The Resources Nobody Owned

Scenario

Example company: 14 AWS accounts used by 9 teams for three years. Finance asks why the bill grew 35% in a year while traffic grew 10%. Nobody can say which team owns a third of the spend.

What you see in production

A review finds: 180 unattached EBS volumes from terminated instances, 2,400 old snapshots, 60 idle load balancers from finished experiments, 300 unused Elastic IPs and public IPv4 addresses (each billed hourly), a forgotten p3 GPU instance from a hackathon, and three copies of a 40 TB data set. About $38,000 a month is pure waste, and 31% of resources have no team tag.

The naive code

resource "aws_instance" "experiment" {
  ami           = "ami-0abc..."
  instance_type = "g5.2xlarge"
  # no tags, no owner, no expiry
}

Reproduce it

An inventory with tags and last-use data makes waste and ownership obvious:

inventory = [
    {"id": "vol-1", "type": "ebs", "monthly": 80, "attached": False, "tags": {}},
    {"id": "i-gpu", "type": "ec2", "monthly": 870, "cpu_avg": 0.3, "tags": {"team": "ml"}},
    {"id": "lb-old", "type": "alb", "monthly": 22, "requests_30d": 0, "tags": {"team": "web"}},
    {"id": "eip-7", "type": "ipv4", "monthly": 3.65, "attached": False, "tags": {}},
    {"id": "i-api", "type": "ec2", "monthly": 140, "cpu_avg": 41, "tags": {"team": "payments", "env": "prod"}},
]

def waste_reason(r):
    if r.get("attached") is False:
        return "unattached"
    if r.get("cpu_avg", 100) < 2:
        return "idle (CPU < 2%)"
    if r.get("requests_30d") == 0:
        return "no traffic in 30 days"
    return None

waste = 0
for r in inventory:
    reason = waste_reason(r)
    owner = r["tags"].get("team", "NO OWNER")
    if reason:
        waste += r["monthly"]
        print(f"{r['id']:7} {r['type']:5} ${r['monthly']:7.2f}/mo  {reason:22} owner: {owner}")
untagged = sum(r["monthly"] for r in inventory if "team" not in r["tags"])
print(f"waste: ${waste:,.2f}/mo, untagged spend: ${untagged:,.2f}/mo")

vol-1   ebs   $  80.00/mo  unattached             owner: NO OWNER
i-gpu   ec2   $ 870.00/mo  idle (CPU < 2%)        owner: ml
lb-old  alb   $  22.00/mo  no traffic in 30 days  owner: web
eip-7   ipv4  $   3.65/mo  unattached             owner: NO OWNER
waste: $975.65/mo, untagged spend: $83.65/mo

Root cause

Creating resources is easy and nothing ever forces cleanup. Without ownership (tags) nobody feels responsible, without expiry experiments live forever, and without visibility (cost per team) nobody notices. Some charges are invisible in daily work: snapshots, unattached volumes, idle IP addresses, data copies.

The fix

1. Mandatory tags (team, env, service, owner) enforced in Terraform modules, with tag policies or Azure Policy / GCP organisation constraints, and activated as cost allocation tags.
2. Cost per team, reviewed monthly by each team, with budgets and anomaly alerts per account.
3. Expiry for experiments: an expires_on tag and a scheduled job that notifies, then stops, then deletes; sandbox accounts with hard budgets.
4. Automated cleanup of unattached volumes, old snapshots (lifecycle policies via Amazon Data Lifecycle Manager or AWS Backup), unused IPs and idle load balancers.
5. Rightsizing with Compute Optimizer / Azure Advisor / Google Cloud recommender, then commitments for the steady baseline. See cost allocation tags and tag policies.

provider "aws" {
  default_tags {
    tags = { team = var.team, env = var.env, service = var.service, managed_by = "terraform" }
  }
}

Trade-offs

• Automated deletion is dangerous; use notify, stop, snapshot, then delete, with an opt-out tag for exceptions.
• Tag enforcement blocks some console experiments; give people sandbox accounts with budgets instead.
• Commitments save money but lock you in; buy them only for the measured, stable baseline.

Detect it in production

• Weekly report: untagged spend share (target near 0%), waste by category, cost per team trend.
• Cost anomaly detection per account and service.
• Unattached and idle resource counts as metrics.

Key points

• Untagged, unowned, unexpiring resources are where cloud money disappears.
• Enforce tags, show cost per team, and give experiments an expiry.
• Automate cleanup carefully and rightsize before committing.