When to Use Each Service
AWS Lambda
Use Lambda for API backends with intermittent traffic, scheduled jobs, file processing, event-driven automation, and lightweight microservices.
AWS ECS with Fargate
Ideal for standard Dockerized web apps, APIs, and background workers—for teams wanting containers without Kubernetes overhead.
AWS EKS
Use when you need Kubernetes-native tooling, multi-team platform standardization, advanced auto-scaling, and better resource allocation.
Amazon EC2
Still the right choice for legacy applications, Windows workloads, specialized software requiring OS access, and high-performance custom tuning.
Common Cost Optimization Scenarios
| Service | Problem | Check | Fix |
|---|---|---|---|
| Lambda | High Lambda cost | Invocation count, memory allocation, execution duration, retry storms | Optimize execution time, right-size memory, add dead-letter queues, use provisioned concurrency only when required |
| ECS Fargate | Fargate costs too high | Overprovisioned CPU/memory, always-on low-traffic services, idle staging environments | Auto-scale tasks, schedule shutdowns for non-prod, optimize task sizes |
| EKS | Cluster too expensive | Too many worker nodes, idle namespaces, oversized requests/limits, multiple underused clusters, duplicate environments, too many load balancers | Consolidate clusters, use Cluster Autoscaler / Karpenter, tune pod requests |
| EC2 | EC2 bill too high | Low utilization instances, wrong instance family, unattached EBS volumes, on-demand instances running 24/7 | Resize instances, use Savings Plans, move to Graviton, remove idle resources |
Security Non-Negotiables (2026 Checklist)
Every environment should implement these baseline controls.
| Control | What to Do |
|---|---|
| IMDSv2 Only on EC2 | Disable IMDSv1 to reduce SSRF attack risk—attackers often exploit metadata endpoints to steal temporary credentials. |
| OIDC for CI/CD | Avoid IAM access keys in GitHub, GitLab, Jenkins, or pipelines—static keys are frequently leaked. Use OpenID Connect for temporary credentials, and watch for long-lived IAM keys and overprivileged roles. |
| KMS Encryption by Default | Encrypt S3 buckets, RDS databases, EBS volumes, and backups—often required for compliance and risk reduction. |
| Enable GuardDuty | Detects crypto-mining activity, suspicious API calls, and credential misuse. |
IMDSv2 Command
aws ec2 modify-instance-metadata-options \
--instance-id <instance_id> \
--http-tokens required \
--http-endpoint enabledThe Cost Killer Toolkit
These checks often reveal immediate waste—and are the first place to look if your AWS bill suddenly spikes.
| Check | Why It Matters |
|---|---|
| Find unattached EBS volumes | Detached volumes continue billing. |
| Find CloudWatch logs with no retention policy | Infinite retention = silent long-term storage cost. |
| Look for Graviton opportunities | ARM-based Graviton instances often save 20–40% depending on workload compatibility. |
Unattached EBS Volumes Command
aws ec2 describe-volumes --filters Name=status,Values=availableCloudWatch Log Retention Command
aws logs describe-log-groups \
--query 'logGroups[?retentionInDays==null].[logGroupName]' \
--output textQuarterly Governance Review Checklist
Run this every quarter.
| Category | What to Check |
|---|---|
| Compute & Storage | Idle EC2 instances, oversized RDS classes, or inefficient Lambda functions? Old snapshots, unused EBS volumes, or missing S3 lifecycle policies? |
| Networking & Security | Idle NAT gateways or unused Elastic IPs? Old IAM users, access keys older than 90 days, or GuardDuty disabled anywhere? |
| Commitment Savings | Savings Plans coverage optimized, and RI utilization healthy? |
Troubleshooting by Symptom
| Symptom | Check |
|---|---|
| "My AWS bill suddenly spiked" | Cost Explorer by service, new EC2 instances, data transfer charges, CloudWatch log growth, Lambda invocation spikes |
| "My Kubernetes cluster is too expensive" | Node idle percentage, over-requested CPU/memory, duplicate environments, too many load balancers |
| "Our CI/CD pipeline is insecure" | Long-lived IAM keys, missing OIDC federation, overprivileged roles |
