zombiecost

Find the zombie resources in your AWS account: things that should be dead but still bill you every month.

Find idle and forgotten AWS resources and see what they cost you every month.

One read-only scan. One table. A number at the bottom you can act on today.

What it finds

Prices are rough us-east-1 on-demand numbers. The goal is order of magnitude, not an invoice.

Checks that depend on usage history (ec2-idle, rds-idle, nat-idle, lb-unused) ignore resources younger than 3 days, so a freshly launched instance is never reported as idle. s3-stale can see writes but not reads; it says so in every finding, because reads are invisible without paid request metrics.

Install

pip install zombiecost

Or from a clone:

python3 -m venv .venv && source .venv/bin/activate
pip install -e ".[dev]"

Run

zombiecost                                  # every enabled region, default profile
zombiecost --profile prod --regions eu-west-1,us-east-1
zombiecost --days 30 --json report.json     # longer lookback, machine-readable output
zombiecost --redact                         # placeholders instead of IDs, names and IPs: safe to paste publicly

Permissions

The scan is read-only. Attach ReadOnlyAccess, or this minimal policy:

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": [
      "sts:GetCallerIdentity",
      "ec2:DescribeRegions",
      "ec2:DescribeVolumes",
      "ec2:DescribeAddresses",
      "ec2:DescribeSnapshots",
      "ec2:DescribeImages",
      "ec2:DescribeInstances",
      "ec2:DescribeNatGateways",
      "rds:DescribeDBInstances",
      "elasticloadbalancing:DescribeLoadBalancers",
      "elasticloadbalancing:DescribeTargetGroups",
      "elasticloadbalancing:DescribeTargetHealth",
      "s3:ListAllMyBuckets",
      "s3:GetBucketLocation",
      "s3:ListBucket",
      "cloudwatch:GetMetricStatistics",
      "cloudwatch:ListMetrics"
    ],
    "Resource": "*"
  }]
}

Tests

pytest

Tests run against moto, no AWS account needed.

Roadmap

• Unused KMS keys, Secrets Manager secrets and VPC endpoints (small, fixed monthly charges that add up)
• Stopped instances still paying for their volumes
• Old AMIs and the snapshots behind them
• Hosted version: cross-account role, weekly scans, Slack alerts