Lift-and-shift cloud bills: what we check first

Shared hosting hid the real shape of traffic

A typical app we inherit runs on one box: web, MySQL, cron, and backups. The monthly fee is a round number. After lift-and-shift you pay for compute, block storage IOPS, snapshots, a load balancer, a NAT gateway, and egress. None of those line items existed as separate invoices before.

We map the current box before we size instances: CPU steal, disk wait, peak RAM, and whether cron jobs collide with the morning peak. Undersizing the first week looks like a cloud failure. Oversizing by 4× is how a “simple move” doubles the bill.

The five cost traps we look for

• NAT gateways on every subnet. Private instances that only need outbound package updates can use cheaper patterns. NAT billed per GB adds up if the app polls a third-party API every few seconds.
• Unattached volumes and old snapshots. Test restores leave disks around. We inventory them in week one.
• Verbose application logs shipped to a paid log product 24/7. Debug level in production is a tax. We keep error + request ID, sample the rest.
• Multi-AZ “because best practice” for a single-tenant internal tool. Availability is a requirement, not a default. We ask what an hour of downtime actually costs.
• Managed database one size above need. Storage auto-grow is fine; compute class is not. We start from observed connections and QPS, not from a vendor’s “production” SKU.

When we refuse a lift-and-shift

If the app still does N+1 queries on the hot page, cloud will not fix the morning timeout — it will make it more expensive. We either fix the query path first (see the 600ms work) or we say the move should wait. Hosting a slow app on a larger VM is not a migration plan.

We also refuse “multi-region from day one” unless there is a documented RPO/RTO and someone who will run failover drills. Fake HA is worse than a single region with backups you have restored once.

What a sane first month looks like

One region, sized from metrics, backups tested, cost alerts at 50% of the old monthly hosting plus a stated buffer. After 30 days we review idle resources and reserved vs on-demand. That review is part of cloud hosting work — not an optional extra after the cutover party.

If you already moved and the invoice jumped, send the last bill and a description of the app. We will tell you which line items to kill before we talk about Kubernetes.