Back to Setup Guide

Guide

How SaneCost Detects Idle Instances

SaneCost monitors your EC2 instances through CloudWatch metrics. When a resource is burning money but doing nothing, you get an actionable Slack alert.

The Detection Pipeline

Every 10 minutes, SaneCost runs a check cycle across all your connected AWS accounts. Here's what happens behind the scenes:

1. Scan EC2 Instances

SaneCost lists all running instances in your connected account via the cross-account IAM role

2. Pull CloudWatch Metrics

For each instance, fetch CPU utilization data for the past 24 hours

3. Apply Idle Threshold

Flag instances where average CPU has been below 5% for the full monitoring window

4. Calculate Waste Cost

Estimate monthly cost based on instance type and pricing. Filter out instances below $5/month savings

5. Send Slack Alert

Post an actionable notification to your configured channel with Stop and Snooze buttons

🎯 What Triggers an Alert

An instance is flagged as idle when all three conditions are met simultaneously:

< 5%
Average CPU utilization
2h
Continuous low CPU period
≥ $5
Monthly savings minimum

This combination eliminates false positives. A server that spikes briefly or costs almost nothing won't generate noise in your channel. Only genuinely wasted spend triggers alerts.

Why these defaults? The 2-hour window catches genuinely idle instances while ignoring brief dips from batch jobs or deploys. The $5/month savings floor filters out nano-instances that aren't worth acting on. Both thresholds are fully configurable — adjust the CPU percentage, idle duration, and minimum savings via /sanecost config to match your workload patterns.

💬 What the Alert Looks Like

When SaneCost detects an idle instance, this is what appears in your notification channel:

# sanecost-channel
SC

SaneCost APP 2:00 PM

💤 Found a sleepy instance that might not be needed

dev-api-server
• Instance type: t3.large
• Running time: 168 hours
• Monthly cost: $73.50

CPU has averaged under 5% for over 2 hours — this instance looks idle.

💾 Stop & Save
⏰ Snooze

🎮 Taking Action

Each alert includes two one-click actions. No need to open the AWS console:

ButtonWhat It DoesWhen to Use
💾 Stop & Save Stops the EC2 instance immediately via the cross-account role. Does not terminate — you can restart later. You've confirmed the instance isn't needed right now.
⏰ Snooze Suppresses alerts for this instance for a configurable period. SaneCost will check again after the snooze expires. The instance is legitimately idle (e.g., staging for next sprint) and you don't want repeated alerts.

Safety note: "Stop & Save" stops the instance, it does not terminate. Your data, EBS volumes, and configuration remain intact. You can restart the instance anytime from the AWS console.

🔕 Smart Notification Deduplication

SaneCost doesn't spam your channel. Once an idle instance has been reported, SaneCost tracks the notification and won't re-alert for the same instance until one of these happens:

The instance is stopped or terminated (alert resolved)

The snooze period expires (re-evaluated on next check)

CPU rises above threshold (no longer idle)

This keeps your channel clean and actionable. Teams that connect multiple AWS accounts still get a manageable alert volume.