AWS Underutilized EC2 Compute Right-Sizing Detector
Identify over-provisioned EC2 compute instances operating at sustained P95 CPU < 5% and right-size to modern instance families.
1. Detection Scope & Operational Boundaries
Every ArthaOps detector enforces strict epistemic honesty. We clearly separate what can be mathematically proven via agentless telemetry from what requires contextual human judgement.
What This Detector Identifies
- EC2 instances running 24/7 where P95 CPU utilization is < 5% over 14 consecutive days.
- Instances where average network throughput is < 10 MB/day.
- Compute instances running older generation types (e.g. c4, m4) that can be modernized to Graviton or newer x86 instance classes.
What It Cannot Establish Alone
- Whether the instance is memory-bound or swap-constrained: hypervisor-level CloudWatch metrics have zero visibility into guest OS RAM usage or swap pressure without AWS Systems Manager (SSM) or CloudWatch Agent installed. Downsizing based solely on CPU risks immediate out-of-memory (OOM) process termination.
- Whether the instance operates as an active-passive disaster recovery failover node.
2. Telemetry & Evidence Requirements
ArthaOps operates strictly via Plane 1 (Read-Only Discovery). The following CloudFormation / IAM permissions and CloudWatch metrics are evaluated:
AWS::EC2::InstanceVerification Protocol: Tested against synthetic EC2 fixtures with sustained low CPU metrics.
Validation Context: Validated in production AWS accounts uncovering instances provisioned for launch traffic that were never right-sized.
3. Reproducible AWS CLI Verification Recipe
Query EC2 instance metrics for 14-day P95 CPU utilization.
# Check 14-day average CPU utilization for target EC2 instance
aws cloudwatch get-metric-statistics \
--region ap-south-1 \
--namespace AWS/EC2 \
--metric-name CPUUtilization \
--dimensions Name=InstanceId,Value=i-0a1b2c3d4e5f67890 \
--start-time $(date -u -v-14d +%Y-%m-%dT%H:%M:%SZ) \
--end-time $(date -u +%Y-%m-%dT%H:%M:%SZ) \
--period 86400 \
--statistics Average Maximum \
--output table-----------------------------------------------------------------------
| GetMetricStatistics |
+--------------------------+---------------------+--------------------+
| Average | Maximum | Timestamp |
+--------------------------+---------------------+--------------------+
| 2.14 | 4.88 | 2026-10-10T00:00Z |
+--------------------------+---------------------+--------------------+💡 Maximum daily CPU consistently below 5% indicates substantial over-provisioning.
4. Transparent Economic Model
- 730 operational hours per standard calendar month.
- Workload requirements fit comfortably within 2 vCPUs and 4 GiB RAM.
- EBS root volume storage fees are unchanged and not included in compute savings.
5. False-Positive Scenarios & Operational Risks
Never delete or terminate cloud resources blindly. These validated architectural scenarios must be reviewed before initiating remediation:
Documented False-Positive Scenarios
- Memory-Bound Workloads: Java (JVM heaps), Redis, Elasticsearch, Kafka, or in-memory analytics clusters operating at sustained low CPU (< 5%) but high RAM consumption (80%+). Downsizing instance family without RAM telemetry can trigger kernel OOM crashes.
- Scheduled Peak Bursts: Workloads that spike to 100% CPU during month-end or flash sales.
Blast Radius & Remediation Risks
- Instance Reboot Required: Modifying instance type requires stopping the instance, causing a 1–2 minute maintenance interruption.
6. Remediation Procedure & Rollback Runbook
Follow this ordered sequence of verified AWS CLI actions to remediate the resource with complete rollback availability:
Stop the EC2 Instance
Stop the instance during an approved maintenance window.
aws ec2 stop-instances --region ap-south-1 --instance-ids i-0a1b2c3d4e5f67890Modify Instance Type
Resize instance attribute to target right-sized family.
aws ec2 modify-instance-attribute --region ap-south-1 --instance-id i-0a1b2c3d4e5f67890 --instance-type c6i.largeStart the EC2 Instance
Start the resized instance and verify operational health.
aws ec2 start-instances --region ap-south-1 --instance-ids i-0a1b2c3d4e5f67890Forensic Rollback Procedure
To roll back, stop the instance and execute `aws ec2 modify-instance-attribute --instance-id <id> --instance-type c6i.2xlarge` then restart.
🔒 ArthaOps Assurance: ArthaOps requires human approval in Plane 2 before issuing any EC2 stop command.
Rightsizing requires stopping the instance; ensure ephemeral IP address changes are handled via Elastic IPs or private DNS.
How This Appears in the ArthaOps Control Plane
c6i.2xlarge instance running at 2.1% P95 CPU for 28 days with zero memory alerts.
Test Your Infrastructure in 180 Seconds
Explore our zero-setup interactive sample report covering real Mumbai findings, or launch a 100% read-only agentless scan across your AWS environment.