Stop bleeding money on zombie cloud resources; learn how to automate the cleanup of orphaned EBS snapshots that are quietly inflating your monthly AWS bill.

The $2,400-a-Year Ghost in Your AWS Bill: Automating the Snapshot Purgatory

A few years ago at TechResolve, I was doing a quarterly audit of our prod-db-01 environment when I noticed something sickening. We were paying nearly $800 a month for EBS snapshots that weren’t attached to any active AMIs or volumes. A legacy Jenkins job from 2019 had been faithfully triggering a backup every time a developer pushed to the “staging” branch, but nobody had ever written the cleanup logic. I spent a miserable Saturday morning manually clicking “Delete” in the console before I realized I was doing the exact kind of “boring, $200-a-month task” that separates the juniors from the seniors. If you’re still clicking buttons to save money, you’re not an engineer—you’re a glorified janitor.

The Root Cause: Why “Orphans” Happen

The problem isn’t that we’re lazy; it’s that AWS makes it incredibly easy to create data and incredibly tedious to track its lineage. When you delete an EC2 instance, the EBS volume might persist. When you delete that volume, the snapshots stay. Over time, your account becomes a graveyard of temp-backup-final-v2-REALLY-FINAL snapshots that no one is brave enough to delete because they don’t know what they belong to. At scale, this isn’t just “messy”—it’s a massive financial leak.

Pro Tip: Infrastructure as Code (IaC) like Terraform helps, but it only manages what it knows about. If a dev creates a snapshot manually “just in case” before a hotfix, Terraform won’t ever touch it.

Solution 1: The Quick Fix (The “Boto3 Scraper”)

If you need to stop the bleeding today, a simple Python script using the Boto3 library is your best friend. This script identifies snapshots older than 30 days that are not associated with any existing AMI. It’s “hacky” because it runs locally, but it gets the job done without complex infrastructure.

import boto3
from datetime import datetime, timedelta, timezone

ec2 = boto3.client('ec2')
threshold = datetime.now(timezone.utc) - timedelta(days=30)

def cleanup_snapshots():
    snapshots = ec2.describe_snapshots(OwnerIds=['self'])['Snapshots']
    for snap in snapshots:
        if snap['StartTime'] < threshold:
            # Check if it's tied to an AMI
            if "Created by CreateImage" not in snap['Description']:
                print(f"Deleting orphan snapshot: {snap['SnapshotId']}")
                # ec2.delete_snapshot(SnapshotId=snap['SnapshotId']) # Unmute to actually delete

Solution 2: The Permanent Fix (AWS Data Lifecycle Manager)

For a more “Senior” approach, stop writing custom scripts and use the native tools. AWS Data Lifecycle Manager (DLM) allows you to define policies that manage your snapshots automatically based on tags. This is the preferred way to handle prod-web-server clusters.

Solution 3: The “Nuclear” Option (The Lambda Janitor)

If you’re managing multiple accounts (Dev, Staging, Prod), you need a “Janitor” Lambda function. This function runs on a CloudWatch Event bridge trigger every Sunday at 2:00 AM. It scans for any resource that lacks a Project or Owner tag and sends a notification to Slack. If the tag isn’t added within 24 hours, the Janitor terminates the resource. It’s aggressive, and it will make you unpopular for a week, but it is the only way to ensure 100% compliance in a large organization.

Warning: The Nuclear Option requires buy-in from your CTO. There is nothing quite like the feeling of your prod-legacy-db being deleted because a consultant forgot to tag it. Use a “Dry Run” flag for at least a month before enabling actual deletions.

In the end, automating these “ridiculously specific” tasks isn’t just about the $200 a month. It’s about reclaiming your mental bandwidth. You were hired to build resilient systems at TechResolve, not to manually audit storage volumes. Automate the boring stuff so you can get back to solving the problems that actually matter.

Darian Vance

Lead Cloud Architect & DevOps Strategist

With over 12 years in system architecture and automation, Darian specializes in simplifying complex cloud infrastructures. An advocate for open-source solutions, he founded TechResolve to provide engineers with actionable, battle-tested troubleshooting guides and robust software alternatives.

🤖 Frequently Asked Questions