One user in one of our AWS Org's accounts created VPC with "dedicated" tenancy and created EC2 instances there (like usual). But these instances had "dedicated" tenance. In the end it costed us quite a lot, for 3-4 consecutive month until it was spotted by us and remediated. It could be good if such instances would be marked somehow in reports with high attention signs/colors

AMI older than 90 days, exclude in-use AMI

Detect Instance of SFTP Transfer Family in "Offline" mode which still be billed.

Detection of unusd CMK

NAT Gateway without traffic.

Unused NLB, CLB, ALB, etc..