TechSoup cut AWS spend 50% with an AWS Well-Architected review

TechSoup's AWS environment ran two EKS clusters (staging and production) on an on-demand pricing model, with stateful workloads on an RDS Aurora MySQL setup. None of this was wrong by itself, but the pricing model and instance sizing were costing TechSoup money that, as a non-profit, every Euro was being pulled directly from programs for teachers, NGO staff, and volunteers.

The constraint was clear: reduce AWS spend significantly without degrading platform performance, and tighten the security posture at the same time. Cost work that hurt reliability or security would have moved the problem rather than solved it.

We ran an AWS Well-Architected Framework review across TechSoup's environment. The framework's six pillars (operational excellence, security, reliability, performance efficiency, cost optimization, sustainability) gave us a structured lens for finding where the environment was over-allocated and where security controls needed strengthening.

Working with TechSoup's team, we turned the review findings into a concrete implementation plan, addressing the biggest cost drivers first and bundling security upgrades into the same set of changes:

1. Purchased a one-year AWS savings plan for the production EKS cluster, locking in a reduced hourly rate for EC2 and cutting associated costs by 35%.
2. Right-sized the RDS Aurora instance after analyzing utilization metrics together with TechSoup's developers, cutting associated database costs by 90%.
3. Migrated the staging environment from on-demand to spot instances, accepting a few-minutes-of-downtime trade-off in exchange for a 65% cost reduction on staging compute.
4. Hardened the AWS account baseline: enforced strong passwords and MFA, switched to short-lived credentials, centralized identity, configured service and application logging, deployed AWS WAF on public-facing apps, and enforced encryption at rest.

The cost work freed budget that TechSoup could redirect to programs for teachers and NGO staff, instead of into AWS line items they couldn't justify against their mission.

On the security side, the upgrades closed visible gaps in identity management, access control, logging, and web-application protection, giving the team a baseline they could maintain and audit against.

TechSoup also qualified for $5,000 in AWS credits as part of the workload remediation following the review, extending their cloud runway further. The platform now runs the same workloads on a tighter security baseline, with capacity to grow without the cost pressure that triggered the engagement.