Raxx · internal docs

internal · gated

Avenue AWS cost handoff report — shared account 521228113048

Prepared: 2026-08-05 UTC Audience: the Avenue agent team (this document is written to stand alone — no prior context from the Raxx side is assumed) Scope: read-only decomposition of Avenue's AWS spend in the shared account, evidence of utilization, and a ranked recommendation list. Nothing in Avenue's infrastructure was changed, tagged, stopped, or modified during this research. All figures are UnblendedCost, USD, from Cost Explorer pulled 2026-08-05; resource state inspected the same day. Companion doc (whole-account baseline): docs/business/bookkeeper/2026-08-aws-cost-breakdown.md

Why you are receiving this

AWS account 521228113048 is shared between two tenants: Raxx CI infrastructure (ci-woodpecker-*, us-east-2) and the Avenue project (avenue-*, us-east-1 + a DR key in us-west-2). The July 2026 account bill was $502.06, which the account operator has flagged as unacceptable. Avenue's share is roughly half. The operator's directive is that each tenant receives its own decomposition and recommendation list; every change to Avenue resources is Avenue's decision — this report only supplies the numbers and the levers.

1. Avenue's July 2026 spend — precise decomposition

Bottom-up, per-line measurement (Cost Explorer usage-type granularity, cross-checked against live resource inventory):

Line Resources July $
NAT Gateway hours avenue-dev-nat-0, avenue-staging-nat-0 (2 × $0.045/hr × 744 hr) $66.96
NAT Gateway data processing 4.7 GB billed across BOTH gateways all month $0.21
ECS Fargate 2 tasks (1 per env), 0.5 vCPU / 1 GB each, 24/7 $36.80
ALB hours + LCU avenue-dev-api, avenue-staging-api (2 × $0.0225/hr × 744 hr + $0.17 LCU) $33.65
RDS instances avenue-dev-postgres, avenue-staging-postgres (2 × db.t4g.micro, single-AZ, $23.81) + gp3 storage 2×20 GB ($4.60) + backup ($0.31) $28.72
CloudTrail avenue-trail + avenue-staging-trail, both multi-region ($23.88 us-east-1 + $2.90 us-east-2 + $0.24 other regions) $27.02
Public IPv4 addresses 6 addresses × $0.005/hr × 744 hr (2 NAT EIPs + 2 ENIs per ALB) $22.33
KMS 11 customer-managed keys ($10.83 us-east-1 + ~$1.00 avenue-tf-state-dr in us-west-2) $11.84
Secrets Manager ~22 secrets (avenue/* + 2 RDS-managed rotation secrets) × $0.40 $8.48
Route 53 health checks 2 × HTTPS/30s against bdca7f-{dev,staging}-api.moosequest.app $4.79
CodeBuild 6 projects (avenue-{dev,staging}-tf-{plan,apply,plan-pr}) $2.39
CodePipeline avenue-dev-tf-pipeline, avenue-staging-tf-pipeline (1 active-pipeline charge) $1.00
CloudWatch alarms 20 of the account's 37 alarms are avenue-* (~54% of $2.59) ~$1.40
S3 6 buckets (avenue-cloudtrail*, avenue-tf-state*, avenue-tf-plan-artifacts*, avenue-{dev,staging}-{feedback,media}) — share of $1.97 account-wide ~$0.50–1.00
Measured Avenue total ≈ $246

Note on the $261.31 headline. The whole-account baseline doc attributed $261.31 to Avenue using a residual method (account total minus explicitly-Raxx lines minus a shared bucket). The bottom-up measurement above lands at ≈ $246/mo; the ~$15 delta is Raxx-side EBS volumes and regional data transfer in us-east-2 (booked under "EC2 – Other") that the residual swept into Avenue's bucket. Use ≈ $246/mo as Avenue's true July run rate. August-to-date daily spend is consistent (~$8.1/day ≈ $245/mo full-month equivalent: $5.00/day carrying the project=avenue tag + ~$3.1/day in usage types that do not inherit resource tags — CloudTrail paid events, public IPv4, KMS, Secrets Manager, Route 53).

Environment split is almost exactly 50/50: dev ≈ $123, staging ≈ $123 (the two envs are architecturally identical).

2. Utilization evidence — both environments are idle

Everything below is CloudWatch data, 2026-07-22 → 2026-08-05, read-only:

Inferred stage (from the evidence, not a judgment): Avenue is pre-traffic — infrastructure is built and CI/CD (Terraform CodePipelines, drift detection at 07:00 UTC daily, RDS credential rotation) is operating, but no workload exists yet. The bill is ~$246/mo of scaffolding availability, not of usage.

3. Ranked recommendations

Ordered by projected monthly savings. Savings overlap — items 1–3 partially cannibalize each other; the scenario table after the list shows realistic combinations. Every item is Avenue's call; the "Only Avenue can decide" column states the judgment the numbers can't make.

# Item Current $/mo Recommended change Projected $/mo saved Risk / effort Only Avenue can decide
1 Scheduled stop/start of dev + staging outside working hours $183 schedulable (NAT $67.17 + Fargate $36.80 + ALB $33.65 + RDS instance-hours $23.81 + IPv4 $22.33 during down-hours) Tier A (low effort): EventBridge Scheduler → ECS desiredCount 0 + rds stop-db-instance nightly/weekends. Tier B (full): Terraform-driven destroy/apply of NAT + ALB + EIPs on the same schedule — you already have avenue-*-tf-pipeline + drift detection, so the plumbing exists; add schedule windows and suppress the 07:00 UTC drift alarms during down-hours. At 40–60 waking hours/week, non-running time is 64–76% Tier A: ~$40–46. Tier B: ~$115–140 Low risk (no external traffic exists to interrupt; RDS auto-restarts after 7 days so the scheduler must re-stop). Effort: A low, B medium Working-hours window; whether CI/deploy jobs need the envs up on-demand; drift-alarm handling
2 Question whether staging needs to exist yet ~$123 (staging's full half) Staging currently runs the byte-identical image as dev with zero traffic — it verifies nothing dev doesn't. Terraform-destroy the staging env (state is preserved in avenue-tf-state*; re-apply recreates it in minutes) until there's a promotion pipeline that actually differs from dev ~$110–120 (supersedes item 1 for the staging half) Low technical risk (fully Terraform-managed, reversible); the RDS instance should be snapshotted first if any data matters Whether staging serves a compliance/promotion purpose the resource state doesn't show
3 Eliminate the NAT gateways $67.17 + 2 EIPs $7.44 The tasks egress ~4.7 GB/mo — NAT is 300× overprovisioned. Option a: run Fargate tasks in public subnets with assignPublicIp + strict security groups (adds 2 × $3.72 IPv4, removes both NATs). Option b: fck-nat / NAT instance on t4g.nano (~$3/mo each). Option a is simpler and standard for pre-prod ~$55–60 net (if envs stay 24/7; mostly subsumed by item 1 Tier B or item 2) Medium: public-subnet tasks are SG-protected but lose the private-subnet defense layer — fine for pre-traffic dev/staging, revisit for prod Security posture: is private-subnet isolation a hard requirement pre-launch?
4 Consolidate CloudTrail to one multi-region trail $27.02 Keep one trail (or one per intended long-term account boundary), delete the duplicate. Since the first management-event copy is free, the paid-events line should drop to ≈ $0, not just half ~$13–27 (evidence says the high end) Low, if neither trail feeds a separately-IAM-scoped consumer — verify before deleting. Effort: low (Terraform) Whether dev vs staging trail separation exists for a real audit/access-isolation reason
5 Collapse the two ALBs into one $33.65 + 4 IPv4 $14.88 One ALB with host-header rules (bdca7f-dev-api.* / bdca7f-staging-api.*) routing to the two target groups ~$24 (ALB $16.83 + 2 IPv4 $7.44); moot if item 2 taken Low-medium: blurs env isolation at the edge; both envs share the ALB's blast radius Whether edge-level env isolation matters before launch
6 KMS key consolidation $11.84 (11 keys) 5 purpose-keys per env (feedback/media/logs/rds/secrets) could collapse to 2–3 per env if shared-purpose keys are acceptable; keep tf-state + DR keys ~$4–6 Low $, but key-per-purpose is a deliberate compliance pattern — do not collapse casually Compliance/data-isolation posture
7 Small trims ~$14 Route 53 health checks: 2 × HTTPS/30s on idle envs — drop to one, or standard 30s→ no fast-interval extras (~$2–4). Secrets Manager: prune unused of the ~22 secrets ($0.40 each). S3 lifecycle on avenue-cloudtrail* (IA at 30 d, Glacier at 90 d) ~$3–6 Negligible Which secrets/checks are still load-bearing

Realistic combined scenarios

Scenario Composition Avenue projected $/mo
Today (no change) — ≈ $246
A — schedule only Item 1 Tier B on both envs ≈ $105–130
B — pause staging + schedule dev Item 2 + item 1 Tier B on dev + item 4 ≈ $60–80
C — envs must stay 24/7 Items 3 + 4 + 5 + 6 + 7 ≈ $125–135

The floor while any env exists 24/7 is the fixed layer: CloudTrail (1 trail ≈ $0–3), KMS, Secrets Manager, tf-pipelines, S3, alarms ≈ $25–30/mo.

4. Shared-account hygiene (affects both tenants — coordinate, don't act unilaterally)

  1. Public IPv4 is an account-wide cost class. AWS charges $0.005/hr per in-use public IPv4 (since Feb 2024). Avenue holds 6 of the account's public IPs ($22.33/mo); Raxx holds the rest ($10.09/mo). Every NAT/ALB decision above moves this line.
  2. Cost-allocation tags went active 2026-08-02 (project, env, managed-by, and casing variants). Avenue's Terraform tagging (project=avenue, lowercase) is already the account convention going forward — no action needed on your side. Be aware that only ~$5.00/day of Avenue spend inherits resource tags in Cost Explorer; CloudTrail paid events, public IPv4, KMS, Secrets Manager, and Route 53 usage types don't carry the tag, so tag-filtered views understate Avenue by ~40%. Use this report's bottom-up method (or region us-east-1 minus Lightsail/Bedrock) for true-ups.
  3. Tag-casing inconsistency is on the Raxx side, not yours. The ci-woodpecker Terraform module tags Project (capital P); any account report grouped by lowercase project silently drops Raxx CI. A Raxx-side ticket exists to standardize to lowercase; Avenue needs no change.
  4. Unattributed third-tenant resources — flagged to the operator, owned by neither tenant. Two Route 53 hosted zones (apl-project-monkey.net, boingboing-inc.net, $1.00/mo) and six prototype-site-{dev,staging,prod}-* S3 buckets with matching CloudFormation stacks in us-west-1 match neither tenant's naming or tagging. Do not tag, adopt, or delete these; ownership confirmation is with the account operator.
  5. Your CloudTrail trails record Raxx activity too (multi-region trails capture the whole account), which is why part of your CloudTrail spend accrues in us-east-2. If the tenants ever split into separate accounts/OUs, trail strategy should be revisited then; for now, item 4 in the recommendation list (consolidating your two trails to one) is safe regardless.

5. Method + reproduction notes