How to Reduce AWS Costs Without Breaking Production: A Practical Framework
Where to Reduce AWS Costs: The 4 Biggest Cost Black Holes
Over 80% of wasted cloud expenditure comes from four distinct areas: Overprovisioned Compute Headroom, AWS NAT Gateway Data Processing, Legacy EBS gp2 Volumes, and Idle/Unattached Cloud Resources.
Compute: Karpenter + Spot Orchestration + Graviton
Transitioning your Kubernetes cluster from static EC2 Auto Scaling Groups to Karpenter with automated consolidation is the highest-impact cost reduction available on AWS.
- Bin-Packing & Defragmentation: Karpenter constantly monitors cluster density. When pods terminate or scale down, Karpenter automatically drains underutilized nodes and consolidates workloads onto smaller, cheaper instances.
- Spot Interruption Handling: By configuring diverse instance families (
c6g, c6i, m6g, m6i, r6g), Karpenter selects from the deepest Spot capacity pools, reducing interruption frequency. - Graviton (ARM64): Switching comparable instance types from x86 to Graviton (for example c5 to c7g) typically lowers the hourly price, and many workloads also get more throughput per dollar. Benchmark your own workload before committing.
# Karpenter NodePool configuration with multi-arch Spot diversification
apiVersion: karpenter.sh/v1beta1
kind: NodePool
metadata:
name: general-workloads
spec:
template:
spec:
requirements:
- key: "karpenter.sh/capacity-type"
operator: In
values: ["spot", "on-demand"]
- key: "kubernetes.io/arch"
operator: In
values: ["arm64", "amd64"]
- key: "karpenter.k8s.aws/instance-category"
operator: In
values: ["c", "m", "r"]
- key: "karpenter.k8s.aws/instance-generation"
operator: Gt
values: ["5"]
disruption:
consolidationPolicy: WhenUnderutilized
consolidateAfter: 60sNetworking: Eliminate NAT Gateway Charges with VPC Endpoints
AWS charges $0.045 per GB processed through a NAT Gateway. In Kubernetes clusters pulling hundreds of gigabytes of container images daily from Amazon ECR and uploading logs/backups to Amazon S3, NAT charges frequently surpass EC2 costs.
The 970+ Incident Handbook & K8s Runbooks are exclusive to subscribers — unlock for FREE
Get battle-tested production runbooks, AWS architecture blueprints, and zero-downtime CI/CD post-mortems sent directly to your inbox. 100% free, no spam.
aws ec2 create-vpc-endpoint --vpc-id vpc-0a1b2c3d4e5f6g7h8 --service-name com.amazonaws.us-east-1.s3 --route-table-ids rtb-0123456789abcdef0 rtb-0987654321fedcba0Traffic to S3 now stays entirely within the private AWS network backbone, instantly eliminating 100% of NAT data processing charges for S3 traffic.
Storage: Automate EBS gp2 to gp3 Migration
General Purpose SSD (gp2) volumes charge $0.10/GB-month and tie IOPS performance to volume size. The modern gp3 standard charges $0.08/GB-month (20% less) and includes 3,000 baseline IOPS and 125 MB/s throughput for free, regardless of size.
# Find all legacy gp2 volumes in region
aws ec2 describe-volumes --filters Name=volume-type,Values=gp2 --query 'Volumes[*].[VolumeId,Size,AvailabilityZone]' --output table
# Non-disruptively modify volume to gp3 on live production instances
aws ec2 modify-volume --volume-id vol-0123456789abcdef0 --volume-type gp3S3 & Observability Pruning
Unpruned CloudWatch Logs and S3 buckets are silent profit killers:
- CloudWatch Retention: Default log retention is "Never Expire". Run an automated script to set all log groups to 14 or 30 days retention. Stream long-term audit logs to S3.
- S3 Intelligent-Tiering: Apply lifecycle policies transitioning objects older than 30 days to Intelligent-Tiering and older than 90 days to Glacier Flexible.
- Orphaned EBS Snapshots & Elastic IPs: Clean up unattached Elastic IPs ($0.005/hr) and snapshots of deleted AMIs.
Have questions about this architecture or scaling your infrastructure?
Whether you're planning a complex cloud migration, optimizing Kubernetes reliability, or designing autonomous AI workflows, I'm always open to discussing architecture and technical challenges with engineering teams.
Connect with Naveed on LinkedIn →Guardrails to Reduce AWS Costs Safely
Cost work fails when it is treated as a one-off purge. The teams that keep savings are the ones that put guardrails around every change, so reliability never pays for a cheaper bill. A few habits make that practical.
- Make cost visible per owner. Tag every resource with a team and service, and report spend by those tags. Savings that nobody owns tend to disappear within a few months.
- Tie every change to a service level objective. Before shrinking, moving to Spot or changing storage, decide which latency and error-rate limits must hold, and watch them during the change.
- Change non-production first. Prove each optimization in development and staging, then roll it out to production gradually, one service or one node group at a time, with an easy way back.
- Measure the result. Compare the same period before and after in Cost Explorer or the Cost and Usage Report, and note which changes actually moved the bill.
- Review on a schedule. Unused volumes, idle load balancers and oversized instances reappear. A monthly review keeps them from piling up again.
The prices quoted in this guide are us-east-1 list prices at the time of writing, so confirm them for your region on the AWS EBS pricing page and AWS VPC pricing page. Rolling out these changes safely is easier when the infrastructure is already codified, which is why a clear Terraform AWS architecture pays for itself, and an infrastructure audit checklist is a good way to find the next round of savings. If Karpenter misbehaves during a change, the Kubernetes runbook has a section on node provisioning failures.
Frequently Asked Questions
How does Karpenter reduce Kubernetes compute costs compared to standard Node Groups?
Standard Managed Node Groups rely on EC2 Auto Scaling Groups with rigid instance types (e.g. m5.xlarge) and slow spin-up times (3-5 minutes), forcing teams to overprovision headroom. Karpenter evaluates exact pending pod CPU/memory requirements and launches optimally sized spot/on-demand instances directly within 30-45 seconds, bin-packing workloads with automated consolidation.
Why are AWS NAT Gateways so expensive and how do you reduce them?
AWS NAT Gateways charge both an hourly rate ($0.045/hr per gateway) and an aggressive data processing charge ($0.045 per GB). In high-volume environments pulling container images from ECR or streaming backups to S3, data processing fees quickly exceed thousands of dollars. The fix is provisioning Gateway VPC Endpoints for S3/DynamoDB (100% free) and Interface VPC Endpoints for ECR, bypassing NAT Gateways entirely.
What is the risk of migrating EC2/EKS instances to AWS Graviton (ARM64)?
AWS positions Graviton as delivering better price-performance than comparable x86 instances, but it requires container images to be compiled for the linux/arm64 architecture. The primary risk is third-party binary dependencies or x86-only native libraries. Mitigate this by using Docker Buildx to build multi-arch images and deploying Graviton node pools alongside x86 pools using Kubernetes nodeAffinity.
