/////DIAGNOSTIC EVIDENCE

[AWS MUMBAI]

ZERO-FRICTION PRODUCT AUDIT

Interactive Sample Cost Audit Report

Explore realistic findings detected in AWS Mumbai (ap-south-1). Inspect exact mathematical pricing formulas, copyable AWS CLI verification commands, and non-destructive remediation workflows.

ENVIRONMENT: Staging & Microservices Core FleetREGION: ap-south-1 (Mumbai, India)342 RESOURCES IN 142s

Illustrative Audit Data · Real AWS Mumbai Pricing

This interactive readout represents the exact diagnostic output and remediation recipes generated by an ArthaOps read-only scan. Simulated on representative microservices infrastructure; no customer confidential data or real account identifiers are exposed.

Identified Monthly Waste₹1,84,370 / mo
~$2,195/mo at ₹84/USD

Annual Waste Recovery₹22,12,440 / yr
Calculated across 12-month run-rate

Resources Audited

342

Completed in 142s (agentless)

Actionable Findings

6 Safe Immediate · 2 Review

The Two-Plane Security Architecture

Plane 1: Discovery (100% Read-Only)

Deployed via AWS CloudFormation in <60 seconds using AWS-managed SecurityAudit. Possesses zero mutate, write, or delete IAM capabilities. Zero agents, zero daemons, zero stored credentials.

Plane 2: Execution (Human-in-the-Loop)

Remediation requires explicit operator authorization with a cryptographic SHA-256 fingerprint. Automated pre-action snapshots (e.g. EBS volume snapshot prior to termination) provide reversible rollbacks.

HIGHDET-NAT-001• VPC & Networking

Idle NAT Gateway with Zero Active Outbound Egress

nat-0a1b2c3d4e5f6g7h8 • ap-south-1a (Mumbai)

₹6,048/mo

₹72,576 / yr

Zero Downtime

Transparent Economic Formula

2 gateways × $0.045/hr × 720h × ₹84.0/USD + EIP reservation base = ₹6,048/mo

Official AWS Rate: AWS VPC Pricing (ap-south-1 Mumbai NAT Gateway: $0.045/hour + $0.045/GB processed)

Exclusions & Boundary: Data processing fees excluded (sustained 0 bytes processed across window).

Telemetry Evidence

CloudWatch metric BytesInFromDestination = 0 bytes and ActiveConnectionCount = 0 over 14 consecutive evaluation days across subnet-01a2b3c4d5.

Infrastructure Impact

VPC maintains provisioned gateway reservation charges 24/7 for isolated private subnets that have no outbound internet traffic.

Independent AWS CLI Verification Recipe

aws ec2 describe-nat-gateways --region ap-south-1 --nat-gateway-ids nat-0a1b2c3d4e5f6g7h8 --query "NatGateways[*].[NatGatewayId,State,SubnetId]" --output table
aws cloudwatch get-metric-statistics --region ap-south-1 --namespace AWS/NATGateway --metric-name BytesInFromDestination --dimensions Name=NatGatewayId,Value=nat-0a1b2c3d4e5f6g7h8 --start-time $(date -v-14d +%Y-%m-%dT00:00:00Z) --end-time $(date +%Y-%m-%dT00:00:00Z) --period 86400 --statistics Sum

Remediation Steps

1.Review route table rtb-09a8b7c6 to confirm zero instances depend on public internet egress.
2.Provision free Gateway VPC Endpoints for Amazon S3 and DynamoDB if internal AWS traffic is required.
3.Delete idle NAT Gateway via AWS Console or CLI.
4.Release the associated Elastic IP address to eliminate idle IPv4 holding fees.

Operational Safeguards

Known Caveats & False-Positive Guard

Verify whether month-end compliance batch jobs or payroll APIs require outbound access during scheduled windows before deletion.

Rollback Mechanism (SAFE RISK)

NAT Gateway can be re-provisioned via CloudFormation/Terraform within 90 seconds if routing requires restoration.

HIGHDET-EBS-002• EC2 & Storage

Unattached gp2 EBS Volumes from Terminated Instances

vol-04f8e7d6c5b4a3210 (7 total volumes) • ap-south-1b (Mumbai)

₹14,112/mo

₹1,69,344 / yr

Snapshot & Terminate

HIGHDET-RDS-003• RDS Database

Dormant Multi-AZ Staging PostgreSQL RDS Cluster

staging-postgres-cluster (db.m6g.xlarge) • ap-south-1 (Mumbai)

₹46,368/mo

₹5,56,416 / yr

Plan Review

MEDIUMDET-EBS-004• EC2 & Storage

Legacy gp2 Block Storage on Active Production Volumes

vol-01a2b3c4... (16 active worker volumes) • ap-south-1 (Mumbai)

₹18,816/mo

₹2,25,792 / yr

Zero Downtime

MEDIUMDET-EIP-001• VPC & Networking

Unassociated Elastic IP Addresses Accumulating Idle Fees

eipalloc-0b1c2d3e4f (4 total unattached IPs) • ap-south-1 (Mumbai)

₹1,452/mo

₹17,424 / yr

Immediate Release

MEDIUMDET-S3-004• S3 Storage

Missing Lifecycle Policy on Build & Deployment S3 Bucket

s3://build-assets-ap-south-1 (18.2 TB) • ap-south-1 (Mumbai)

₹32,256/mo

₹3,87,072 / yr

Policy Attachment

MEDIUMDET-CW-002• CloudWatch & Logs

High-Volume CloudWatch Log Groups Retained with 'Never Expire'

/aws/ecs/production-ingress (+ 11 log groups, 9.6 TB) • ap-south-1 (Mumbai)

₹24,192/mo

₹2,90,304 / yr

Policy Attachment

HIGHDET-EC2-001• EC2 & Compute

Severely Underutilized EC2 Worker Instances (P95 CPU < 2.4%)

i-0f1e2d3c4b5a6978, i-0e9d8c7b6a543210 (2 × c6g.2xlarge) • ap-south-1 (Mumbai)

₹41,126/mo

₹4,93,512 / yr

Plan Review

100% READ-ONLY · ZERO AGENTS · DEPLOYS IN <60 SECONDS

Ready to audit your actual AWS infrastructure?

Connect your AWS account using our read-only CloudFormation template. The scan runs agentless across your environment in typically under 180 seconds, identifying orphaned resources and exact rupee savings with zero write permissions.

Run Free 180s Read-Only Scan Book 15-Minute Engineering Review