Auditing What Is Actually Running in an Unfamiliar Account
A systematic sweep of every region for compute, storage, addresses, schedules and identities, so nothing keeps running or billing unnoticed.
The console home page shows a summary. Summaries are regional, partial, and cheerfully omit the things that cost money while doing nothing. A proper sweep is methodical and takes about half an hour.
Check every region, not just yours
This is the single most important rule. Resources in a region you never look at bill exactly the same as ones you do. Most providers offer a global resource search or a billing view broken down by region; either is faster than clicking through a region selector.
Start from the bill. Anything generating charges appears there, which makes it the most reliable index of what exists.
The inventory
Compute
Running and stopped instances. Stopped instances usually still have storage attached, and that storage still bills.
Storage
Attached volumes, detached volumes, snapshots and object storage buckets. Detached volumes and old snapshots are the classic silent cost: nothing uses them and nobody remembers creating them.
Addresses
Reserved or elastic addresses. Several providers charge for reserved addresses that are not attached to anything, which is a small charge that runs forever.
Networking
Load balancers, gateways and private networks. Load balancers bill hourly regardless of traffic.
Scheduled work
Cron jobs on servers, scheduled functions, and managed schedulers. A forgotten job that writes to storage every five minutes is invisible until you look for it.
Identities
Users, roles, service accounts and API keys. Anything you cannot explain should be disabled, then removed once nothing breaks.
Look inside the machines too
For any server you intend to keep, check what is actually running on it: listening ports, installed packages, authorised SSH keys, and cron entries. An inherited machine reflects someone else’s intentions and may be running services you would not choose to expose.
Take a snapshot before changing anything, so you can undo a mistake.
Decide, then act
For each item, choose one of three outcomes: keep it, and document why; stop it, and see whether anything complains; or remove it once you are confident. Resist deleting anything on the first pass, because the cost of keeping something for a week is small and the cost of deleting the wrong thing is not.
Record the result. That list is the baseline described in documenting a cloud account handover.
Cloud accounts on OldCloudShop
Ten providers, every configuration and the starting price for each.
Continue in the library
Other entries covering account structure, billing, security and provider infrastructure.