Infra Audit6 min readUpdated November 4, 2026

Your Next Cloud Bill Has a Date Already

RI expiry, EKS upgrades, Lambda runtime blocks, unbounded log retention. Every one has a date you can look up today and an amount you can estimate.

Check RI and Savings Plan expiry, EKS version support dates, Lambda runtime deprecation dates, and log retention settings. Each produces a dated, priced forecast: the bill jump becomes a line item instead of a surprise.

Reserved Instances and Savings Plans expire on a known date: on-ex demand pricing resumes silently. EKS versions have published support windows: past the window, the upgrade happens on AWS's schedule with node group replacement. Lambda runtimes hit deprecation blocks: creates blocked first, updates later. Log retention unset means storage that only grows.

See How We Work

In This Guide

The four dated jumps

Reserved Instances and Savings Plans expire on a known date: on-ex demand pricing resumes silently. EKS versions have published support windows: past the window, the upgrade happens on AWS's schedule with node group replacement. Lambda runtimes hit deprecation blocks: creates blocked first, updates later. Log retention unset means storage that only grows.
Reserved Instances and Savings Plans expire on a known date: on-ex demand pricing resumes silently. EKS versions have published support windows: past the window, the upgrade happens on AWS's schedule with node group replacement. Lambda runtimes hit deprecation blocks: creates blocked first, updates later. Log retention unset means storage that only grows. Each has a date, and each date is queryable today.

The forecast format

The audit reports each expiry as: what, date, expected amount. For example: RI for 3x m5.large expires 2027-01-15, expected increase about $180/month at current usage. A CFO forwards that sentence. A warning that says costs may increase does not survive the inbox.
The audit reports each expiry as: what, date, expected amount. For example: RI for 3x m5.large expires 2027-01-15, expected increase about $180/month at current usage. A CFO forwards that sentence. A warning that says costs may increase does not survive the inbox.

If it stays untracked

The bill jump arrives as a surprise, the team spends a day diagnosing what changed, and the fix is the same upgrade that could have been scheduled calmly months earlier. The audit turns each surprise into a calendar entry with a price tag.
The bill jump arrives as a surprise, the team spends a day diagnosing what changed, and the fix is the same upgrade that could have been scheduled calmly months earlier. The audit turns each surprise into a calendar entry with a price tag.

Get the skill

The checks in this guide come from the roqy audit skill, open source at https://github.com/roncoo-2/roqy-audit. It runs read-only against your own account, produces findings with verdicts (confirmed, needs_validation, rejected), and was validated on a live canary AWS account where 9 planted misconfigurations were detected 9 out of 9 times.
The checks in this guide come from the roqy audit skill, open source at https://github.com/roncoo-2/roqy-audit. It runs read-only against your own account, produces findings with verdicts (confirmed, needs_validation, rejected), and was validated on a live canary AWS account where 9 planted misconfigurations were detected 9 out of 9 times. The full canary report is in the repository under docs/runs. Copy the skill into any coding agent, point it at your stack, and get the same report for your account.

4 Tips to Get Started

1

aws ce get-reserved-plans-usage-and-costs (or the Cost Explorer console) lists RI expiry dates.

2

EKS publishes version support dates; an expired version forces a paid upgrade on their schedule.

3

Log groups with no retention policy bill forever. retentionInDays: null is the finding.

4

A forecast with a date and an amount is what a CFO forwards. A warning without numbers is noise.

Ready to Stop Worrying About Infra?

Knowledge is the first step. Get a free 1-hour diagnostic and see where your infrastructure leaks time, money, and focus.

Related Guides

Is My S3 Bucket Public? How to Check in One Command

One command tells you if your S3 bucket is public, and one curl proves it. The policy check shows intent, the anonymous request shows reality.

The Most Common AWS Misconfiguration (It Is One Line of Config)

Public buckets and Principal * policies cause most disclosed AWS incidents. Each is one line of config with account-wide blast radius. Here is the pattern.

Terraform State File Leak: Every Secret in Plaintext

terraform.tfstate stores database passwords, IAM keys and TLS private keys in plaintext. sensitive=true hides nothing. Here is how leaks happen and the check.

Docker Socket Mounted in a Container: Root on the Host, No Exploit Needed

A container with /var/run/docker.sock mounted controls the host daemon and can mount your entire filesystem. No kernel exploit required. Here is the mechanism and the check.

R

Ron Cohen — DevOps engineer & founder, roqy.io

Content reviewed by the roqy.io team. Our guides are based on publicly available data.

Disclaimer: This content is for informational and educational purposes only. It does not constitute professional advice or a guarantee of specific results. Infrastructure needs vary by team, stack, and stage. Consult a qualified engineer for advice tailored to your situation.

Frequently Asked Questions

Why did my AWS bill jump?

Common causes: a Reserved Instance or Savings Plan expired, EKS auto-upgraded a node group, log retention set to never expire, or crypto-mining in an exposed ECS task. The roqy audit skill forecasts each expiry date with the expected amount, so the jump is a line item, not a surprise.

When does my Lambda runtime stop working?

AWS blocks new function creates on a runtime after its deprecation date and blocks updates later. Check aws lambda list-functions against the published runtime support schedule and plan the upgrade before the block date.

How do I find unbounded log retention costs?

aws logs describe-log-groups --query 'logGroups[].{n:logGroupName,r:retentionInDays}'. Any group with retentionInDays null never deletes anything: storage bills grow forever and PII stays forever. One setting fixes both.

Get the DevOps Ecosystem Behind You

One accountable engineer. Full platform behind him. Month-to-month, no lock-in.

See How It Works