The AWS cost technique catalogue, the maths, and twenty pitfalls.

This part is the reference chapter: every technique from the 28 case studies organised by the AWS service it applies to (EC2, containers and serverless, storage, databases and caches, networking, observability, pricing and commitments), each with why it saves money, what to watch out for and which cases used it; the reusable back-of-envelope maths (payback period, S3 break-even, scheduling, NAT versus endpoints, the cost of one log line, cross-AZ chatter, sanity-checking a claimed saving, commitment sizing); and twenty pitfalls with a guard rail for each. Use it as a checklist during a cost review. Prices are approximate us-east-1 list prices as of September 2026 and change often, so confirm on the current AWS pricing pages before you rely on any figure.

1. How to use this reference

The earlier parts tell stories. This one is for the day you sit down with a Cost Explorer view and a coffee and need to know: what could I try on this line item, what could go wrong, and who has done it already? Find the service, read the row, and follow the cross-reference to the part that tells the full story.

Two cautions apply to everything below. First, prices quoted are approximate us-east-1 list prices as of September 2026; confirm current numbers before deciding. Second, every technique has a watch-out for a reason: each one is the residue of someone's near-miss or incident.

2. Compute: EC2

Technique	Why it saves	Watch-outs	Seen in
Delete idle and temporary instances	Stops paying for forgotten capacity and attached EBS	Verify ownership; stopped instances still pay for EBS and Elastic IPs	Levels.fyi 1, Duolingo
Right-size (Compute Optimizer)	Most fleets run far below capacity	Check memory as well as CPU; watch p99 latency	Segment, Duolingo
Graviton / newer generation	Around 20% lower price per instance, often better performance	Native dependencies, x86-only binaries, licensed software	Pinterest, Honeycomb, Zomato, Zendesk (Part 4)
Spot for tolerant workloads	Up to ~90% off On-Demand	Interruptions; diversify types and AZs; checkpoint	Salesforce, Lyft CI, Moneysmart, Tinybird (Part 5)
Bin-pack onto fewer instance types	Higher utilisation; simpler commitments	Noisy neighbours; blast radius	Segment
Schedule non-production	Pay only for working hours	Provide a self-service wake-up	Moneysmart

3. Compute: containers and serverless

Technique	Why it saves	Watch-outs	Seen in
ECS/Fargate task right-sizing	Tasks are billed on requested vCPU and memory, not usage	Duolingo found 90-95% memory utilisation safe; test your own	Duolingo, Levels.fyi 1
Lower minimum tasks, calmer scale-out	Fewer idle tasks off-peak	Keep headroom for cold starts	Duolingo, Levels.fyi 1
EKS: Karpenter plus consolidation	Just-in-time nodes, continuous repacking, Spot mix	Requires graceful shutdown and disruption budgets	Tinybird, Salesforce
EKS: right-size pod requests first	Schedulers pack requests, not usage	Use VPA recommendations; avoid OOM kills	Tinybird
EKS: stay on standard support	Extended-support versions carry a much higher control-plane fee (about $0.60 vs $0.10 per cluster-hour)	Plan upgrades on a cadence	General practice
Lambda on arm64	About 20% lower duration price, often faster	Check native modules and layers	Levels.fyi 1
Step Functions: avoid per-second transitions	Standard workflows bill per state transition	Use Express workflows or in-process orchestration for high volume	Prime Video (Part 6)

4. Storage: S3, EBS, backups, registries

Technique	Why it saves	Watch-outs	Seen in
S3 lifecycle to IA / Glacier IR / Deep Archive	Standard ~$0.023, IA ~$0.0125, Glacier IR ~$0.004, Deep Archive ~$0.00099 per GB-month	Per-object transition fees; 30/90/180-day minimums; 128 KB minimum billable size	Canva, Snap, Rewind, Levels.fyi 1, Pinterest (Part 3)
Measure access first	Storage Class Analysis and Storage Lens show real access	Product changes can reheat cold data	Canva
Expire noncurrent versions	Versioned buckets keep every overwrite forever by default	Keep enough history for recovery	Duolingo
Abort incomplete multipart uploads	Orphaned parts are billed but invisible in listings	Add a lifecycle rule to every bucket	General practice
Intelligent-Tiering	Automatic tiering for unpredictable access	Per-object monitoring fee; objects under 128 KB are not tiered	Airbnb
Pause event consumers during bulk transitions	Prevents a flood of storage-class events	Re-attach listeners afterwards	Levels.fyi 1
EBS gp2 to gp3	About 20% cheaper per GB; IOPS and throughput decoupled	Set IOPS/throughput to match gp2 burst if needed	Levels.fyi 1
Delete unattached volumes and old snapshots	Orphans accumulate after instance deletion	Snapshot before deleting	Segment, Levels.fyi 1
Tiered backup retention (grandfather-father-son)	Keeps recovery points while cutting copies	Document the policy for auditors	Levels.fyi 2
ECR lifecycle policies	Old images pile up per build	Keep images referenced by running or rollback releases	Levels.fyi 1

5. Databases and caches

Technique	Why it saves	Watch-outs	Seen in
Graviton classes and gp3 storage for RDS	Lower price per vCPU and per GB	Test extensions and drivers	Levels.fyi 1
Aurora I/O-Optimized	Removes per-I/O charges for I/O-heavy clusters	Evaluate when I/O is roughly a quarter or more of Aurora spend	Duolingo
DynamoDB key design	Capacity is sized by the hottest partition	Needs data-model changes	Segment
DynamoDB TTL	Automatic deletion of stale items	Does not clean existing rows unless you backfill the attribute	Duolingo
DynamoDB Standard-IA table class	Cheaper storage for large, rarely read tables	Higher read/write prices	Duolingo
Capacity mode review	On-demand for spiky, provisioned plus autoscaling for steady	Revisit as traffic matures	Lyft (top 25 tables)
Find orphaned caches and databases	Legacy features leave them behind	Check connections from inside first	Levels.fyi 1, Duolingo
Valkey engine for ElastiCache	Priced below Redis OSS on ElastiCache	Validate client compatibility	Levels.fyi 2
Database Savings Plans	Up to 35% off with a one-year, no-upfront commitment across engines and regions	Commit after right-sizing; one-year term only	Part 6

6. Networking and data transfer

Technique	Why it saves	Watch-outs	Seen in
S3 and DynamoDB gateway endpoints	Free; removes NAT processing (~$0.045/GB) for that traffic	Confirm every private route table has the prefix-list route	nOps, general practice
Interface endpoints for chatty AWS APIs	Cheaper than NAT for ECR pulls, CloudWatch, STS at volume	Hourly fee per AZ; do the maths	nOps
Zone-aware routing	Avoids cross-AZ charges (~$0.01/GB each way)	Balance capacity per AZ	DoorDash
Remove hairpins through CDN/WAF	Stops paying per-request edge prices for internal traffic	Replace edge caching first (shadow-run)	Levels.fyi 2
PrivateLink for overlapping CIDRs	Private connectivity without re-addressing networks	Check AZ coverage of endpoints	Levels.fyi 2
Trace bytes with VPC Flow Logs	Turns a network line item into a list of talkers	Flow logs have their own cost; sample	nOps
Release unused public IPv4 addresses	AWS charges for every public IPv4 address (about $0.005/hour each)	Prefer private subnets plus endpoints	General practice
Cheaper CDN or better cache-hit ratio	For content sites the CDN can be the largest line item	Egress and request pricing differ widely	Levels.fyi 1

7. Observability

Technique	Why it saves	Watch-outs	Seen in
Set log retention everywhere	CloudWatch log groups default to never expire	Keep audit logs per policy	Levels.fyi 1, Duolingo
Stop logging payloads and stack traces	Ingestion is priced per GB (around $0.50 in the standard class)	Keep error-level detail; sample the rest	Levels.fyi 2, Duolingo
Cheaper destinations for bulk logs	S3 (or the CloudWatch Infrequent Access class) is far cheaper for rarely read logs	Lose some real-time query features	Levels.fyi 2
Filter WAF/CDN logs	Keep blocked or suspicious requests, not every allowed one	Security team sign-off	Levels.fyi 2
Automated anomaly detection	Catches regressions within days	Tune thresholds per service	Duolingo

8. Pricing and commitments

Technique	Why it saves	Watch-outs	Seen in
Compute Savings Plans	Flexible across families, regions, Fargate and Lambda	Commit to the trough, not the average	Airbnb
Reserved Instances at high coverage	About 50% off for predictable baselines	Less flexible than Savings Plans	HERE
Database Savings Plans	Extends commitment discounts to databases, including serverless	One-year term only	Part 6
Managed-Spot or group-buying services	Outsourced optimisation for a share of savings	Fees (e.g. 20% of savings); resale rules	Moneysmart, Levels.fyi 1

9. The maths, gathered in one place

Every calculation here was used by a case-study team. Do the arithmetic for your own numbers; the point of each formula is to turn an opinion into a number you can argue about.

9.1 Payback period

payback_months = one_off_cost / monthly_saving

Canva: $1.6M divided by $0.3M a month is about 5.3 months. Rewind: $103K divided by $16K a month is about 6.4 months. 37signals: roughly $700K of hardware against about $160K a month of reduced cloud spend, recouped within 2023. Anything under six months is usually an easy yes; above eighteen months needs a strategic reason.

9.2 S3 transition break-even by object size

months = (0.02 / 1000) / (object_GB x (0.0125 - 0.004))

Average object size	Months to break even	Verdict
128 KB	19.3	Only if data will stay cold for years
200 KB	12.3	Marginal
400 KB	6.2	Canva's cut-off; good
1 MB	2.4	Excellent
4 MB	0.6	Immediate win

Glacier IR also bills a minimum of 90 days per object and 128 KB per object, and its retrieval charges are higher than Standard-IA's. Include expected retrieval volume if data is not truly cold. Part 3 works this in detail.

9.3 Scheduling non-production

Schedule	Hours per week	Compute saving vs 24x7
24 x 7	168	0%
Weekdays 07:00-22:00 (Moneysmart)	75	55%
Weekdays 08:00-20:00	60	64%
Weekdays 09:00-19:00	50	70%

9.4 NAT gateway versus gateway endpoint

A workload in private subnets pushing 10 TB a month to S3 through a NAT gateway pays about 10,240 GB times $0.045, roughly $461 a month in processing, plus about $33 per NAT gateway per month in hourly charges (times the number of AZs). Through an S3 gateway endpoint the same traffic costs nothing extra. For ECR image pulls, CloudWatch or STS, interface endpoints cost about $0.01 per hour per AZ plus $0.01 per GB, which beats NAT once volume is more than a few hundred GB a month.

9.5 The cost of one log line

A Lambda invoked 50 million times a month that logs a 20 KB event on every call writes roughly 950 GB a month. At around $0.50 per GB ingested, that is about $475 a month before storage, and storage keeps growing if the log group never expires. A 200-byte summary line instead writes about 9.5 GB, roughly $5 a month: the same 99% reduction Levels.fyi saw.

9.6 Cross-AZ chatter

Two services exchanging 50 TB a month across AZs pay about $0.01 per GB in each direction, around $1,000 a month. If zone-aware routing keeps 80% of that traffic local, the charge falls to roughly $200. The saving grows linearly with every new hop in a microservice call chain.

9.7 Sanity-checking a claimed saving

Levels.fyi cut RDS snapshot storage from 15.7 TB to 3 TB and reported about $1,200 a month in savings. At roughly $0.095 per GB-month for RDS backup storage beyond the free allowance, 12.7 TB is about $1,235 a month, which matches. Reproducing a claimed saving from list prices is a quick way to check that you understand where the money went.

9.8 Commitment sizing

• Finish right-sizing, Graviton moves and scheduling first; commitments freeze the footprint.
• Look at hourly eligible spend over the last 30-60 days and commit to roughly its trough, not its average.
• Ladder purchases (for example quarterly) so commitments expire at different times and can track change.
• Track coverage (discounted share of eligible usage) and utilisation (share of commitment used); aim high on utilisation before pushing coverage.
• Prefer Compute Savings Plans and Database Savings Plans when your instance families or engines are still changing.

9.9 Three yes/no checklists

Is it a Spot candidate?	Is it Graviton-ready?	Would leaving pay off?
Stateless or checkpointed; tolerates a two-minute termination notice; runs on several instance types; horizontally scaled; retries are cheap	Interpreted or JVM runtime, or you control the build; no x86-only binaries or licensed agents; base images published for arm64; CI can build multi-arch images; benchmark on production-like load	Load is steady and predictable; storage and egress dominate the bill; few managed-service dependencies; in-house ops and hardware skills; existing racks, power and contracts

10. Twenty pitfalls and their guard rails

Pitfall	Seen in	Guard rail
Committing before optimising	HERE (context), general	Right-size and modernise first; commit to the new trough
Trusting the last few days in Cost Explorer	Levels.fyi 2	Check a control line item; wait several days
Deleting based on activity graphs	Levels.fyi 1	Inspect from inside (INFO, connections); snapshot first
Bulk storage-class changes firing events	Levels.fyi 1	Pause or filter S3 event consumers during transitions
Ignoring transition fees and minimum durations	Canva, Rewind	Compute payback per bucket; align ages with minimums
Assuming a new TTL cleans old data	Duolingo	Backfill the TTL attribute or run a one-off purge
Never reverting incident scale-ups	Segment	Create a scale-down ticket in every incident review
Staging larger than production	Duolingo	Budget alerts per environment; schedules for non-prod
Per-transition orchestration in hot loops	Prime Video	Estimate cost per unit of work; keep inner loops in memory
Internal traffic hairpinning through the edge	Levels.fyi 2	Private paths (PrivateLink, endpoints) for service calls
Gateway endpoint without the route	nOps	Audit route tables for the S3/DynamoDB prefix-list route
Round-robin across AZs by default	DoorDash	Zone-aware or topology-aware routing with balanced capacity
Spot or consolidation without graceful shutdown	Tinybird	SIGTERM handling, PDBs, readiness probes first
Single-instance proofs of concept	Levels.fyi 2	Test across every AZ and instance group before cutover
Timeouts that measure the wrong thing	Levels.fyi 2	Measure on an idle path; do not discard completed work
Lift-and-shift without modernisation	GEICO	Right-size and re-architect during migration
Comparing exits to On-Demand list prices	OneUptime (critics)	Compare with the best cloud price including SP and Spot
Maximal compliance retention	Levels.fyi 2	Define, document and follow a tiered retention policy
Logging full payloads and stack traces	Levels.fyi 2, Duolingo	Summary lines, sampling, error-only in loops
Forgetting double-running costs	Dropbox	Budget for parallel systems during migrations
Group-buying commitments without checking terms	Levels.fyi 1	Verify current AWS resale and pooling rules

The pitfalls cluster into four families: order (commit before optimising), evidence (trusting graphs and fresh billing data), side effects (event floods, hairpins, churn) and scope (one-instance proofs of concept, lift-and-shift). Most guard rails are a habit rather than a tool: snapshot first, price the one-off, test across every zone, and keep a ticket to undo every emergency scale-up.

Which section of this catalogue should I start with?

Start with observability and storage: log retention, versioning, multipart-upload aborts and lifecycle rules are the lowest-risk, highest-certainty rows, and they appear in nearly every case study. Then networking (endpoints), then compute swaps, and commitments last.

Are these prices still correct?

They are approximate us-east-1 list prices as of September 2026 and change frequently. Use them to understand the shape of each trade-off and always confirm on the current AWS pricing pages.

How do I sanity-check a saving someone claims?

Reproduce it from list prices, as in the RDS backup example: 12.7 TB at about $0.095 per GB-month is roughly $1,235 a month, matching the reported $1,200. If the numbers do not reconcile, the scope or the assumption is different from what you think.

Takeaways

• Use the catalogue per service. Find the line item, read the watch-out, then read the case.
• Log retention, versioning, multipart aborts and lifecycle rules are the lowest-risk rows and appear everywhere.
• The maths fits on one page: payback, S3 break-even, schedules, NAT versus endpoints, log lines, cross-AZ, sanity checks, commitment sizing.
• Pitfalls cluster into order, evidence, side effects and scope.
• Confirm prices before relying on any figure; the shape of the trade-off matters more than the third digit.

References & further reading

• Cutting the AWS Bill: 28 Case Studies (PDF) - sections 5 (technique catalogue), 6 (maths) and 7 (pitfalls) are the basis of this part.
• AWS pricing overview · S3 pricing · VPC pricing (NAT, endpoints)
• S3 storage class prices and lifecycle policies
• AWS - Lambda functions on Graviton2
• Vantage - NAT gateway vs VPC endpoint savings