AWS FinOps — Cost Optimization & Reservations

This skill covers AWS cost optimization: identifying waste, right-sizing workloads, choosing the right storage classes and instance families, planning commitment purchases (Savings Plans, RIs, reserved nodes for RDS/ElastiCache/OpenSearch/Redshift/DynamoDB), and using AWS-native cost tooling (Cost Explorer, CUR, Compute Optimizer, Trusted Advisor, Budgets).

Scripts: Always run scripts with --help first. Scripts call the AWS CLI and assume credentials are already configured (env vars, profile, or instance role). Do not read script source unless debugging the script itself.

References: Load reference files on demand. Do not pre-load all references.

Slash commands: Users can also invoke these directly:

• /finops-skills:finops-audit [account-or-profile] — Account-wide waste audit (idle resources, untagged spend, gp2 volumes, old snapshots)
• /finops-skills:finops-rightsize [resource-id] — Analyze a workload (EC2 / RDS / ASG) and recommend instance/RDS sizing
• /finops-skills:finops-commit — Recommend a coordinated reservation portfolio (Savings Plans + RDS/ElastiCache/OpenSearch RIs)

Where the Money Usually Goes

In most AWS accounts, the top cost drivers — in order — are:

1. EC2 / Fargate / Lambda compute — biggest line item; biggest savings lever via right-sizing + Compute Savings Plans + Graviton + Spot.
2. RDS — second largest in data-heavy accounts; Multi-AZ doubles cost; reservations matter.
3. Data transfer — silent killer. NAT Gateway, cross-AZ, cross-region, internet egress.
4. S3 — usually cheap per GB but huge volumes; storage class + lifecycle is the lever.
5. EBS — gp2 is almost always wrong now; gp3 is cheaper and faster.
6. ElastiCache / OpenSearch / Redshift — significant when present; reservations available.
7. Idle/orphaned resources — unattached EBS, idle ELBs, unused EIPs, old snapshots, dev environments left running.

Go after these in order of impact, not in order of "easy."

Optimization Decision Tree

"My AWS bill is too high"
│
├─ First: get the data
│  ├─ Cost Explorer: group by SERVICE (1-month) → top 5 services
│  ├─ Cost Explorer: group by USAGE_TYPE on the top service
│  └─ If you have CUR + Athena: query by account, tag, resource_id
│
├─ Top driver = EC2 / Fargate / Lambda?
│  ├─ Compute Optimizer → right-size recommendations (free)
│  ├─ Move dev/test to Spot or schedule off-hours
│  ├─ Migrate to Graviton (~20% cheaper, often faster)
│  ├─ Buy a Compute Savings Plan to cover stable baseline
│  └─ Read references/compute.md
│
├─ Top driver = RDS?
│  ├─ Right-size with Performance Insights + Compute Optimizer for RDS
│  ├─ gp2 → gp3 storage (cheaper + faster)
│  ├─ Aurora I/O-Optimized if I/O > 25% of cost
│  ├─ Buy RDS Reserved Instances for steady-state prod
│  └─ Read references/reservations.md (RDS section)
│
├─ Top driver = Data Transfer?
│  ├─ NAT Gateway hot? → VPC Endpoints for S3/DynamoDB/ECR/etc.
│  ├─ Cross-AZ? → Co-locate chatty services in one AZ (with HA tradeoff)
│  ├─ CloudFront in front of S3/ALB to cut egress
│  └─ Read references/networking.md
│
├─ Top driver = S3?
│  ├─ Enable Storage Lens (free dashboard) → identify cold buckets
│  ├─ Intelligent-Tiering for unknown/changing access patterns
│  ├─ Lifecycle rules to transition old objects to IA/Glacier
│  ├─ Delete incomplete multipart uploads (silent waste)
│  └─ Read references/storage.md
│
├─ Top driver = EBS?
│  ├─ gp2 → gp3 migration (always wins under most workloads)
│  ├─ Find unattached volumes (waste)
│  ├─ Snapshot lifecycle (DLM) — old snapshots accumulate
│  └─ Read references/storage.md
│
└─ Lots of small line items?
   ├─ Run idle/waste audit → scripts/find-idle-resources.sh
   ├─ Untagged spend → scripts/untagged-spend.sh
   └─ Read references/waste.md

The 12 Highest-Leverage Wins (Quick Reference)

In rough order of savings-per-effort. Most accounts have at least 3-4 of these.

1. gp2 → gp3 EBS migration — typically 20% cheaper and faster. Online conversion, no downtime. Run scripts/ebs-gp2-to-gp3-audit.sh.
2. Compute Savings Plan for steady baseline — 1yr No Upfront on stable EC2/Fargate/Lambda usage = ~27% off, no lock-in pain. Most flexible commitment AWS offers.
3. Delete unattached EBS volumes + old snapshots — pure waste. Run scripts/find-idle-resources.sh.
4. VPC Endpoints for S3, DynamoDB, ECR, Secrets Manager — eliminates NAT Gateway data processing fees for those flows.
5. S3 Intelligent-Tiering on large buckets — automatic, low risk, ~30-70% off cold data.
6. RDS Reserved Instances for prod databases — DBs are the most steady-state workload you have. 1yr All Upfront ~40% off, 3yr All Upfront ~60%.
7. Right-size EC2 + RDS — Compute Optimizer is free and surprisingly accurate; act on its recommendations.
8. Migrate to Graviton (ARM) — ~20% cheaper, often higher perf. Easy for managed services (RDS, ElastiCache, OpenSearch); requires rebuild for EC2.
9. Schedule non-prod off-hours — dev/test stopped nights + weekends = ~70% off those workloads. Use Instance Scheduler or simple Lambda.
10. NAT Gateway audit — collapse to one per region if possible (HA tradeoff), or use NAT Instance for low-traffic non-prod.
11. Spot for batch/CI/stateless — up to 90% off. Karpenter / EKS managed node groups make this safe.
12. Reserved nodes for ElastiCache / OpenSearch / Redshift — same pattern as RDS RIs. Often missed because teams only think about EC2.

Reservation Quick Reference

Full decision tree, math, and modification rules in Reservations Reference. Quick lookup:

Rules of thumb:

• For EC2/Fargate/Lambda: prefer Compute Savings Plan unless you have a very specific reason. Most flexible, covers all three.
• For RDS/ElastiCache/OpenSearch/Redshift: there is no Savings Plan. You must use Reserved Instances / Reserved Nodes, and they are strictly scoped (especially ElastiCache/OpenSearch — no size flex).
• Term: start with 1-year unless you are 100% sure of 3-year stability. Cloud usage shifts; 3-year regret is real.
• Payment: No Upfront has ~75-85% of the savings of All Upfront with zero capital risk. Default to No Upfront unless cash is sitting idle.
• Coverage target: aim for ~70-80% of steady-state baseline reserved. Leave headroom for variability.
• Utilization target: aim for >95% utilization on what you do reserve. Anything lower means you over-bought.

Cost Tooling Quick Reference

For Cost Explorer queries, CUR + Athena recipes, and Compute Optimizer workflow, read Tooling Reference.

Diagnostic Scripts

All scripts use the AWS CLI. Set AWS_PROFILE or AWS_REGION as needed. Run with --help for full options.

Idle Resource Finder

bash scripts/find-idle-resources.sh                      # current region
bash scripts/find-idle-resources.sh --region us-east-1
bash scripts/find-idle-resources.sh --all-regions        # slow but thorough

Finds: unattached EBS volumes, unused Elastic IPs, idle ELBs (no requests), stopped EC2 (still paying for EBS), snapshots older than 90 days, unattached ENIs.

EBS gp2 → gp3 Audit

bash scripts/ebs-gp2-to-gp3-audit.sh
bash scripts/ebs-gp2-to-gp3-audit.sh --apply             # actually convert (with confirmation)

Lists every gp2 volume with estimated monthly savings if migrated to gp3. Optionally performs the online migration.

Untagged Spend

bash scripts/untagged-spend.sh --tag-key Owner
bash scripts/untagged-spend.sh --tag-key CostCenter --region eu-west-1

Reports resources missing a required tag, grouped by service. Use to drive a tagging cleanup before allocating cost.

Reservation Coverage

bash scripts/reservation-coverage.sh                     # all services
bash scripts/reservation-coverage.sh --service rds
bash scripts/reservation-coverage.sh --expiring-days 60

Reports current SP/RI coverage and utilization across EC2, RDS, ElastiCache, OpenSearch, Redshift; flags reservations expiring soon.

Reference Files

Load these as the task requires:

• [Compute Reference](./references/compute.md) — EC2 right-sizing, instance family selection, Spot strategy, Graviton migration, Auto Scaling cost patterns, Fargate vs EC2 economics, Lambda cost tuning.

• [Storage Reference](./references/storage.md) — EBS (gp2/gp3/io2/st1/sc1) selection, EBS snapshot lifecycle (DLM), S3 storage classes (Standard, IA, One Zone-IA, Glacier tiers, Intelligent-Tiering), S3 lifecycle rules, incomplete multipart uploads, cross-region replication cost.

• [Networking Reference](./references/networking.md) — NAT Gateway costs and alternatives (NAT Instance, VPC Endpoints), data transfer matrix (intra-AZ free, cross-AZ paid, cross-region, internet egress), CloudFront economics, VPC peering vs Transit Gateway, PrivateLink.

• [Waste Reference](./references/waste.md) — Idle resource catalog, dev/test scheduling patterns, snapshot/AMI cleanup, untagged spend strategy, account hygiene.

• [Reservations Reference](./references/reservations.md) — Full decision tree, payment math, scoping rules, modification/exchange rules for: Compute SP, EC2 Instance SP, EC2 Standard/Convertible RIs, RDS RIs, ElastiCache reserved nodes, OpenSearch reserved instances, Redshift reserved nodes, DynamoDB reserved capacity.

• [Tooling Reference](./references/tooling.md) — Cost Explorer recipes, CUR + Athena query library, Compute Optimizer workflow, Trusted Advisor cost checks, AWS Budgets templates, CUDOS dashboard setup.

• [Organizations Reference](./references/organizations.md) — Multi-account FinOps: OU structure, RI/SP sharing, SCP templates (region lockdown, instance allowlist, tag enforcement, public-S3 deny), Tag Policies, budget kill-switches, service-quota guardrails, org-level CUR.

• [EKS Reference](./references/eks.md) — Karpenter (Spot + Graviton + consolidation), pod right-sizing (VPA/Goldilocks), HPA + KEDA, ALB Ingress aggregation, ECR pull-through cache + VPC endpoints, Container Insights tuning, Fargate vs EC2 decision, Kubecost / OpenCost for namespace attribution, reservations strategy for EKS.

Quick Task Reference