Most AWS cost waste comes from resources that are doing something — just not enough to justify their size. Orphaned resources are the other category: things that aren't doing anything at all, because whatever they were attached to is already gone, and nothing ever cleaned them up.
Nothing points to any of these anymore — no attached instance, no traffic, no reference in a template. The billing doesn't know that.
Elastic IPs stopped being free to sit idle
For years, an Elastic IP was free as long as it was attached to a running instance and only billed hourly once detached. AWS changed this — unattached (and now, in-use-but-idle) Elastic IPs carry an hourly charge regardless of attachment state. An account that's been reassigning IPs for years without ever releasing the old ones is a very common source of a small, steady, easy-to-miss line item.
Load balancers with nothing behind them
An ALB or NLB left pointed at a target group with zero healthy targets — because the service behind it was decommissioned, migrated, or replaced — keeps billing its hourly rate and LCU usage indefinitely. It's easy to miss because it doesn't show up as an error anywhere; it just quietly serves 5xx responses to nobody.
Snapshots outliving their volume
EBS snapshots are cheap per GB individually, but they accumulate — automated backup jobs create one a day, the source volume gets deleted during cleanup, and the snapshots keep being generated (or simply keep sitting there) with no volume left to restore into that anyone remembers needing. Multiply by every volume that's ever been decommissioned and it adds up to a real number.
Finding them without a manual sweep
- AWS Config or Trusted Advisor's "unassociated Elastic IP" and "idle load balancer" checks catch most of this automatically if either is already enabled.
- A scheduled script against the EC2 and ELB APIs — unattached EIPs, target groups with zero healthy targets, snapshots whose source volume ID no longer resolves — covers the same ground without a paid tool if none of the above is already in place.
- Tag resources with an owner and a review date at creation time; orphaned resources are almost always resources nobody was accountable for finding again.