Stop wrestling with surprise Azure bills. Learn the real-world, in-the-trenches strategies to find and eliminate cloud waste, from quick manual fixes to powerful, automated governance.

I Saw a $20k Azure Bill for a Dev Environment. Here’s How We Make Sure It Never Happens Again.

I still remember the pit in my stomach. It was a Monday morning, and I was sipping my first coffee when a frantic message popped up from our finance department. It was a screenshot of our Azure billing forecast, and it was projecting a massive overspend. After a frantic half-hour of digging, we found the culprit: a junior engineer, trying to impress, had spun up a premium AKS cluster with a dozen high-spec nodes and attached GPU instances for a “quick performance test” on Friday afternoon. He forgot to turn it off. That weekend-long “test” was on track to cost us more than my first car.

We’ve all been there. The cloud makes it incredibly easy to provision resources, but it makes it just as easy to forget them. This isn’t about blaming the junior dev; it’s a systemic problem. The root cause is a lack of visibility and guardrails. When anyone can spin up anything, without a clear process for tracking, tagging, and decommissioning, your bill will inevitably spiral out of control. It’s death by a thousand papercuts—or in this case, a thousand unattached disks and idle App Service plans.

The Problem: Identifying the “Cost Zombies”

Before you can fix the problem, you need to know what you’re looking for. Based on my experience and a great discussion I saw bubble up on Reddit recently around a tool called CleanCloud, the biggest culprits tend to fall into a few categories. These are the “cost zombies”—resources that are technically running but are providing zero value, just silently draining your budget.

So, how do we hunt them down? Let’s break it down into a few levels of engagement.

Level 1: The Quick & Dirty Manual Cleanup

This is the emergency-response, “we need to stop the bleeding now” approach. It’s manual, it’s tedious, but it’s effective for immediate results. You’re basically playing detective in the Azure Portal.

• Hunt for Unattached Disks: Go to the ‘Disks’ service in the Azure Portal. Sort by the ‘Disk state’ column. Anything marked as ‘Unattached’ is a prime suspect. It’s a disk that isn’t connected to any VM. We keep them around “just in case,” but 90% of the time, they’re relics from a VM that was deleted months ago.
• Find Idle Public IPs: Similarly, check your ‘Public IP addresses’. If an IP isn’t associated with a running resource (like a VM, Load Balancer, etc.), you’re paying for it to do nothing.
• Check Azure Cost Management: This is your best friend. Dive into ‘Cost Management + Billing’ -> ‘Cost analysis’. Group by ‘Resource type’ and ‘Resource’. This will show you exactly what’s costing you money, from that `prod-db-01` you expect to the `dev-test-vm-for-that-one-project-07` that you don’t.

Pro Tip: Don’t just delete things! If you find an unattached disk named prod-legacy-db-disk-do-not-delete, maybe ask around first. A good first step is to take a snapshot (which is cheaper to store) and then delete the premium disk. It’s a safety net.

Level 2: The Permanent Fix – Automated Governance

After you’ve put out the initial fire, it’s time to build a fire station. This is about putting policies and automation in place so the problem doesn’t happen again. This is where you move from being a firefighter to an architect.

The key here is Azure Policy. It allows you to enforce rules over your resources, so your users can only create resources that comply with your standards.

Example: Enforcing a ‘ttl’ (Time-To-Live) Tag

We can create a policy that requires any resource in a “Sandbox” resource group to have a tag called `ttl-days`. Then, we can have an Automation Account runbook that scans for these tags and deletes expired resources.

Here’s a basic PowerShell snippet you could adapt for a runbook to find expired resources:

# Connect to Azure
Connect-AzAccount -Identity

# Get all resource groups with a 'ttl-days' tag
$resourceGroups = Get-AzResourceGroup | Where-Object { $_.Tags.ContainsKey('ttl-days') }

foreach ($rg in $resourceGroups) {
    $creationDateStr = $rg.Tags['creation-date'] # Assuming you also have a creation-date tag
    $ttlDays = $rg.Tags['ttl-days']

    if ($creationDateStr -and $ttlDays) {
        $creationDate = [datetime]$creationDateStr
        $expiryDate = $creationDate.AddDays([int]$ttlDays)

        if ([datetime]::UtcNow -gt $expiryDate) {
            Write-Host "Resource Group '$($rg.ResourceGroupName)' has expired. Removing..."
            # Use -WhatIf for testing before you go live!
            # Remove-AzResourceGroup -Name $rg.ResourceGroupName -Force -WhatIf
        }
    }
}

Warning: Be extremely careful with automated deletion scripts. Always, ALWAYS test with the -WhatIf parameter first. Deleting the wrong production resource group is what we call a “resume-generating event.”

Level 3: The ‘Heavy Machinery’ – Dedicated Tooling

When your environment gets big and complex, manual scripts and basic policies don’t scale. This is where dedicated tools, like the one mentioned in that Reddit thread (CleanCloud), come in. These tools are built on a set of rules—heuristics that are really good at spotting waste.

Think of it as having a junior engineer who does nothing but scan your environment 24/7 for cost-saving opportunities, but without the coffee breaks. Here are the kinds of rules they use, which you should be looking for manually if you don’t have a tool:

Whether you build your own tooling based on these rules or use a commercial product, the principle is the same: Automate the detection of waste. Your time is too valuable to be spent clicking through the Azure Portal every month. Set up the systems, let them find the problems, and then you can focus on making the strategic decisions.

Darian Vance

Lead Cloud Architect & DevOps Strategist

With over 12 years in system architecture and automation, Darian specializes in simplifying complex cloud infrastructures. An advocate for open-source solutions, he founded TechResolve to provide engineers with actionable, battle-tested troubleshooting guides and robust software alternatives.

🤖 Frequently Asked Questions