Config drift usually gets discussed as a correctness problem: the running state no longer matches the intended one. But three specific drifts are money problems first, and they share a shape: a default nobody chose, set at provision time, growing silently ever since. None of them shows up as an incident. All of them show up on the bill, unlabeled.
Here they are, priced, with the fix for each.
CloudWatch log groups that never expire
The default retention for a CloudWatch log group is never expire. Not 90 days, not a year: forever. Every log group created without an explicit retention setting accumulates at $0.03 per GB-month of storage, on top of the $0.50 per GB you already paid at ingestion.
The math compounds quietly. A service logging 5 GB a day into a no-retention group holds about 3.6 TB after two years: roughly $110 a month in pure storage, growing about $4.50 more every month, for logs nobody has ever queried past week one. Multiply by the forty log groups a typical account accumulates, and drift becomes a line item.
