Set a per-user budget so nobody creates too many machines

An AWS account with a single person is kept under control with a glance at the bill. With four or five people creating things, it is not. Each one creates "a small machine to test", "a copy just in case", "a database for a moment", and none of them sees what the others create. Nobody spends much; between all of them, the bill doubles in three months. And when it arrives, there is no way to know whose each dollar is.

The solution is not to forbid, but to give each person a monthly figure and make visible how much they have spent. It is the same as a company card with a limit: nobody takes offence, and it avoids 90 % of the surprises.

AWS has no "per-user budget" as such. It can be imitated with three pieces: a mandatory tag with the name of whoever creates each thing, a budget (Budgets) filtered by that tag, and an IAM policy that prevents creating without a tag. The steps below build it; the following sections explain how to decide the figures and what to count.

Step by step

1. Decide the tag and tell everyone

   Choose a tag name and a value format, and never change them: for example Propietario with each person's IAM user name (Propietario = ana). Write it down somewhere everyone can see. From now on, everything that gets created (machines, disks, snapshots, databases, buckets) carries that tag.

2. Activate the tag as a cost allocation tag

   In the AWS console, your account menu, Billing and Cost Management, section Cost allocation tags. Look for Propietario in the list of user-defined tags and click Activate. Until it is activated, Cost Explorer and Budgets cannot filter by it. It takes up to 24 hours to appear, and it only counts spending from the moment it is activated, not earlier.

3. Create a budget per person in Budgets

   In Billing and Cost Management, go to Budgets and click Create budget. Choose Customize, type Cost budget, period Monthly, fixed amount (for example 60 dollars). Under Filters, choose the dimension Tag, key Propietario, value ana. Name it presupuesto-ana.

   In the alerts, add two: when the actual spend exceeds 80 % and when the forecast exceeds 100 %, with that person's email and yours. Repeat the budget for each person. The first two budgets in the account are free; beyond that, each costs a few cents a day.

4. Prevent creating machines without a tag

   In IAM, Policies, Create policy, JSON editor. A deny policy like this one prevents creating an EC2 instance or a volume that does not carry the Propietario tag:

   {
     "Version": "2012-10-17",
     "Statement": [{
       "Effect": "Deny",
       "Action": ["ec2:RunInstances", "ec2:CreateVolume"],
       "Resource": ["arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*"],
       "Condition": { "Null": { "aws:RequestTag/Propietario": "true" } }
     }]
   }

   Attach the policy to the user group. With a similar condition (StringNotEquals on aws:RequestTag/Propietario and the variable ${aws:username}) you can force the value to be the user's own name, so nobody charges their machines to someone else. Each service has its own actions (rds:CreateDBInstance, lightsail:CreateInstances); start with EC2 and RDS, which is where the money is.

5. Limit which sizes can be created

   A budget warns, but it does not stop a 2-dollar-an-hour machine created on a Friday afternoon. Add another deny policy for ec2:RunInstances with the condition ec2:InstanceType outside a list (t3.micro, t3.small, t3.medium...). Whoever needs something bigger asks for it. In RDS the equivalent is rds:DatabaseClass.

6. Review once a month

   In Cost Explorer, group by the Propietario tag. You will see one bar per person and another one, "No tag", with everything created by skipping the rule or before it was set. That bar is the to-do list: tag or delete. Spend ten minutes at the start of each month and go over the figures with the team. Transparency does more than any policy.

Why spending shoots up with several people

It is not bad faith or carelessness; it is that the AWS console gives no signal of what each click costs. Creating a machine does not show the monthly price, only the type. A snapshot does not warn you that it is charged forever. And each person sees the account as "theirs": they do not know there are already three test machines from other colleagues doing the same thing.

The three patterns that cost the most money:

• Create and forget. A machine for a two-day test that stays on for three months. It is, by far, the number one cause.
• "Just in case" copies. Snapshots before every change, which nobody deletes afterwards.
• Size for comfort. Choosing a machine four times bigger than needed "so it runs well", without knowing it costs four times more.

How to set the figure

Start from what is already being spent. Look at the last three months in Cost Explorer and split it mentally by person (if there are no tags, ask). Usually one or two people account for almost all the legitimate spend (production) and the rest is testing and development.

Separate two things: what is shared (production servers, the company database) and what is personal (what each person creates for their own work). The per-user budget applies only to the second. For a developer, a reasonable figure is between 30 and 100 dollars a month: enough for one or two small machines running during office hours and a handful of snapshots. For someone who only looks, zero.

Set the figure a little above what the biggest reasonable spender spends today, and lower it after two months if there is room to spare.

What to count in each person's budget

Everything that person creates that has a recurring cost:

• Machines on EC2 and Lightsail, by the hour or by monthly plan. Remember that in Lightsail a stopped machine is still charged.
• Disks of those machines, including the ones left loose when deleting them.
• Databases on RDS and Lightsail, which are usually the most expensive object a person creates.
• Snapshots, per GB per month while they exist.
• Buckets in S3: storage and, above all, what is downloaded from them.
• IPs reserved and not attached.

What you do not need to count at first: data transfer, CloudWatch logs, DNS queries. They are small and hard to attribute. Focus on what gets created with a button and forgotten.

One trap: Budgets counts the accumulated spend of the month. What someone created on the 2nd and deleted on the 3rd keeps adding up even though the object no longer exists.

What AWS cannot do

It is worth being honest about the limits of this setup:

• Budgets warns, it does not block. There are "budget actions" that apply a deny policy when a threshold is exceeded, but they are crude and arrive late: the money is already spent.
• Tags depend on people adding them. The IAM policy enforces it in EC2 and RDS, but not every service supports tagging at creation time, and automatic snapshots do not inherit the disk's tag.
• Lightsail tags, but its console does not enforce it, and what was created before activating the cost tag is not counted.
• It takes upkeep: each new person means a budget, a tag value and a review; each person who leaves, cleaning up what was theirs.

Even so, it is much better than nothing.

What can go wrong