Most AWS bills are read from the top. Someone opens Cost Explorer, sees EC2 and RDS at the top of the list, decides those are "the bill", and closes the tab. The lines that follow are each a few percent, so none of them looks worth an afternoon.
Added together, those small lines are routinely a third of the invoice. They're also the easiest money on it, because almost none of them is load-bearing. Here are the ones we find most often, and how to check yours.
1. NAT gateway data processing
Every gigabyte that leaves a private subnet through a NAT gateway is billed twice: an hourly charge for the gateway itself, and a per-gigabyte processing charge on top of normal transfer. Chatty services in private subnets, container images pulled on every deploy, and traffic to S3 that isn't using a VPC endpoint all land here.
Check it: group Cost Explorer by usage type and look for NatGateway-Bytes. If it's material, the usual fix is a gateway VPC endpoint for S3 and DynamoDB, which costs nothing per gigabyte.
2. Cross-AZ traffic
Spreading services across availability zones is good practice. Chatting across them constantly is not. Traffic between zones is billed in both directions, so a service that talks to a database in another zone on every request pays for the privilege twice.
Check it: look for DataTransfer-Regional-Bytes. Zone-aware routing or moving talkative pairs into the same zone usually fixes it without touching redundancy.
3. EBS snapshots nobody deleted
Snapshots are cheap individually and automated by default, which is precisely why they accumulate. Teams often carry years of them for volumes that no longer exist.
Check it: list snapshots older than your actual retention policy. Write the policy down first, then enforce it with a lifecycle rule rather than a cleanup script someone has to remember to run.
4. Unattached volumes and idle load balancers
Terminating an instance doesn't necessarily delete its volume, and deleting a service doesn't delete the load balancer in front of it. Both keep billing quietly.
Check it: filter EC2 volumes by available status, and look for load balancers with no healthy targets. Confirm before deleting, then delete.
5. CloudWatch logs with no retention
The default log group retention in CloudWatch is "never expire". Most teams discover this when ingestion and storage together have become one of the larger lines on the bill.
Check it: list log groups where retention is unset. Pick a retention period per group deliberately. For logs you must keep long-term, export to S3 and let a lifecycle rule move them to a colder storage class.
6. S3 with no lifecycle policy
Object storage is cheap enough that nobody thinks about it until several terabytes of build artifacts, old exports and staging data have accumulated in the standard storage class, alongside incomplete multipart uploads that are invisible in the console but still billed.
Check it: enable S3 Storage Lens, add a lifecycle rule to abort incomplete multipart uploads, and move anything older than a few months to an infrequent-access or archival class.
7. Commitments that no longer fit
Savings Plans and Reserved Instances are the biggest lever on an AWS bill and the easiest to get wrong in both directions. Buying none leaves the discount on the table. Buying for a shape you've since outgrown leaves you paying for capacity you don't use.
Check it: look at both coverage and utilisation, not just one. And rightsize before you commit, because committing to today's oversized fleet locks the waste in for a year.
How to do this in an afternoon
Open Cost Explorer, set the granularity to daily and the group-by to usage type, and sort descending. Work down the list and ask one question of each line: who chose this? Anything nobody chose is a candidate.