboard. One account does not need this. The API does not create the IAM role, and it does not delete a volume. StackSets can land the role across the org. The script lands the registration. Both have to happen, or you get a row in our app and no scan, or a role in AWS that nobody asked us to use. If you are about to click Add account for the twentieth time, stop and write the loop. Start with one account if you have not seen a scan yet. --- ### Cost Explorer shows spend. It does not find idle AWS. URL: https://unusd.cloud/blog/cost-explorer-wont-find-idle-aws-resources Date: 2026-08-23T13:00:00Z Updated: 2026-09-23T07:30:00Z Open Cost Explorer after a noisy month. You will see services, accounts, and maybe a forecast. You will not see vol-0abc sitting unattached since March in a region nobody opens. That is the gap. Native AWS is good at the bill. It is weak at naming the resource you can turn off this week. Two panels. Cost Explorer: EC2-Other up 18 percent month over month. A waste scan: vol-0a1b, 500 GB gp3 unattached since March, $44 a month; nat-0f1e, NAT gateway under 1 MB a day, $32.85 a month; an unattached Elastic IP, $3.65 a month. What each tool answers | Tool | What it answers | Where it stops | | --- | --- | --- | | Cost Explorer | Spend by service, account, and time. | It does not name the idle resource. | | Compute Optimizer | A smaller size for EC2, EBS, Lambda, and a few other families. | It skips detached volumes, idle NAT gateways, unused Elastic IPs, and old snapshots. | | Cost Optimization Hub | Some of those recommendations in one console, after you opt in. | It is not a weekly list in email or Slack. | | Budgets | An alert when spend crosses a line you set. | It does not say which resource crossed it. | | unusd.cloud | Idle and unused resources, with account, region, and a monthly estimate. | It does not replace the bill, and it does not change AWS. | Keep Cost Explorer, or a CUR in a warehouse, when the question is where the money went. Keep Budgets so someone hears about a threshold. unusd.cloud does not replace either. Trusted Advisor has cost checks too. Many of them need a paid support plan, and someone still has to open the console. Cost Anomaly Detection flags a weird spend shape. It still does not name the NAT. What the scan adds A read-only IAM role and 55+ fixed rules across 30+ services and every enabled region. The result is a weekly email you can forward, with the resource, the account, the region, and a monthly estimate. The rules are deterministic. You can explain a finding to an auditor. If you opted in to Cost Optimization Hub, its recommendations show up next to the idle checks. You still delete, stop, or whitelist. Nothing in the account changes unless you change it. Related: find idle resources without living in the CLI, EKS extended support. If the question is what to turn off this week, run a scan. --- ### Navi: ask the scan, not the open web URL: https://unusd.cloud/blog/navi-ask-your-aws-scan-not-the-internet Date: 2026-08-23T12:00:00Z Generic chatbots are happy to tell you how AWS pricing works. They will also invent an instance ID. That is useless at 17:30 when you need to ping the owner of acme-staging. Navi sits on the other side of a real scan. The scan is boring on purpose: read-only AWS APIs, fixed rules, a list of findings with dollars and regions. Navi reads that list. It does not browse the web for "best practices." What you actually get In the app you get a ranked pack: what to do this week, estimated monthly waste, effort, CLI, console link. You can filter to one account or region. Then you ask follow-ups in a thread: why is this still here, what is the risk if we delete it, draft the Slack message. Answers have to cite IDs and amounts that appeared in the scan. If the model makes up a volume, we drop that step. Navi does not start, stop, or delete anything. You paste the command when your change process says so. Your prompts are not used to train foundation models. Memory and custom instructions are opt-in, for org facts the scan cannot see (no Reserved Instances, prod is sacrosanct, tags you care about). Who this is for Platform and FinOps people who already trust the finding and need a draft, a sequence, or a sentence for a ticket. Not a replacement for the report. The weekly email stays short. The pack lives in the dashboard (Business and Enterprise). If you wanted an agent that "optimizes AWS" by itself, this is not that. If you wanted an engineer who read this week's scan and can talk about it, that is Navi. Connect an account, wait for a scan, then open the app. There is nothing to ask until there is a finding. --- ### A Telegram digest for people who do not live in #finops URL: https://unusd.cloud/blog/telegram-channel-for-aws-executive-cost-digest Date: 2026-08-23T11:00:00Z Your CTO is not in the Slack channel where the NAT findings land. They will not open Cost Explorer. They will glance at a phone on Tuesday morning and ask "are we still leaking." That is what the management report is for. One org-level digest: spend so far, waste rate, a short briefing, a handful of actions, no instance IDs. Email already did this. A lot of leadership teams live in Telegram instead of Slack. What we post (and what we do not) On Enterprise you can send that digest to a Telegram Channel you create. You bring the bot. We do not join as some shared unusd user. The message is a short HTML card: numbers, this week's actions, a button to the full web report. We do not dump every account scan into the channel. Scan detail still goes to email, Slack, Teams, or SNS. Telegram is the rollup, on purpose. A 400-finding firehose trains people to mute the bot. The digest has org figures only. No volume IDs, no keys, no "please delete i-0abc." If someone needs the resource list, they open the app. Why not only email Email is easy to forward and easy to bury. A channel with the CFO, the VP of engineering, and the FinOps lead is a standing meeting that does not need a calendar invite. Public or private channel, your rules. Revoke the bot token and it stops. Setup is in the dashboard under management reports: bot token, channel id, frequency. The next scheduled digest posts there. You can keep email too. If you are the person who already lives in #finops, you do not need this. If you are trying to get a number in front of people who will never install Slack, this is the path. Marketplace and private offers are available when procurement wants the spend on the AWS bill. The digest is the same product either way. --- ### Catch AWS spend drift before the invoice URL: https://unusd.cloud/blog/aws-spend-drift-before-the-invoice Date: 2026-08-23T10:00:00Z The invoice is a lagging indicator. By the time finance forwards the PDF, the runaway EMR cluster has been up for 19 days. AWS Budgets can fire at a threshold you guessed in January. Cost Anomaly Detection can fire on a shape you do not recognize. Both still live in a console most engineers ignore. Drift in unusd.cloud is simpler: we watch the spend we already pull for scans, learn what "normal" looks like on your accounts, and flag a rise that does not match that history. A noisy sandbox is not treated like a flat prod billing account. A drop is noted. A spike is the alert. Thirty days of daily spend for acme-prod. It stays inside its usual range of $950 to $1,110, then climbs to $1,420 in three days, 38 percent above baseline. Forecast is the other half Cost Explorer's forecast is a single number, late in the month, and it does not give you an end-of-year view. We put a low / mid / high end-of-month estimate on the scan, plus an end-of-year range that follows your actual month-to-month trend, not "MTD times twelve." That is what a CFO asks in week two: "are we still on the number we booked." A platform manager asks: "which account broke the pattern." Same data, two altitudes. The management report rolls the forecast up. The per-account scan keeps the detail. What this is not It is not GuardDuty. A crypto miner can look like drift. You still need security tooling. It is not a promise that every alert is waste. A planned launch will look like a spike. Whitelist and context exist so you are not paged for Black Friday. Startup plans and above include drift. Forecasting shows up on the scan and on the exec digest. Neither one deletes resources. They tell you to look now, not on the 6th of next month. Pair this with idle detection. Drift says the number moved. The waste rules say which NAT and which volume. Cost Explorer will not do that pairing. --- ### Your Jenkins box does not work weekends. It still bills them. URL: https://unusd.cloud/blog/stop-paying-for-aws-nights-and-weekends Date: 2026-08-23T09:00:00Z Ask a platform team which boxes must run on Sunday. The honest list is short: prod, maybe a standby, maybe a build cache you have measured. The actual list in AWS is the same as Friday afternoon, plus whatever someone started for a demo and never tagged. Working hours waste is not "the instance is idle." It is busy Monday to Friday, 08:00-18:00, and asleep the rest of the week, while the meter runs at 100 percent. A bastion. Jenkins. A fat RDS used by analysts who do not work Saturdays. You already know this. The bill does not care. A week grid for a dev Jenkins box: busy Monday to Friday, 08:00 to 18:00, which is 50 of 168 hours. The other 118 hours are billed while idle. Native AWS almost gets you there Instance Scheduler, scaling plans, and a well-written tag policy can stop this. Plenty of teams built that in 2019 and then the tag rot started. New accounts never got the stack. Someone launched an untagged m5.2xlarge for a hotfix and left it. Cost Explorer will show you a higher EC2 line. It will not say "these three names are weekday-only." Compute Optimizer may suggest a smaller size. It will not suggest "turn it off at 18:00." What the scan reports unusd.cloud looks at usage shape over time and flags resources that look like a working-hours schedule. The report shows the names, the busy window, and a monthly figure if you stopped them outside that window. You still apply the scheduler, the tag, and the change ticket. Read-only, as usual. That finding sits next to fully idle instances and detached volumes so you do not run two tools to ask two obvious questions. Non-prod is where this pays. If you stop a 24/7 prod database because a blog post told you to, that is on you. The scan is a list. You are the change manager. Run it on a sandbox first. If the first digest names a Jenkins box that has been up since 2024, you already know the rest. --- ### Buy unusd.cloud on AWS Marketplace (one bill, no new vendor) URL: https://unusd.cloud/blog/unusd-cloud-is-now-available-on-aws-marketplace-simpler-smarter-and-directly-on-your-aws-bill Date: 2025-06-10T10:00:00Z Updated: 2026-08-23T13:00:00Z If you have ever tried to add a SaaS tool in a company that already lives on AWS, you know the delay is not the product. It is the vendor form, the credit card, the legal entity nobody has seen before. unusd.cloud is listed on AWS Marketplace. The subscription lands on the AWS invoice you already pay. No second card. No new supplier file for a lot of teams. That matters for a FinOps or platform lead who already got a "yes" from engineering and is now stuck in procurement. It also matters for consultants who cannot put a random SaaS charge on a client card. What you are buying Same product: read-only scans, weekly digest, full report in the app, Navi on Business and above. Marketplace is how you pay, not a different scanner. Need custom terms, a private offer, or a paper trail for security review? Email support@unusd.cloud. We will write the offer in Marketplace so finance can approve it like any other AWS line. You can still start on the free Individual plan with one account and 30 scans, then move the org to Marketplace when you are ready. --- ### EKS extended support is a $0.60/hour tax. Plan the upgrade. URL: https://unusd.cloud/blog/aws-extended-eks-support-hidden-costs-and-how-to-avoid-them Date: 2025-02-03T05:00:00Z Updated: 2026-09-23T19:00:00Z When an EKS version leaves standard support, AWS does not turn the cluster off. It moves you to extended support. That is $0.60 per cluster per hour, six times the $0.10 standard control plane. Roughly $365 extra a month, per cluster, before worker nodes. Ten clusters left behind after a busy quarter is not a thought experiment. It is a line item that looks like "we didn't add traffic" and still grows. One EKS control plane for a year: $876 on standard support at $0.10 an hour, $5,256 on extended support at $0.60 an hour. Ten clusters left behind add $43,800 a year. Extended support is a delay, not a strategy. You get more time on an old Kubernetes version. You do not get the rest of the ecosystem frozen with you. Controllers, CRDs, and add-ons move on. Security patches are narrower. New features stay on newer versions. It is not only EKS The same pattern exists on other managed engines. RDS, OpenSearch, and ElastiCache charge extra when you stay past standard support. The unit is often vCPU-hours, so a multi-node datastore hurts more than one idle cluster. AWS documents the dates. Someone still has to map version to cluster to account. Cost Explorer will not title the line "you are on extended support." You see a higher EKS or RDS spend and start a thread. What to do Upgrade before the date, with a test cluster and a rollback. Treat "we will do it next quarter" as a budget decision, not a default. If you truly cannot move, know the hourly tax and put an owner on it. unusd.cloud flags extended-support risk on EKS, RDS, OpenSearch, and ElastiCache next to idle waste, in the same read-only scan. Platform teams get the list in Slack or email. Leadership gets the rollup, not a Kubernetes changelog. Scan an account if you are not sure which clusters already crossed the line. --- ### The $32 NAT that never shows up in standup URL: https://unusd.cloud/blog/low-signals-these-small-amounts-that-are-draining-your-aws-budget Date: 2024-12-15T13:37:00Z Updated: 2026-08-23T13:00:00Z A NAT gateway is about $32 a month before you send a byte. An unused Elastic IP is a few dollars. A gp3 volume you forgot is a few more. None of these get a Jira ticket. Together they are the "why is the bill up, we didn't ship anything" thread. Cost Explorer rolls them into service totals. You see "EC2-Other" and "VPC." You do not see "this NAT in the old shared-services VPC has no traffic." Where the quiet charges live Networking. NAT with no throughput. Interface VPC endpoints you no longer use (hourly, even idle). Load balancers in abandoned test stacks. Storage. Unattached EBS. Snapshots from a migration that ended. AMIs copied "for rollback" in 2022. S3 buckets of fixture data. Log groups with no expiry. Compute that is almost off. Stopped RDS still bills storage. SageMaker endpoints after a workshop. Dev EC2 that is only busy 08:00-18:00 and still runs Saturday. One developer leaving two fat instances, a couple of volumes, a NAT, and an RDS leftover is not a cartoon. It is a normal week. Multiply by a 10-person squad and three regions. A receipt for one forgotten test stack in us-east-1: NAT gateway $32.85, snapshots $25.00, load balancer $16.43, VPC endpoint $14.60, gp3 volume $8.00, Elastic IP $3.65. $100.53 a month for one stack, $1,206 a month for twelve. No line on that receipt would get a ticket. Twelve copies across accounts and regions is a real number. What does not fix it A single Cost Explorer dashboard. A quarterly cleanup day. A wiki page of CLI commands. Those help once. Then someone creates tmp-debug-2 in ap-northeast-1. You need a repeating pass that names the resource, the account, the region, and a dollar estimate, then lands in Slack or email. Tags help ownership. They do not find untagged leftovers. unusd.cloud is that pass: read-only, every region, 55+ detection rules. We do not promise a percent. We list the NAT. You delete it, or you whitelist it if it is real. Related: idle resources without living in the CLI, Cost Explorer vs a waste scan. --- ### How to find idle AWS resources without living in the CLI URL: https://unusd.cloud/blog/uncover-hidden-aws-costs-a-guide-to-spotting-idle-resources Date: 2024-09-24T13:37:00Z Updated: 2026-09-23T19:00:00Z I used to send clients a shell history. CPU near zero. RDS with no connections. Volumes in available. Snapshots older than anyone on the team. It works. It also takes a day, and it is stale the next morning. If you want the DIY version for one account and one region: EC2. CloudWatch CPUUtilization and network packets, not a single 5-minute dip. An instance can look idle at noon and busy at 03:00. RDS. DatabaseConnections at zero for a week is a smell. Confirm it is not a replica you still need. EBS. Unattached volumes are the easy win: ``bash aws ec2 describe-volumes \ --query "Volumes[?State=='available'].[VolumeId,Size]" \ --output table ` Elastic IPs. An address that is not attached to anything still bills by the hour: `bash aws ec2 describe-addresses \ --query "Addresses[?AssociationId==null].[PublicIp,AllocationId]" \ --output table ` Snapshots. Sort yours by age and read the top of the list. The oldest ones usually belong to a migration that ended: `bash aws ec2 describe-snapshots --owner-ids self \ --query "sort_by(Snapshots,&StartTime)[].[SnapshotId,VolumeSize,StartTime,Description]" \ --output table ` NAT gateways. About $32 a month each before a single byte. List them, then check a week of outbound traffic per gateway. Near zero means nothing uses it: `bash aws ec2 describe-nat-gateways \ --filter Name=state,Values=available \ --query "NatGateways[].[NatGatewayId,VpcId]" \ --output table aws cloudwatch get-metric-statistics \ --namespace AWS/NATGateway --metric-name BytesOutToDestination \ --dimensions Name=NatGatewayId,Value=nat-0123456789abcdef0 \ --start-time 2026-09-16T00:00:00Z --end-time 2026-09-23T00:00:00Z \ --period 604800 --statistics Sum ` Logs. Log groups with no retention fill quietly: `bash aws logs describe-log-groups \ --query "logGroups[?retentionInDays==null].[logGroupName,storedBytes]" \ --output table ` Every command above covers one region. Loop over the regions your account has enabled: `bash for region in $(aws ec2 describe-regions --query "Regions[].RegionName" --output text); do echo "== $region" aws ec2 describe-volumes --region "$region" \ --query "Volumes[?State=='available'].[VolumeId,Size]" \ --output text done ` Then do the same for load balancers with no targets, SageMaker endpoints, ElastiCache, and RDS snapshots. Then do it for every account. This is why the audit became a product. Why this is a bad weekly ritual A FinOps engineer can run the CLI. A CTO will not. A platform manager with 40 accounts will not do it every Monday. The miss is always the same: us-west-2 was in the script, eu-central-1` was not, and that is where the demo VPC still lives. unusd.cloud runs 55+ checks like these on a schedule, with a read-only role, in every region you enabled. You still choose what to delete. Idle resources are also attack surface. An open sandbox with an old key is not only a cost problem. Connect one account if you are done maintaining the script. --- ### More Lambda memory can cost less. Idle Lambda still costs. URL: https://unusd.cloud/blog/aws-lambda-hack-boost-memory-to-slash-costs-and-turbocharge-heavy-workloads Date: 2024-09-20T05:00:00Z Updated: 2026-08-23T13:00:00Z Lambda bills memory times duration. CPU rides along with the memory slider. For a tight numeric job, 1024 MB that finishes in 2.5s can beat 512 MB that crawls for 6s. You pay a higher rate for fewer milliseconds. That is a real lever. It is also a lab result. Unit prices move. Your payload is not our payload. Measure with AWS Lambda Power Tuning on your function, then pick a size. Do not copy a blog table into production. Two different problems Right-sizing memory is for functions that actually run. The other problem is quieter: functions that almost never run, or that sit on x86 in a region where Arm is cheaper, or that were given 3008 MB "to be safe" and peak at 200. Cost Explorer will show you a Lambda line. It will not tell you which function is over-provisioned. Compute Optimizer can, for memory, if you opened it. Most teams do not. What we flag unusd.cloud is not a profiler. We do not retune every handler. The scan looks for waste you can act on without a research project: idle patterns, over-sized memory vs observed use, and x86 functions that are candidates for Arm where it is available. Navi can then draft the change notes from those findings. It does not deploy them. If Lambda is a rounding error on your bill, skip this. If it is a product surface, tune the hot paths and delete the cold ones. Run a read-only scan when you want the idle list instead of another spreadsheet. --- ### AWS bill shock is usually a forgotten account, not a hack URL: https://unusd.cloud/blog/aws-cost-optimization-horror-stories-and-solutions Date: 2023-04-04T06:00:00Z Updated: 2026-08-23T13:00:00Z In 2014 a Hacker News user wrote that the scariest thing about AWS was accidentally going broke while learning it. The thread is still right. The threads that go viral mix two different failures. A stolen key that mines crypto is a security incident. GuardDuty, SCPs, and a broken-glass process belong there. unusd.cloud will not replace that. The other failure is quieter, and it is the one we built for. Someone opened an account for a proof of concept. The company moved on. Three years later the bill is still landing. Or a sandbox in ap-southeast-2 that nobody has logged into since the last reorg. Reddit is full of those: $15k because services kept running, $20k on an account nobody remembered. Why the console is a bad watchdog AWS will sell you more capacity in seconds. It will not nag you when that capacity goes idle. Budgets help if someone set them, on the right account, with an email that still works. Cost Anomaly Detection flags spend shape. It does not say "this NAT has no traffic" or "this EBS volume is detached." If you are a platform lead, you already know the pattern. Dev accounts sprawl. Tags are optional. The person who created the cluster left. Finance sees the total. Engineering sees 90 accounts and 20 regions. What to do before the screenshot lands 1. Put a budget and an anomaly alert on every account, including the ones you think are empty. 2. Scan for idle and orphaned resources on a schedule, in every region, not when someone has a free afternoon. 3. Send the result to people who can act (Slack, Teams, email), and a short rollup to people who sign the invoice. That third point is the gap Cost Explorer leaves. A director will not live in the billing console. A weekly digest they can forward beats a 40-tab investigation after month close. unusd.cloud runs those scans with a read-only role. The first pass is free. For the hack-shaped bills, lock down IAM and turn on GuardDuty. For the forgotten-account bills, look at what is still running. --- ### The AWS bill that grew while nobody was looking URL: https://unusd.cloud/blog/how-unusd-cloud-can-slash-your-cloud-bill Date: 2023-04-04T05:00:00Z Updated: 2026-08-23T13:00:00Z Finance sends the screenshot on a Monday. The line item is up. Nobody shipped a new product. The staging account did what staging accounts do: it kept the lights on. A three-person platform team left a few m5s running after a load test. Three gp3 volumes never got attached again. An Aurora instance sat there "in case we need the dump." Elastic IPs nobody routes to. None of this is dramatic. All of it is a monthly charge. That is the usual story. Not a crypto miner. Not a misconfigured Lambda. A test that ended, a person who changed teams, a region nobody opens in the console. What Cost Explorer will not tell you Cost Explorer is good at "EC2 in eu-west-1 went up." It is weak at "this volume has been available for 40 days and still bills." Trusted Advisor and Compute Optimizer help on a subset of services, if you remember to open them, if the support plan unlocks the check, if someone owns the ticket. The waste that hurts most is boring: - EC2 that idles all week - RDS stopped for more than a week (you still pay storage) - NAT gateways with almost no traffic - SageMaker endpoints left after a demo - Snapshots and AMIs kept "just in case" What we actually do unusd.cloud is the audit I used to run by hand for clients. You deploy a read-only IAM role (CloudFormation, Terraform, or StackSets). We scan 30+ services in every enabled region with 55+ fixed rules. Nothing in the account changes unless you change it. You get a weekly email you can forward. We do not invent a "you will save 20 percent" number. The first scan lists resources, regions, and a monthly estimate. You decide what to stop, delete, or whitelist. If you want the same pass on one account, start a free scan. No credit card. For how this sits next to Cost Explorer, read the comparison.