The Serverless Cost Audit Ritual I Run Every Month

Serverless costs are cheap until they are not. A single badly written Lambda or an unbounded DynamoDB query can turn a twelve dollar month into a two hundred dollar month. I run a monthly audit ritual that takes forty minutes and has caught three cost leaks in six months.

The Audit Checklist

• Lambda invocations by function: flag any function with 10x month-over-month growth
• Lambda duration p99: flag any function over two seconds
• DynamoDB read/write capacity peaks: flag any table hitting provisioned limits
• S3 storage growth: flag any bucket gaining more than 5GB
• CloudWatch logs retention: flag any log group over 30 days without reason
• API Gateway 4xx spikes: flag any endpoint with new error patterns

Six checks, forty minutes, covers 95% of cost surprises before they hit the bill.

The Queries I Use

Most of the audit runs through CloudWatch Insights. I keep the queries in a file I can paste every month:

# Top invoked Lambdas, last 30 days
filter @type = "REPORT"
| stats count(*) as invocations by @log
| sort invocations desc
| limit 20

Copy, paste, read. No dashboards, no clicking. A text file I trust more than any console view.

The Cost Leaks I Caught

• A function calling DynamoDB in a loop instead of batch_get
• A CloudWatch log group retaining forever on a debug function
• A cron invoking a 45-second Lambda every minute instead of every hour

Each leak was under fifty dollars a month. Together they would have been six hundred dollars a year.

Why Monthly, Not Quarterly

Quarterly is too long. A runaway function can burn thousands before a quarterly check catches it. Weekly is too often: the cost data is noisy week to week and you react to fluctuations that do not matter. Monthly hits the sweet spot: enough signal to see trends, short enough to catch leaks.

The Tooling I Skip

I tried three third-party cost tools. All of them showed beautiful dashboards that I never opened. The ritual works because it lives in a text file, runs on a calendar reminder, and takes less than an hour. No tool replaces the discipline of actually looking.

AWS publishes a monthly cost optimization checklist that covers the broader surface if you want a more formal frame.

The Client Conversation

Running this audit monthly gives me an artifact I can share with clients on retainer projects. One page, six checks, flagged items with recommended actions. Clients stop worrying about surprise AWS bills when they get a monthly cost note in their inbox. The audit is as much a trust asset as an operational one.

The Discipline of Looking

The biggest lesson after six months of monthly audits is that the looking is the whole value. Tools that produce reports you never open catch nothing. A ritual you actually perform catches everything eventually. Make it small enough to keep doing and the rest takes care of itself.