−38% infra cost in 90 days

The challenge

The client, a Nordic payments platform, processes card payments for around 4,000 merchants. Three years of growth-first engineering had left the AWS bill at roughly $212k a month and climbing 8% quarter on quarter — faster than transaction revenue. Finance could see the total but not the causes: fewer than half of all resources carried usable tags, so nobody could say which product line or team the money belonged to.

The waste hid in defensible-sounding places. Kubernetes resource requests had been set generously during a 2023 incident and never revisited, leaving clusters at 22% average utilization. Every team provisioned its own RDS instances “to be safe.” Development environments ran around the clock, weekends included. And because the platform is PCI DSS Level 1, every proposed change carried a compliance question that made engineers default to touching nothing.

The CFO’s brief was blunt: cut the bill materially within a quarter, hold 99.99% availability on the payment path, and don’t create an ops burden that eats the savings within a year.

The approach

We started with two weeks of measurement, not migration. Cost and Usage Reports went into Athena, a tagging standard was enforced through AWS Config rules, and every dollar was attributed to a service and a team. That produced a ranked backlog of 31 savings opportunities, each with an estimated monthly value, an effort score, and a risk note — so the client’s leadership could approve the plan line by line instead of on faith.

The biggest wins were mechanical. We right-sized Kubernetes workloads from two weeks of Vertical Pod Autoscaler recommendations, then replaced static node groups with Karpenter so the cluster scaled with demand instead of with fear. Batch settlement jobs — a third of all compute — moved to spot instances with checkpointing, so an interruption costs minutes, not a rerun. Sixteen underused RDS instances consolidated to six on Graviton, and development environments became ephemeral: built from Terraform on demand, destroyed every night.

To make the changes stick, we packaged the new defaults as versioned Terraform modules — the paved road for every new service — and shipped per-team cost dashboards on Kubecost with budget alerts wired to Slack. Finance got one number to watch: cost per 1,000 transactions. Compliance ran alongside throughout; every change went through the existing change-control process, and the PCI scope never moved.

The result

Monthly spend fell 38% by week twelve, with zero customer-facing incidents along the way and availability holding at 99.99% on the payment path. Cost per 1,000 transactions — the number the board now sees — dropped 43%, because throughput kept growing while spend shrank.

More durable than the number is the system that maintains it. Six months on, spend remains within 4% of the post-engagement baseline: tagging is enforced automatically, new services inherit right-sized defaults from the Terraform modules, and engineers see the cost of what they run in the same dashboards as latency and errors. The client’s platform team operates the whole loop without us — which was the brief.