Your AWS bill has gone up: where to look in 10 minutes

The AWS email with the bill arrives and it is 40 % higher than last month. Or the budget alert goes off on the 18th. You do not need to understand the whole bill to sort it out: it is almost always one single thing that has appeared or grown, and Cost Explorer points at it in a few minutes if you know which buttons to press.

The method is always the same: first which service has gone up, then in which region, then which usage type within that service, and finally since which day. With those four answers you already know which object to look for in the console and what to do with it.

Price figures are approximate and in dollars.

Step by step

1. Open Cost Explorer and compare with last month

   Your account menu (top right), Billing and Cost Management, Cost Explorer. If it is the first time, click Enable and come back tomorrow: it takes up to 24 hours to have data.

   In the right-hand panel, period last 3 months, granularity monthly, and under Group by choose Service. You will see three bars stacked by colour. Compare this month's with the previous one: the colour that has grown is the guilty service. If the month is not over, also look at the forecast line, which extrapolates at the current pace.

2. Narrow down to the last few days to see when it started

   Change the period to last 14 days and the granularity to daily, same grouping by service. Now you will see a step: the day the daily spend went up. That day is the most valuable clue: someone created something, a process changed or something restarted. Ask the team what happened that day before searching further.

   If instead of a step you see a ramp going up little by little, it is accumulation: snapshots, logs, file versions.

3. Filter by that service and group by usage type

   In the filters panel, Service, tick only the one that has gone up and apply. Change Group by to Usage type. The names are technical but understandable: BoxUsage is machine hours, EBS:VolumeUsage disks, EBS:SnapshotUsage snapshots, DataTransfer-Out outbound data, PublicIPv4:InUseAddress and IdleAddress IP addresses, NatGateway-Hours the NAT gateway. The prefix of each name (EU, EUW3, USE1) tells you the region.

4. Group by region

   Go back to Group by and choose Region. If there is spend in a region where you have nothing (Virginia, Ohio, Frankfurt when your things are in Ireland or Paris), you have located it: someone ran a test there or a wizard created something. Switch region in the EC2 console and look at instances, volumes, snapshots and IPs. Lightsail has a separate console per region; check it too.

5. Group by tag or by resource

   If you have cost allocation tags activated (Proyecto, Propietario), group by that Tag: it tells you whose the new spend is. If not, with daily granularity and filtering by EC2, you can group by Resource over the last 14 days to see the exact identifier of the machine or disk. Copy the identifier and search for it in the EC2 console.

6. Check the official bill and the credits

   In Bills, choose the month and expand the service. There is every line with the quantity (hours, GB) and the amount, with the region in the name. Also look at credits and the free tier: an increase that coincides with the account's anniversary is usually the end of the first free year. There is nothing to fix there; the real price is finally showing.

The usual causes, from most to least frequent

Machine created and forgotten. An EC2 for a test, running for weeks. In Cost Explorer: EC2, usage type BoxUsage, a step on the day it was created. A t3.medium costs about 30-35 dollars a month; an m5.xlarge, about 150. The same in Lightsail, with the difference that there a stopped machine keeps charging the full plan.

Accumulated snapshots. A gentle ramp in EC2 (SnapshotUsage), RDS or Lightsail. Each GB costs about 0.05 dollars a month; the problem is that it is hundreds of GB across dozens of copies nobody deletes. They usually come from an automatic backup policy with no retention limit.

Unattached IP. AWS charges for every public IPv4 address, about 3.60 dollars a month each. An Elastic IP from a machine you deleted, or five of them, show up as IdleAddress. Small, but noticeable in accounts with little spend.

Outbound data transfer. DataTransfer-Out-Bytes, about 0.09 dollars per GB. A website that suddenly serves video, a backup that is now downloaded daily outside AWS, a public S3 bucket someone has linked from a high-traffic site. Also traffic between regions or between availability zones, which is charged even though it stays inside AWS.

Stopped RDS that restarts on its own. An RDS database can be stopped to save money, but AWS automatically starts it again after 7 days. Whoever stopped it on Monday finds it running and charging the following Monday. In Cost Explorer: RDS, with weekly steps if someone keeps stopping it again.

Lambda in a loop. A function that triggers itself (writes to a bucket which in turn triggers the function, or retries without limit) can run millions of times. Lambda is very cheap per execution, but millions are millions. In Cost Explorer, Lambda goes up and, with it, CloudWatch for the logs. To see it: in the AWS console go to Lambda, open the function and look at the Monitor tab, invocations chart. In Simplio there is no need to search for it: each function's card shows the month's executions and their approximate cost.

NAT Gateway. The VPC wizard creates it by default in some flows. It costs about 30-35 dollars a month just for existing, plus about 0.05 dollars per GB that goes through it. It shows up as NatGateway-Hours and NatGateway-Bytes under "EC2-Other". If your machines have a public IP, you do not need it.

Other, less frequent: a support plan subscribed by mistake, CloudWatch logs with no expiry, old versions in an S3 bucket with versioning, load balancers with nothing behind them.

How to cut the spend today

• Forgotten machine: if you do not need it, take a snapshot (just in case) and terminate it. If you need it now and then, stop it; in EC2 you will only pay for the disk. If it is Lightsail, snapshot and delete: stopping does not save anything.
• Snapshots: sort by date and delete the old ones. Keep the last two or three of each production machine. Review the automatic backup policies (Data Lifecycle Manager, AWS Backup, Lightsail automatic snapshots) and set a retention limit.
• Loose IPs: in EC2, Elastic IPs, the ones with no associated instance: Release. In Lightsail, Networking menu, the unattached ones: delete.
• Transfer: identify the source (the machine or bucket with the most outbound traffic in its metrics) and decide: caching, CloudFront, compression, moving the backup to S3 within the same region, or closing a public bucket.
• RDS that restarts: if you really do not use it, take a snapshot of the database and delete it; restoring it takes ten minutes. If you use it occasionally, schedule the weekly shutdown with EventBridge Scheduler or accept the cost.
• Lambda in a loop: lower the function's reserved concurrency to 0 to stop it on the spot, fix the trigger and raise it again.
• NAT Gateway: in VPC, NAT gateways, delete it if there are no private machines using it. First, check that no machine without a public IP needs it to reach the internet.

So it does not happen again

Three things, in this order of effort:

1. A budget in Budgets with an alert at 80 % of actual spend and at 100 % of the forecast. Two minutes. It turns a surprise at month end into a warning mid-month.
2. Tags Proyecto and Propietario activated as cost tags. Next time, step 5 of this guide gives you the name directly.
3. A five-minute monthly review: Cost Explorer by service and by region, loose IPs, disks without a machine, snapshots older than six months.

What can go wrong