Technology
AWS
Most of the estates we work on run on AWS, and most of the cost questions we are asked turn out to be attribution questions: the bill is known, but which team, cluster or workload produced it is not.
What we think, and why
A cost figure that does not reconcile to the bill is not a cost figure.
Usage-type lines from Cost Explorer sum to the invoice exactly. Any per-team or per-workload number we publish is a partition of that total, not a parallel estimate — so the parts add back up to something the finance team already recognises.
The instance list is not the demand.
Sizing a target from what is running today carries forward every oversized decision made under pressure. Demand is measured — percentiles over weeks, not averages over hours — and the target is sized from that.
Read-only until there is a reason not to be.
An audit needs billing and metrics access, nothing more. Administrator credentials are a thing to ask for when there is something to change, with the change agreed first.
The interesting money is rarely in the compute line.
Cross-zone transfer, NAT processing, unattached storage, public IPv4 addresses and log retention are individually unglamorous and collectively substantial — and none of them appear in the service most people look at first.
What we do with it
- Account, network and identity design, including who is permitted to spend
- Cost attribution down to namespace and workload, reconciled against the bill
- Migrations to and within AWS, sized from measured demand
- Commitment strategy — but only after the fleet has stopped changing shape