Idle AWS resources, found by metric and priced by region

Reads

CloudWatch CPUUtilization (average) and NetworkIn + NetworkOut (sum)

Idle when

below 3% CPU and below 5 MB a day of network, both at once, over the trailing window

A running instance whose average CPU is under three percent and whose network traffic adds up to less than five megabytes a day is doing nothing anyone is waiting for. Both conditions have to hold: a low-CPU box moving traffic is a proxy or a queue consumer, not an idle one. The finding carries the instance type and its monthly rate, the Availability Zone and subnet, the private and public addresses and the security groups, so the engineer who has to decide can see what it is attached to. Stopped instances are a separate check (ec2-stopped): they stop billing for compute but keep billing for every volume attached to them.

Reads

CloudWatch DatabaseConnections (average), AWS/RDS or AWS/DocDB namespace

Idle when

an average of exactly zero connections across the trailing window, with datapoints present

A database instance in the available state that no client has connected to for the whole window is billed for its instance class, its storage and its backups all the same. The finding names the endpoint, the engine and version, the class and its monthly rate, the allocated storage and whether it is Multi-AZ, and recommends a final snapshot before deletion. A stopped RDS instance is not a remedy on its own: AWS restarts it after seven days, which is how idle databases quietly keep billing. DocumentDB instances surface through the RDS API but publish metrics under a different namespace, and the rule reads the right one.

Reads

CloudWatch BytesOutToDestination (sum)

Idle when

under one megabyte processed over the whole trailing window

A NAT gateway bills an hourly charge for every hour it exists, plus a per-gigabyte fee on what passes through it. One left behind in a subnet whose instances have moved on, or in a VPC a proof of concept ran in, moves nothing and still costs the hourly charge every month. The finding shows the VPC and subnet, the bytes processed over the window and the Elastic IPs associated with the gateway, and the checklist asks you to confirm no route table still points at it and no occasional batch job depends on it before you delete.

Reads

DescribeListeners, DescribeTargetGroups and DescribeTargetHealth, not a metric

Idle when

no listeners configured, no registered targets, or zero healthy targets

An Application or Network Load Balancer bills by the hour whether or not it can serve a request. One with no listener, no registered target or no healthy target cannot, so the state alone is the finding: it is read from the load balancer's own configuration and target health rather than inferred from traffic. The finding reports the type and scheme, the VPC and Availability Zones, the DNS name, the counts of listeners, registered and healthy targets, and the monthly base charge, and asks you to check DNS records and in-progress deployments before deleting. Classic Load Balancers with zero requests to zero healthy instances are a separate check (clb-idle-zero-traffic).