Storage spend is growing faster than data volume. What are the likely causes?

What is being tested

Whether you know where storage cost hides — which is almost never in the primary data.

The likely causes

1. Snapshots and backups. Frequently larger than the primary data, retained indefinitely, and almost never reviewed. Daily snapshots retained for a year with no lifecycle policy is the single most common cause of this pattern.

2. Orphaned volumes. Storage from terminated instances that was not deleted, accumulating quietly. Every large estate has them, and without ownership tags nobody can safely remove them.

3. Wrong tier for the access pattern. Data sitting in premium or high-performance storage that is never read. Conversely, data moved to a cold tier by an age-based policy but read frequently, so retrieval charges exceed the storage saving — this produces exactly this symptom and is the counter-intuitive one.

4. Request charges. With millions of small objects, per-request costs can exceed storage costs entirely, and they grow with access rather than with volume.

5. Cross-region replication, charged both as storage in the second region and as transfer to get it there.

6. Versioning enabled without lifecycle rules, so every overwrite retains the previous version forever.

7. Autoscaling storage that cannot shrink, so a one-off bulk load raised the floor permanently.

8. Retention policies that exist in a document and not as a job. This is usually the largest single line, and the gap between documented and enforced retention is where most of the cost lives.

The diagnostic

Break the bill down by storage class, by request charges, and by snapshot versus primary. The answer is nearly always obvious once separated, and it is nearly always invisible in the total.

Then check the growth rate of each: primary data growing 10% while snapshots grow 60% identifies the problem immediately.

The fixes in order

1. Enforce retention — a job that runs, not a policy that exists.
2. Lifecycle rules driven by access pattern, not by age alone. Intelligent tiering where available.
3. Delete orphans, with ownership tags making that safe.
4. Snapshot lifecycle: daily for a week, weekly for a month, monthly for a year — rather than everything forever.
5. Consider deduplication and compression, which can be dramatic depending on the data.

What a strong answer adds

That the largest lever is upstream: do not store it. Sampling telemetry, aggregating rather than retaining raw events, and declining to store full request bodies removes the cost permanently rather than managing it — and removes legal exposure at the same time, which is the larger benefit.