The unattached EBS volume one is the sneakiest of the five, honestly. Terminating an EC2 instance feels like a clean, complete action, but the volume surviving that termination by default (unless "Delete on Termination" was set at launch) means the cost keeps accruing on something that looks, from the billing dashboard, like it belongs to nothing. That's the kind of charge that survives for months precisely because there's no obvious "owner" left to notice it.

NAT Gateway is the one I'd flag as most likely to blindside a smaller team specifically, since it's easy to treat as a one-time networking decision rather than an ongoing cost line. A dev environment needing outbound internet for a few hours a week paying for 24/7 NAT uptime is a good example of infrastructure that was correctly provisioned once and then never revisited, which is really the theme running through all five of these, none of them are configuration mistakes, they're all review mistakes.

The tagging recommendation under EC2 is probably the highest-leverage single practice in the whole list, since it's the thing that makes every other point on this list actually actionable. Untagged idle resources are invisible in a monthly review; tagged-by-owner ones at least have someone to ask "do you still need this" before the bill quietly compounds another month.