Back to Setup Guide

Guide

How SaneCost Detects Idle Instances

SaneCost monitors your EC2 instances through CloudWatch metrics. When a resource is burning money but doing nothing, you get an actionable Slack alert.

⚡ The Detection Pipeline

Every 10 minutes, SaneCost runs a check cycle across all your connected AWS accounts. Here's what happens behind the scenes:

1. Scan EC2 Instances

SaneCost lists all running instances in your connected account via the cross-account IAM role

↓

2. Pull CloudWatch Metrics

For each instance, fetch CPU utilization data for the past 24 hours

↓

3. Apply Idle Threshold

Flag instances where average CPU has been below 5% for the full monitoring window

↓

4. Calculate Waste Cost

Estimate monthly cost based on instance type and pricing. Filter out instances below $5/month savings

↓

5. Send Slack Alert

Post an actionable notification to your configured channel with Stop and Snooze buttons

🎯 What Triggers an Alert

An instance is flagged as idle when all three conditions are met simultaneously:

< 5%
Average CPU utilization
2h
Continuous low CPU period
≥ $5
Monthly savings minimum

This combination eliminates false positives. A server that spikes briefly or costs almost nothing won't generate noise in your channel. Only genuinely wasted spend triggers alerts.

Why these defaults? The 2-hour window catches genuinely idle instances while ignoring brief dips from batch jobs or deploys. The $5/month savings floor filters out nano-instances that aren't worth acting on. Both thresholds are fully configurable — adjust the CPU percentage, idle duration, and minimum savings via /sanecost config to match your workload patterns.

💬 What the Alert Looks Like

When SaneCost detects an idle instance, this is what appears in your notification channel:

# sanecost-channel
SC

SaneCost APP 2:00 PM

💤 Found a sleepy instance that might not be needed

dev-api-server
• Instance type: t3.large
• Running time: 168 hours
• Monthly cost: $73.50

CPU has averaged under 5% for over 2 hours — this instance looks idle.

💾 Stop & Save
⏰ Snooze

🎮 Taking Action

Each alert includes two one-click actions. No need to open the AWS console:

ButtonWhat It DoesWhen to Use
💾 Stop & Save Stops the EC2 instance immediately via the cross-account role. Does not terminate — you can restart later. You've confirmed the instance isn't needed right now.
⏰ Snooze Suppresses alerts for this instance for a configurable period. SaneCost will check again after the snooze expires. The instance is legitimately idle (e.g., staging for next sprint) and you don't want repeated alerts.

Safety note: "Stop & Save" stops the instance, it does not terminate. Your data, EBS volumes, and configuration remain intact. You can restart the instance anytime from the AWS console.

🔕 Smart Notification Deduplication

SaneCost doesn't spam your channel. Once an idle instance has been reported, SaneCost tracks the notification and won't re-alert for the same instance until one of these happens:

✓ The instance is stopped or terminated (alert resolved)

✓ The snooze period expires (re-evaluated on next check)

✓ CPU rises above threshold (no longer idle)

This keeps your channel clean and actionable. Teams that connect multiple AWS accounts still get a manageable alert volume.