The three AWS defaults on your bill that nobody actually chose

A post published on dev.to takes three config drifts that normally get filed as correctness problems and prices them instead: CloudWatch log groups with no retention, S3 buckets with no lifecycle policy, and RDS Multi-AZ carried into environments that never asked for it ^[1][10][20]. The argument is that none of these ever pages anyone, so they arrive as unlabeled growth on the invoice rather than as an incident ^[25].

Start with logs. The default retention for a CloudWatch log group is never expire, and storage bills at $0.03 per GB-month on top of the $0.50 per GB already paid at ingestion ^[1][2]. The post's worked example: a service writing 5 GB a day holds about 3.6 TB after two years, roughly $110 a month in storage, growing about $4.50 a month ^[3]. That growth rate compounds to about $54 a month more one year later, near $164 a month in year three ^[2]. A typical account accumulates around forty log groups ^[4]. The finder is one query for groups where retentionInDays is null ^[5], and the fix is put-retention-policy at 30 to 90 days, with existing data past the new window ageing out by itself ^[6][7]. Watch the sibling drift the post flags: debug logging left on after an incident inflates ingest, and ingest cannot be cleaned up retroactively ^[8]. At $0.50 per GB, one gigabyte of ingest costs what sixteen months of storing it does ^[5].

One number in that section does not reconcile. The post says compliance logs belong in S3 rather than CloudWatch "at 6x the storage price" ^[6], but its own S3 Standard figure is $0.023 per GB-month, making CloudWatch about 1.3 times Standard ^[1]. The direction is right; the multiple only works against a colder tier.

S3 is the cleaner case. Standard is $0.023, Infrequent Access $0.0125, Glacier Instant Retrieval $0.004, Deep Archive $0.00099 ^[9]. A bucket with no lifecycle policy keeps everything hot forever ^[10]; the post prices 10 TB of aging logs at $230 a month in Standard against about $10 in Deep Archive, a $2,600 annual gap per bucket ^[11], which checks out at $2,640 on the monthly figures ^[3]. The fine print is where this goes wrong in practice: transitions bill per 1,000 objects, so millions of tiny files can cost more to move than they save ^[12]; minimum durations are 30 days in IA, 90 in the Glacier tiers, 180 in Deep Archive ^[13]; and deep-tier retrieval costs time and money, which is acceptable for backups and audit logs and wrong for anything an application reads ^[14]. Intelligent-Tiering at $0.0025 per 1,000 objects monitored covers genuinely unknown access patterns, and fails the same way, forgotten on buckets full of small objects ^[15]. The audit is a loop over get-bucket-lifecycle-configuration, treating every "no lifecycle configuration" error on a log or backup bucket as drift ^[16].

RDS Multi-AZ doubles instance and storage cost exactly, which makes it drift in both directions ^[17]. Single-AZ production is risk drift, one AZ event from an outage worth more than a decade of standby ^[18], found with a MultiAZ==false query against your production identifiers ^[19]. Non-production Multi-AZ is cost drift, usually a cloned prod Terraform module ^[20]: a db.m5.large at about $125 a month becomes $250, and four of them in dev is $6,000 a year of high availability for test data ^[21][4]. Same family: 35-day backup retention on throwaway databases, snapshot schedules with no deletion policy ^[22].

What to watch is whether any of it stays fixed. The post's own conclusion is that the source of drift is provisioning behaviour, not inventory: new log groups still default to never expire, new buckets still ship without lifecycle rules, and the next cloned module carries prod settings into dev again ^[24]. The usable test it offers is ownership. Any environment where you cannot name who chose the availability setting is running on a default ^[23].