Cloud Cost Optimization Rules

AWS Rules

Application Load Balancer

Application Load Balancers with no Registered Targets

AWS Application Load Balancers forward client requests to a backend target group. A target group consists of multiple registered targets in different availability zones, such as EC2 instances. AWS Load Balancers with no registered targets can increase your monthly AWS costs.

• NIST 800-53 LOW
• NIST 800-53 MODERATE
• NIST 800-53 HIGH
• NIST 800-171
• CIS CRITICAL CONTROLS
• FedRAMP LOW
• FedRAMP MODERATE
• FedRAMP HIGH
• PCI DSS
• AWS Well-Architected (Reliability)
• CMMC
• ACSC ISM
• ISO27001
• DISA IL2
• DISA IL4
• DISA IL5

Idle Application Load Balancers

AWS Application Load Balancers distribute and forward network traffic across multiple instances in different Availability Zones. Idle or unused AWS Application Load Balancers can increase your monthly AWS costs.

• NIST 800-53 LOW
• NIST 800-53 MODERATE
• NIST 800-53 HIGH
• NIST 800-171
• CIS CRITICAL CONTROLS
• FedRAMP LOW
• FedRAMP MODERATE
• FedRAMP HIGH
• PCI DSS
• AWS Well-Architected (Reliability)
• CMMC
• ACSC ISM
• ISO27001
• DISA IL2
• DISA IL4
• DISA IL5

Aurora DB Cluster

Idle Amazon Aurora DB Clusters

Amazon Aurora DB Clusters are groups of one or more DB instances managed by a cluster volume. Idle or unused AWS Aurora DB clusters can increase your monthly AWS costs.

• NIST 800-53 LOW
• NIST 800-53 MODERATE
• NIST 800-53 HIGH
• NIST 800-171
• CIS CRITICAL CONTROLS
• FedRAMP LOW
• FedRAMP MODERATE
• FedRAMP HIGH
• PCI DSS
• AWS Well-Architected (Reliability)
• CMMC
• ACSC ISM
• ISO27001
• DISA IL2
• DISA IL4
• DISA IL5

Classic Load Balancer

Classic Load Balancers with no Registered Instances

AWS Classic Load Balancers forward client requests to a backend instance group consisting of multiple registered instances in different availability zones. AWS Load Balancers with no registered instances can increase your monthly AWS costs.

• NIST 800-53 LOW
• NIST 800-53 MODERATE
• NIST 800-53 HIGH
• NIST 800-171
• CIS CRITICAL CONTROLS
• FedRAMP LOW
• FedRAMP MODERATE
• FedRAMP HIGH
• PCI DSS
• AWS Well-Architected (Reliability)
• CMMC
• ACSC ISM
• ISO27001
• DISA IL2
• DISA IL4
• DISA IL5

Idle Classic Load Balancers

AWS Classic Load Balancers distribute and forward network traffic across multiple instances in different Availability Zones. Idle or unused AWS Classic Load Balancers can increase your monthly AWS costs.

• NIST 800-53 LOW
• NIST 800-53 MODERATE
• NIST 800-53 HIGH
• NIST 800-171
• CIS CRITICAL CONTROLS
• FedRAMP LOW
• FedRAMP MODERATE
• FedRAMP HIGH
• PCI DSS
• AWS Well-Architected (Reliability)
• CMMC
• ACSC ISM
• ISO27001
• DISA IL2
• DISA IL4
• DISA IL5

DynamoDB Table

DynamoDB Tables with Zero Items

Empty or unused AWS DynamoDB Tables may violate the principle of least functionality and increase your monthly AWS costs.

• NIST 800-53 LOW
• NIST 800-53 MODERATE
• NIST 800-53 HIGH
• NIST 800-171
• CIS CRITICAL CONTROLS
• FedRAMP LOW
• FedRAMP MODERATE
• FedRAMP HIGH
• PCI DSS
• AWS Well-Architected (Reliability)
• CMMC
• ACSC ISM
• ISO27001
• DISA IL2
• DISA IL4
• DISA IL5

EBS Snapshot

Orphaned EBS Snapshots older than 30 days

Amazon Elastic Block Storage (EBS) Spanshots are incremental backups of EBS volumes stored in Amazon S3 and help restore data to new EBS volumes. Keeping EBS snapshots older than 30 days can increase your monthly AWS costs.

• NIST 800-53 LOW
• NIST 800-53 MODERATE
• NIST 800-53 HIGH
• NIST 800-171
• CIS CRITICAL CONTROLS
• FedRAMP LOW
• FedRAMP MODERATE
• FedRAMP HIGH
• PCI DSS
• AWS Well-Architected (Reliability)
• CMMC
• ACSC ISM
• ISO27001
• DISA IL2
• DISA IL4
• DISA IL5

EBS Volume

EBS Volumes Attached to a Stopped EC2 Instance

Amazon Elastic Block Storage (EBS) volumes are storage devices attached to an instance, similar to physical hard drives. AWS EBS volumes attached to stopped EC2 instances may violate the principle of least functionality and increase your monthly AWS costs.

• NIST 800-53 LOW
• NIST 800-53 MODERATE
• NIST 800-53 HIGH
• NIST 800-171
• CIS CRITICAL CONTROLS
• FedRAMP LOW
• FedRAMP MODERATE
• FedRAMP HIGH
• PCI DSS
• AWS Well-Architected (Reliability)
• CMMC
• ACSC ISM
• ISO27001
• DISA IL2
• DISA IL4
• DISA IL5

EBS Volumes Not Marked For "Delete On Terminate"

Amazon Elastic Block Storage (EBS) volumes are storage devices attached to an instance, similar to physical hard drives. Retaining AWS EBS volumes attached to terminated EC2 instances may violate the principle of least functionality and increase your monthly AWS costs.

• NIST 800-53 LOW
• NIST 800-53 MODERATE
• NIST 800-53 HIGH
• NIST 800-171
• CIS CRITICAL CONTROLS
• FedRAMP LOW
• FedRAMP MODERATE
• FedRAMP HIGH
• PCI DSS
• AWS Well-Architected (Reliability)
• CMMC
• ACSC ISM
• ISO27001
• DISA IL2
• DISA IL4
• DISA IL5

GP3 EBS Volumes with greater than 3000 IOPS provisioned

Checks for any EBS Volumes with more than 3000 IOPS provisioned.

IO EBS volumes

Check to see if the Instance these EBS volumes are connected to actually need these more expensive volumes.

Idle EBS volumes

Amazon Elastic Block Storage (EBS) volumes are storage devices attached to an instance, similar to physical hard drives. Idle or unused AWS EBS volumes can increase your monthly AWS costs.

• NIST 800-53 LOW
• NIST 800-53 MODERATE
• NIST 800-53 HIGH
• NIST 800-171
• CIS CRITICAL CONTROLS
• FedRAMP LOW
• FedRAMP MODERATE
• FedRAMP HIGH
• PCI DSS
• AWS Well-Architected (Reliability)
• CMMC
• ACSC ISM
• ISO27001
• DISA IL2
• DISA IL4
• DISA IL5

Unattached EBS Volume

Amazon Elastic Block Storage (EBS) volumes are storage devices attached to an instance, similar to physical hard drives. AWS EBS volumes unattached from EC2 instances may violate the principle of least functionality and increase your monthly AWS costs.

• NIST 800-53 LOW
• NIST 800-53 MODERATE
• NIST 800-53 HIGH
• NIST 800-171
• CIS CRITICAL CONTROLS
• FedRAMP LOW
• FedRAMP MODERATE
• FedRAMP HIGH
• PCI DSS
• AWS Well-Architected (Reliability)
• CMMC
• ACSC ISM
• ISO27001
• DISA IL2
• DISA IL4
• DISA IL5

EC2 Instance

Idle EC2 Instances

Amazon Elastic Compute Cloud (EC2) are virtual servers deployed in an AWS account. Idle or unused AWS EC2 Instances can increase your monthly AWS costs.

• NIST 800-53 LOW
• NIST 800-53 MODERATE
• NIST 800-53 HIGH
• NIST 800-171
• CIS CRITICAL CONTROLS
• FedRAMP LOW
• FedRAMP MODERATE
• FedRAMP HIGH
• PCI DSS
• AWS Well-Architected (Reliability)
• CMMC
• ACSC ISM
• ISO27001
• DISA IL2
• DISA IL4
• DISA IL5

Stopped EC2 Instances

Amazon Elastic Compute Cloud (EC2) are virtual servers deployed in an AWS account. While stopped AWS EC2 Instances do not incur charges, the Elastic IP addresses and EBS volumes attached to stopped instances can increase your monthly AWS costs.

• NIST 800-53 LOW
• NIST 800-53 MODERATE
• NIST 800-53 HIGH
• NIST 800-171
• CIS CRITICAL CONTROLS
• FedRAMP LOW
• FedRAMP MODERATE
• FedRAMP HIGH
• PCI DSS
• AWS Well-Architected (Reliability)
• CMMC
• ACSC ISM
• ISO27001
• DISA IL2
• DISA IL4
• DISA IL5

Elastic IP Address

Elastic IP Address not associated with an AWS Resource

AWS Elastic IP addresses are public IPv4 addresses associated with an AWS resource, such as an instance, Internet gateway, NAT gateway, or load balancer. Disassociated Elastic IP addresses can increase your monthly AWS costs.

• NIST 800-53 LOW
• NIST 800-53 MODERATE
• NIST 800-53 HIGH
• NIST 800-171
• CIS CRITICAL CONTROLS
• FedRAMP LOW
• FedRAMP MODERATE
• FedRAMP HIGH
• PCI DSS
• AWS Well-Architected (Reliability)
• CMMC
• ACSC ISM
• ISO27001
• DISA IL2
• DISA IL4
• DISA IL5

NAT Gateway

Idle NAT Gateways

AWS NAT Gateways enable instances in a private subnet to connect to systems and services outside the VPC in which they reside but prevent external systems and services from initiating connections to those instances. Idle or underutilized NAT Gateways can increase your monthly AWS costs.

• NIST 800-53 LOW
• NIST 800-53 MODERATE
• NIST 800-53 HIGH
• NIST 800-171
• CIS CRITICAL CONTROLS
• FedRAMP LOW
• FedRAMP MODERATE
• FedRAMP HIGH
• PCI DSS
• AWS Well-Architected (Reliability)
• CMMC
• ACSC ISM
• ISO27001
• DISA IL2
• DISA IL4
• DISA IL5

Network Load Balancer

Idle Network Load Balancers

AWS Network Load Balancers distribute and forward network traffic across multiple targets in an attached target group without modifying the headers. Idle or unused AWS Network Load Balancers can increase your monthly AWS costs.

• NIST 800-53 LOW
• NIST 800-53 MODERATE
• NIST 800-53 HIGH
• NIST 800-171
• CIS CRITICAL CONTROLS
• FedRAMP LOW
• FedRAMP MODERATE
• FedRAMP HIGH
• PCI DSS
• AWS Well-Architected (Reliability)
• CMMC
• ACSC ISM
• ISO27001
• DISA IL2
• DISA IL4
• DISA IL5

Network Load Balancers with no Registered Targets

AWS Network Load Balancers forward network traffic from clients to a backend target group. A target group consists of multiple registered targets in different availability zones, such as EC2 instances. AWS Load Balancers with no registered targets can increase your monthly AWS costs.

• NIST 800-53 LOW
• NIST 800-53 MODERATE
• NIST 800-53 HIGH
• NIST 800-171
• CIS CRITICAL CONTROLS
• FedRAMP LOW
• FedRAMP MODERATE
• FedRAMP HIGH
• PCI DSS
• AWS Well-Architected (Reliability)
• CMMC
• ACSC ISM
• ISO27001
• DISA IL2
• DISA IL4
• DISA IL5

RDS DB Instance

Idle RDS Instances

Amazon Relational Database Service (RDS) instances are database servers deployed in an AWS account. RDS instances contain one or more user-created databases. Idle or unused AWS RDS instances can increase your monthly AWS costs.

• NIST 800-53 LOW
• NIST 800-53 MODERATE
• NIST 800-53 HIGH
• NIST 800-171
• CIS CRITICAL CONTROLS
• FedRAMP LOW
• FedRAMP MODERATE
• FedRAMP HIGH
• PCI DSS
• AWS Well-Architected (Reliability)
• CMMC
• ACSC ISM
• ISO27001
• DISA IL2
• DISA IL4
• DISA IL5

Previous Generation RDS Instances

Amazon recommends upgrading RDS instances to the latest generations for best performance.

• NIST 800-53 MODERATE
• NIST 800-53 HIGH
• NIST 800-171
• CIS CRITICAL CONTROLS
• FedRAMP MODERATE
• FedRAMP HIGH
• PCI DSS
• CMMC
• ACSC ISM
• ISO27001
• DISA IL2
• DISA IL4
• DISA IL5

RDS Instances that are Using Provisioned IOPS SSDs

Checks for any RDS Database Instances using privisioned IOPS SSDs.

Redshift Cluster Node

Idle Redshift Cluster Nodes

Amazon Redshift is a data warehouse service consisting of clusters with one or more databases that can store sensitive information. Idle or unused AWS Redshift Cluster Nodes can increase your monthly AWS costs.

• NIST 800-53 LOW
• NIST 800-53 MODERATE
• NIST 800-53 HIGH
• NIST 800-171
• CIS CRITICAL CONTROLS
• FedRAMP LOW
• FedRAMP MODERATE
• FedRAMP HIGH
• PCI DSS
• AWS Well-Architected (Reliability)
• CMMC
• ACSC ISM
• ISO27001
• DISA IL2
• DISA IL4
• DISA IL5

Underutilized Redshift Cluster Nodes

Down-sizing underutilized Redshift Clusters can help reduce your monthly AWS costs.

• ISO27001

S3 Bucket

S3 Bucket Name is not DNS compliant

AWS recommends following best practices for naming S3 buckets. Except for S3 buckets used for hosting static websites, you should avoid using dots (.) in bucket names to ensure support for virtual-host-style addressing over HTTPS, S3 Transfer Acceleration, and future AWS features.

• NIST 800-53 LOW
• NIST 800-53 MODERATE
• NIST 800-53 HIGH
• FedRAMP LOW
• FedRAMP MODERATE
• FedRAMP HIGH
• DISA IL2
• DISA IL4
• DISA IL5

Workspace

Unhealthy Workspaces

Unhealthy Workspaces can cause reliability and performance issues.

• AWS Well-Architected (Reliability)

Workspaces with no user activity in the last 14 days

Deleting unused AWS Workspaces reduces unnecessary configuration items, increases the accuracy of cloud inventories, and reduces the monthly AWS costs.

• NIST 800-53 LOW
• NIST 800-53 MODERATE
• NIST 800-53 HIGH
• NIST 800-171
• CIS CRITICAL CONTROLS
• FedRAMP LOW
• FedRAMP MODERATE
• FedRAMP HIGH
• PCI DSS
• AWS Well-Architected (Reliability)
• CMMC
• ACSC ISM
• ISO27001
• DISA IL2
• DISA IL4
• DISA IL5

Azure Rules

Application Gateway

Idle Application Gateways

Azure Application Gateways distribute and route traffic to web applications based on HTTP attributes. Idle or underutilized Application Gateways may violate the principle of least functionality and increase your monthly Azure costs.

• NIST 800-53 LOW
• NIST 800-53 MODERATE
• NIST 800-53 HIGH
• NIST 800-171
• CIS CRITICAL CONTROLS
• FedRAMP LOW
• FedRAMP MODERATE
• FedRAMP HIGH
• PCI DSS
• AWS Well-Architected (Security)
• AWS Well-Architected (Reliability)
• CMMC
• ACSC ISM
• ISO27001
• DISA IL2
• DISA IL4
• DISA IL5

Cosmos DB Account

Unused Cosmos DB Accounts

Azure Cosmos DB is a serverless NoSQL database service fully managed by Microsoft. Unused or underutilized Cosmos DB accounts may violate the principle of least functionality and increase your monthly Azure costs.

• NIST 800-53 LOW
• NIST 800-53 MODERATE
• NIST 800-53 HIGH
• NIST 800-171
• CIS CRITICAL CONTROLS
• FedRAMP LOW
• FedRAMP MODERATE
• FedRAMP HIGH
• PCI DSS
• AWS Well-Architected (Security)
• AWS Well-Architected (Reliability)
• CMMC
• ACSC ISM
• ISO27001
• DISA IL2
• DISA IL4
• DISA IL5

Underutilized Cosmos DB Accounts

Down-sizing underutilized Azure Cosmos DB accounts can reduce your monthly Azure costs.

• AWS Well-Architected (Security)
• AWS Well-Architected (Reliability)
• ACSC ISM
• ISO27001

Disk

Detached Managed Disks

Azure Managed Disks are block-level storage volumes attached to Azure Virtual Machines. When Virtual Machines are deleted, any attached disks remain in the Azure subscription to prevent data loss and continue to incur charges. Deleting unattached Azure Disks is consistent with the principle of least functionality and can help lower your monthly Azure costs.

• NIST 800-53 LOW
• NIST 800-53 MODERATE
• NIST 800-53 HIGH
• NIST 800-171
• CIS CRITICAL CONTROLS
• FedRAMP LOW
• FedRAMP MODERATE
• FedRAMP HIGH
• PCI DSS
• AWS Well-Architected (Security)
• AWS Well-Architected (Reliability)
• CMMC
• ACSC ISM
• ISO27001
• DISA IL2
• DISA IL4
• DISA IL5

Load Balancer

Idle Load Balancers

Azure Load Balancers distribute and forward network traffic across multiple backend resources or servers. Idle or underutilized Load Balancers may violate the principle of least functionality and increase your monthly Azure costs.

• NIST 800-53 LOW
• NIST 800-53 MODERATE
• NIST 800-53 HIGH
• NIST 800-171
• CIS CRITICAL CONTROLS
• FedRAMP LOW
• FedRAMP MODERATE
• FedRAMP HIGH
• PCI DSS
• AWS Well-Architected (Security)
• AWS Well-Architected (Reliability)
• CMMC
• ACSC ISM
• ISO27001
• DISA IL2
• DISA IL4
• DISA IL5

MySQL Flexible Server + MySQL Server

Underutilized MySQL Servers

Down-sizing underutilized Azure MySQL Servers can help reduce your monthly Azure costs.

• AWS Well-Architected (Security)
• AWS Well-Architected (Reliability)
• ACSC ISM
• ISO27001

PostgreSQL Flexible Server

PostgreSQL Flexible Servers with Low IOPs

Down-sizing underutilized Azure PostgreSQL Servers accounts can help reduce your monthly Azure costs.

• AWS Well-Architected (Security)
• AWS Well-Architected (Reliability)
• ACSC ISM
• ISO27001

PostgreSQL Server

Underutilized PostgreSQL Servers

Down-sizing underutilized Azure PostgreSQL Servers accounts can help reduce your monthly Azure costs.

• AWS Well-Architected (Security)
• AWS Well-Architected (Reliability)
• ACSC ISM
• ISO27001

Public IP Address

Disassociated Public IP Addresses

Azure Public IP addresses enable Azure resources to communicate with and be reachable from external sources. Deleting Public IP addresses not associated with an Azure network resource reduces unnecessary configuration items, increases the accuracy of cloud inventories, streamlines network management, and may lower monthly Azure costs.

• NIST 800-53 LOW
• NIST 800-53 MODERATE
• NIST 800-53 HIGH
• NIST 800-171
• CIS CRITICAL CONTROLS
• FedRAMP LOW
• FedRAMP MODERATE
• FedRAMP HIGH
• PCI DSS
• AWS Well-Architected (Security)
• AWS Well-Architected (Reliability)
• CMMC
• ACSC ISM
• ISO27001
• DISA IL2
• DISA IL4
• DISA IL5

SQL Server

Underutilized SQL Servers

Down-sizing underutilized Azure SQL Servers accounts can help reduce your monthly Azure costs.

• AWS Well-Architected (Security)
• AWS Well-Architected (Reliability)
• ACSC ISM
• ISO27001

Traffic Manager Profile

Idle Traffic Manager Profiles

Azure Traffic Managers distribute and route client requests to Internet-facing applications via the global Azure regions using DNS. Idle or underutilized Traffic Managers profiles may violate the principle of least functionality and increase your monthly Azure costs.

• NIST 800-53 LOW
• NIST 800-53 MODERATE
• NIST 800-53 HIGH
• NIST 800-171
• CIS CRITICAL CONTROLS
• FedRAMP LOW
• FedRAMP MODERATE
• FedRAMP HIGH
• PCI DSS
• AWS Well-Architected (Security)
• AWS Well-Architected (Reliability)
• CMMC
• ACSC ISM
• ISO27001
• DISA IL2
• DISA IL4
• DISA IL5

Virtual Machine

Idle Virtual Machines

Azure Virtual Machines (VM) are virtual servers deployed in a Microsoft Azure subscription. Idle or underutilized Virtual Machines may violate the principle of least functionality and increase your monthly Azure costs.

• NIST 800-53 LOW
• NIST 800-53 MODERATE
• NIST 800-53 HIGH
• NIST 800-171
• CIS CRITICAL CONTROLS
• FedRAMP LOW
• FedRAMP MODERATE
• FedRAMP HIGH
• PCI DSS
• AWS Well-Architected (Security)
• AWS Well-Architected (Reliability)
• CMMC
• ACSC ISM
• ISO27001
• DISA IL2
• DISA IL4
• DISA IL5

Stopped Virtual Machines

Azure Virtual Machines (VM) are virtual servers deployed in a Microsoft Azure subscription. Stopped Virtual Machines do not release the leases on underlying resources and incur charges as if they were running, potentially violating the principle of least functionality and increasing your monthly Azure costs.

• NIST 800-53 LOW
• NIST 800-53 MODERATE
• NIST 800-53 HIGH
• NIST 800-171
• CIS CRITICAL CONTROLS
• FedRAMP LOW
• FedRAMP MODERATE
• FedRAMP HIGH
• PCI DSS
• AWS Well-Architected (Security)
• AWS Well-Architected (Reliability)
• CMMC
• ACSC ISM
• ISO27001
• DISA IL2
• DISA IL4
• DISA IL5

Web App

Idle Web App Services

Azure App Service is a fully-managed service that allows customers to build and host web apps, REST APIs, and mobile backends. Azure App Service is a fully-managed service that allows customers to build and host web applications, REST APIs, and mobile backends. Idle or underutilized Web Apps may violate the principle of least functionality and increase your monthly Azure costs.

• NIST 800-53 LOW
• NIST 800-53 MODERATE
• NIST 800-53 HIGH
• NIST 800-171
• CIS CRITICAL CONTROLS
• FedRAMP LOW
• FedRAMP MODERATE
• FedRAMP HIGH
• PCI DSS
• AWS Well-Architected (Security)
• AWS Well-Architected (Reliability)
• CMMC
• ACSC ISM
• ISO27001
• DISA IL2
• DISA IL4
• DISA IL5