How to tell whether you have this
Ask for your cloud spend broken down by resource, then ask what each line is for.
That is a cheap conversation and in most small estates it finds something. If nobody can account for a line item, that is not a billing question. It is a configuration question with a bill attached.
Why it happens
Provisioning is a decision somebody makes in a hurry to unblock something. Deprovisioning is a decision nobody is ever assigned. Cloud spend accretes for that reason alone, and it does not require anyone to have made a mistake.
Why this belongs on a security site
Because the most common reason this work does not happen at a firm your size is not disagreement about whether it should. It is that there is no budget line for it, and asking a principal to find new money for a risk that has not materialised is a hard conversation.
This is the answer to that. Money already being spent on infrastructure delivering nothing can fund the monitoring, the identity work and the documentation without anyone finding new budget. On the engagement below, the monitoring platform that replaced part of the removed spend runs at about A$160 a month.
How I would approach it
- Separate three different things that look alike on an invoice: genuinely unused, over-provisioned for a load that never arrived, and correctly sized but the wrong service for the job.
- Document a reverse command and a business rationale for every change, so nothing is removed on the strength of my judgement alone and anything contested goes back in a minute.
- Handle the third category last, because it carries the actual risk. Switching off something unused is housekeeping. Replacing something that works with something cheaper that works better is a judgement call.
- Set a budget with forecast alerting and an action group, so the position holds instead of drifting back within a year.
What you end up with
A recurring saving rather than a one-off, and somebody finding out about drift in the month it happens rather than at the next annual review.
The framing that matters is not cost cutting. Infrastructure delivering nothing is money you have already decided to spend. It can be spent on something that reduces risk instead.