FinOps / Guide 6

Stop the bleeding: storage and orphaned resources

Orphaned disks, snapshots and IPs, wrong storage tiers and redundancy, missing lifecycle rules, and logs kept forever.

Some cloud costs don't come from anything running. They come from things left behind or set up with the wrong defaults: a disk nobody attached again, a storage account replicating test data to another region, backups sitting in the most expensive tier, logs kept forever. Each one is small, but together they leak money every month until someone looks. This guide is the checklist.

Orphaned resources

# Quick checks from PowerShell
Get-AzDisk | Where-Object DiskState -eq 'Unattached' | Select-Object Name, ResourceGroupName, DiskSizeGB, @{n='Sku';e={$_.Sku.Name}}
Get-EC2Volume -Filter @{ Name = 'status'; Values = 'available' } | Select-Object VolumeId, Size, VolumeType, CreateTime
Get-EC2Address | Where-Object { -not $_.AssociationId } | Select-Object PublicIp, AllocationId
gcloud compute disks list --filter='-users:*' --format='table(name,zone.basename(),sizeGb,type.basename())'
gcloud compute addresses list --filter='status=RESERVED' --format='table(name,region.basename(),address)'

Before deleting a disk, check with the owner and take a final snapshot if there's any doubt. A snapshot costs a fraction of the disk, and it can be deleted later under a retention rule.

Wrong disk type

# AWS: change a gp2 volume to gp3 in place (no downtime)
Edit-EC2Volume -VolumeId 'vol-0123456789abcdef0' -VolumeType gp3

Storage redundancy and tier

Object storage has two settings that quietly multiply the bill: how many copies are kept, and which tier the data sits in.

Two traps: deleting or moving data before its minimum storage time is charged as if it had stayed, and the infrequent-access tiers charge for each read. Cooler tiers suit data that is written once and rarely read, such as backups, archives and old logs, not data that's read every day.

# Azure: redundancy and default tier for every storage account
Get-AzStorageAccount | Select-Object StorageAccountName, ResourceGroupName, @{n='Redundancy';e={$_.Sku.Name}}, AccessTier

Lifecycle management

Lifecycle rules move data to cheaper tiers as it ages and delete it when it's no longer needed. Without them, everything stays in the tier it was written to, forever. Check every bucket or storage account holding backups, logs, exports or uploads.

# Find storage without lifecycle rules
Get-AzStorageAccount | ForEach-Object {
    $p = Get-AzStorageAccountManagementPolicy -ResourceGroupName $_.ResourceGroupName -StorageAccountName $_.StorageAccountName -ErrorAction SilentlyContinue
    [pscustomobject]@{ Account = $_.StorageAccountName; HasLifecyclePolicy = [bool]$p }
}
Get-S3Bucket | ForEach-Object {
    $rules = try { Get-S3LifecycleConfiguration -BucketName $_.BucketName -ErrorAction Stop } catch { $null }
    [pscustomobject]@{ Bucket = $_.BucketName; LifecycleRules = @($rules.Rules).Count }
}
gcloud storage buckets list --format='value(name)' | ForEach-Object {
    $lc = gcloud storage buckets describe "gs://$_" --format='value(lifecycle_config)'
    [pscustomobject]@{ Bucket = $_; HasLifecycleRules = [bool]$lc }
}

Versioning and backups that never expire

• Versioned buckets keep every overwritten and deleted object. Without a rule for noncurrent versions, a bucket that is overwritten nightly grows every night.
• Backup retention: check backup policies keep what the business needs, not "forever by default". Daily backups kept for years add up fast. The backup coverage reports help here: Get-AzBackupCoverage.ps1, Get-AwsBackupCoverage.ps1 and Get-GcpBackupCoverage.ps1.
• Snapshots made by hand before a change and never removed. Name them with a date and owner, and delete them after the change is signed off.

Logs kept forever

# AWS: log groups with no retention, then set 90 days on one
Get-CWLLogGroup | Where-Object { -not $_.RetentionInDays } | Select-Object LogGroupName, StoredBytes
Write-CWLRetentionPolicy -LogGroupName '/aws/lambda/notes-test' -RetentionInDays 90

Data transfer

Traffic leaving the cloud to the internet, and traffic between regions, is charged per GB. Traffic between availability zones is charged on AWS and Google Cloud too. Watch for chatty services split across regions, backups copied to another region every night, and NAT gateways processing traffic that could use private endpoints or gateway endpoints instead. The networking comparison covers private access to cloud services in each provider.