A team spun up a fleet to load test a release on a Thursday. The release went out. The fleet stayed. Nobody looked again until the following month, when finance asked why one cost centre had jumped by five figures.
It took Duke twenty minutes to find and kill. That is the part that still annoys us. Twenty minutes of work, four weeks late, because nothing in the account had an opinion about idle machines at 3 a.m.
We had used ParkMyCloud for exactly this. It turned non-production resources off when nobody was using them, and it did it without a forty-page procurement process. Then Turbonomic bought it in 2019, IBM bought Turbonomic in 2021, and the simple scheduler got folded into a much bigger platform. The lightweight version never came back.
We met working on that same giant AWS account. Both of us had watched the provider side and the paying side. We knew the problem was not a missing feature in one service. It was that nobody had time to be the person who turns things off.
The IAM half came from the same estate. Fixing access meant reading a policy so nested that three engineers disagreed about what it actually allowed. Not a hard question. Just written in a language humans do not read well.
So: park what nobody is using, and say plainly who can do what. That is the whole company. We are not adding a tenth module.