In 2018, the small fintech I worked at had its AWS run by an offshore firm. Most things worked. Services ran, bills got paid. Then the bill started climbing past what any of us thought the workload justified, and requests for an explanation got slow replies or none at all. Management asked me to poke at the account informally a couple of times, and what I found made them less confident rather than more. One morning the contract was terminated, with no handover.
I took it on. I was a frontend engineer at the time, one of around 10 on the engineering team, with some GCP exposure from a Google Summer of Code project a couple of years earlier. Nothing deep, no certifications, no AWS on paper. But, somebody had to, and the next-closest person had less. The case for me was mostly that the learning was going to happen one way or another and I was the closest to where it had to start.
For the first few days I was a headless animal. No runbooks, nothing tagged, a root account, a handful of IAM users with long-lived keys and a console full of things I had never seen before. What got me moving was drawing parallels with GCP: IAM vs IAM, S3 vs GCS, EC2 vs Compute Engine, Security Groups vs firewall rules, VPC vs VPC (close enough). The names and the defaults differ in small ways that matter, but the mental model mostly carries over. A week in, I stopped needing the translation for most things.
Access & security came first. I rotated every key, dropped the IAM users that didn't need to exist, pulled buckets off the public internet where they shouldn't have been and tightened the security groups a notch at a time, watching Slack for a day after each one to see what broke.
Then rightsizing. EC2 instance types matched to the CloudWatch metrics I could see, instead of whatever the previous vendor had guessed. There were a lot of m4.2xlarges doing the work of m4.larges. That move alone paid for several months of my learning curve.
Then the culling, which was the part I was least proud of at the time. Anything with no identifiable owner, no traffic and no explanation got stopped (stopped, not terminated). Then I would wait for a cry on Slack. Most of the time nothing came. Now and then something did, and I would start it back up and learn what it was. Trial & error, with Slack as the monitoring plane. Not pretty. But, the alternative was paying for services nobody knew existed, indefinitely.
Reserved Instances came later, and not quickly. RIs are a 1-year lock-in at minimum, and a small startup that might pivot its workload in 6 months doesn't commit lightly to that. I waited until I was confident which instances were baseline load before buying anything. Spot went in where we could tolerate interruption, mostly batch workloads.
It took 2, maybe 3 months. The bill came down by about half, from somewhere in the 40,000-a-month range to the low 20s. The infra stopped being a mystery. And the frontend engineer who was going to do this for a quarter didn't go back.
The part I don't dwell on is that I wrote almost none of this down while it was happening. Every decision lived in my head, including the reasons things were the size they were. Bus factor of 1. Good for the cost line and bad for me. Every infra question has funnelled to me since, whether I'm on call or on holiday, and 2-and-change years on it hasn't fully unwound. If I were doing it again, I would lose a day a week to writing things down from the first week. I didn't, and I'm the one who still pays for it.
It's fair to ask whether any of this was real expertise or just a low bar set by the previous vendor. Mostly the latter, for the first round of fixes. Anyone who had touched AWS before would have caught the public S3 buckets and the oversized instances. The RI strategy and the rightsizing based on real load patterns took some learning. But, the 50% headline was easy because the bar was on the floor.
So, that's how I became the infra person. I was the closest one to the problem, willing to learn on the job, and the company was small enough that volunteering and doing weren't really separate acts. I think small teams underrate this. Hiring for a gap is expensive (weeks to run a process, more weeks before the hire is productive, and the problem keeps costing money the whole time), while somebody already in the room has offered to do it. Saying yes is close to free, and it tells the rest of the team how the place rewards initiative.