All cheat sheets
Operational Efficiencycheat sheet

AWS Resource Explorer

Free, cross-region, cross-account search for everything in your AWS estate — the fastest way to surface the orphaned volumes, unassociated Elastic IPs, forgotten NAT Gateways, and idle SageMaker endpoints that accumulate in any account older than two years.

Last reviewed: July 11, 2026

Prefer step by step? Take the guided AWS Resource Explorer walkthrough — free, anonymous, interactive.Have an AI assistant? Jump to the copy-paste audit prompt at the bottom of this sheet.

TL;DR: Half of cost optimization is just finding things: the unattached volumes, unassociated Elastic IPs ($3.60/month each, forever), NAT Gateways in abandoned VPCs, and SageMaker endpoints nobody ever deleted. Resource Explorer is AWS's free account-wide search box — enable indexing per region, promote one aggregator, and "what do we even have?" becomes a query. Accounts older than two years typically surface $200–2,000/month of pure waste on the first pass.

The numbers

  • Cost of the service: $0 — no metering, org-wide aggregation included
  • The usual suspects it finds: unattached EBS ($0.08/GB-month), unassociated EIPs (~$3.60/month each), idle NLBs ($16+/month), NAT Gateways ($32/month + data), zero-invocation SageMaker endpoints ($100–500/month)
  • Field examples: a 30-account org found 8 forgotten NAT Gateways (~$500/month with data charges — $6k/year for a 90-minute cleanup); an inherited 5-year-old account held 214 unattached volumes (8.7 TB, ~$700/month)

Do this

  1. Enable indexing in every active region (Resource Explorer does nothing by default — empty search results mean setup, not brokenness), designate your primary region as the aggregator index, wait ~10 minutes.

  2. Run the money queries:

    • resourcetype:ec2:volume filtered to available state
    • resourcetype:ec2:elastic-ip with no association
    • resourcetype:ec2:natgateway, resourcetype:sagemaker:endpoint, resourcetype:elasticloadbalancing:loadbalancer
    • NOT tag:Owner — orphans concentrate among the untagged
    • tag:Owner=<person-who-left> — almost always cleanup candidates

  3. Validate before deleting: CloudTrail for creator/last use, CloudWatch for actual traffic (HealthyHostCount, invocations), snapshot before removing anything questionable. Rank by monthly cost; the top 10 usually carry 80% of the win.

  4. Org-wide: enable the multi-account aggregator in the management account — "every NAT Gateway across 50 accounts" becomes one query instead of fifty logins.

  5. Make it recurring + prevent re-accumulation: quarterly search, plus SCP-enforced tagging so the next pass is shorter.

Gotchas

  • It shows resources, not costs — pair with Cost Explorer; the intersection of "expensive service" and "old/untagged resource" is where the wins live.
  • No history: current state only. "What was deleted last week" is CloudTrail/Config territory.
  • Tag search quality = tagging discipline — a 60%-untagged estate limits the fancy queries (but NOT tag:Owner is itself the finding).
  • Not every resource type is indexed — check the supported list before declaring the account clean.
  • Tool boundaries: Resource Explorer = fast search (free); AWS Config = change history (paid); Tag Editor = bulk tag edits.

Skip this if

  • The account is young and small enough to eyeball in two consoles.
  • You already run a mature inventory/CMDB pipeline — then this is just a handy backup query, not a program.
  • Discovery isn't the bottleneck — if you already know the waste, go fix it: DeleteOnTermination, NAT consolidation, Trusted Advisor checks.

Run this audit with your AI assistant

Paste this into Claude, ChatGPT, or any agent that can run the AWS CLI with read-only credentials. It audits your account for exactly the waste this sheet describes — and changes nothing.

You are performing the orphaned-resource hunt that AWS Resource
Explorer enables — directly via the AWS CLI with READ-ONLY
credentials. Do not create, modify, or delete anything.

Per region with recent activity:
1. Unattached EBS volumes: aws ec2 describe-volumes
   --filters Name=status,Values=available (≈$0.08/GB-mo each).
2. Unassociated Elastic IPs: aws ec2 describe-addresses — entries
   with no AssociationId (~$3.60/mo each).
3. NAT Gateways: aws ec2 describe-nat-gateways — cross-reference VPCs
   with running instances; a NAT in a workload-less VPC is ~$32/mo +
   data for nothing.
4. Load balancers: aws elbv2 describe-load-balancers +
   describe-target-health — zero healthy targets for 30 days (check
   CloudWatch HealthyHostCount) = idle at $16+/mo.
5. SageMaker endpoints: aws sagemaker list-endpoints — cross-check
   CloudWatch Invocations; zero-invocation endpoints are $100–500/mo.
6. Snapshots/AMIs: orphaned snapshots with no AMI or volume parent.
7. Tag hygiene: sample resources missing an Owner/Project tag —
   orphans concentrate there.

Also check whether Resource Explorer itself is set up
(aws resource-explorer-2 list-indexes) and recommend enabling indexing
+ an aggregator region if not, so this hunt becomes a search query
next quarter.

Report: findings table (resource | region | age | est. $/mo | evidence
of orphanhood), ranked by monthly cost, with deletion candidates
clearly marked NEEDS-HUMAN-CONFIRMATION. Total the monthly waste.
Change nothing.
Works with any assistant that can run shell commands.

Want the guided version?

The AWS Resource Explorer walkthrough covers this topic interactively — it asks about your setup, branches to what’s relevant, and quizzes you on the tricky parts. Free and anonymous.

Start the walkthrough

More Operational Efficiency cheat sheets

AWS Config Resource Exclusion

AWS Config bills ~$0.003 per configuration item, and the 'record everything' default meters every ENI and Lambda-version change your account churns through. Excluding high-churn, zero-audit-value resource types cuts most Config bills 40–70%.

AWS License Manager

Windows EC2 costs ~2× Linux; SQL Server Enterprise adds $4–5/hour on top. If you already own those licenses under Software Assurance, BYOL removes the AWS markup — and License Manager is the free tracking layer that makes it audit-safe.

CloudWatch Logs Infrequent Access

The IA log class halves both ingestion (~$0.25/GB) and storage (~$0.015/GB-month) for write-and-forget log groups — but silently disables metric filters, subscription filters, and Live Tail. Know the disable list before you move anything.

CloudWatch Logs Retention Policies

Every new log group defaults to Never Expire, so logs from 2019 experiments still bill you today. One CLI line per log group (or one bulk script per region) cuts log storage 60–90% with zero application risk.