Cloud FinOps: Stopping Ghost Costs
A ghost cost is a line on your cloud bill that no longer maps to anything you use. You created a resource once, moved on, and the meter kept running.
This is not the same problem as “our cloud spend is too high.” Optimizing real workloads means trade-offs. Ghost costs have none. You are paying for capacity that does zero work. Names differ by provider; the behaviour does not, because every major cloud makes deletion the dangerous operation and retention the default.
Where they hide
- Orphaned block storage. Deleting a VM often leaves its disks behind: the boot disk usually follows a delete-with-instance flag, disks attached later usually do not. Check your provider’s default rather than assuming. AWS EBS, Azure managed disks, Google persistent disks.
- Snapshots and backups. Snapshots are built to outlive their source. That is the point. Automated policies then create them forever, unless a retention rule removes them.
- Idle load balancers. Billed by the hour whether or not anything is behind them.
- Reserved public IPv4 addresses. All three major clouds charge for these, including ones you hold but never attached.
- Environments that outlived their purpose. The staging stack from a two-year-old migration is the most common, and the hardest to remove, because nobody is certain who still depends on it.
Why they are hard to see
Consoles are organized by service, not by purpose. Nothing in the storage view says a disk has been unattached for eight months, and the bill is grouped by service too, so it blends into normal storage spend. The question you need answered, “what am I paying for that nothing depends on?”, is not a view any provider gives you for free.
Four habits
Set a budget alert before you need one. Every major provider has this and it is free: AWS Budgets, Azure Cost Management budgets, Google Cloud budgets and alerts. Set it just above your normal monthly spend. The goal is to detect change, not to enforce a target. An alert that fires every month gets filtered into a folder.
Tag with an owner and a purpose. Two labels answer most questions: who to ask, and what it is for. AWS and Azure call them tags, Google calls them labels. Enable them in cost reporting and the bill becomes answerable, not merely readable. The value is almost entirely in applying them consistently.
Review on a schedule. Quarterly is plenty for a small footprint. Group spend by service and look for anything flat and unexplained. Steady cost with no matching activity is the signature of a ghost.
Delete rather than stop. A stopped VM still bills for its disks and any reserved address attached to it. “Stopped” is fine for something you resume next week, and a bad state for something you resume “eventually.” If you might need it later, snapshot it, delete the resource, and put the snapshot on a retention policy.
The kill switch
Everything above detects; nothing above stops. A budget alert is a smoke detector, not a sprinkler. If you want spend to actually halt, wire it up yourself:
- AWS budgets can trigger budget actions: apply a restrictive IAM policy, or stop EC2 and RDS instances, at a threshold you set.
- Azure budgets can fire an action group that runs an automation runbook. There is also a hard spending limit, but it applies only to credit-based subscriptions. Microsoft states it “isn’t available for subscriptions with commitment plans or with pay-as-you-go pricing.”
- Google Cloud budgets publish to Pub/Sub, and the documented pattern is a function that disables billing on the project. Google’s own warning is worth quoting: it shuts down all resources, and “resources might be irretrievably deleted.”
Note what that last one means. A kill switch is a circuit breaker for runaway spend: a runaway job, a leaked key, a bug in a retry loop. It is the wrong tool for ghost costs, which are small and steady and will never trip a threshold. Set it well above normal spend, treat it as an outage you chose, and know exactly what it takes down before you arm it.
The habit is the deliverable
None of this needs a dedicated FinOps function. These habits turn cloud spend from something you discover into something you decide. Start with the budget alert. It takes five minutes, works the same on every provider, and it is the one that tells you when the other three have lapsed.