"I already deleted the server, but AWS keeps charging me." It is the most repeated sentence on any AWS forum. Because deleting the machine does not delete its disk unless the box was ticked, nor its fixed IP, nor its snapshots, nor the DNS zone, nor the backup bucket, nor the database someone stopped "for now". And because the console shows one region at a time: what you created in Virginia two years ago does not show up while you are looking at Ireland. This guide is a shopping list in reverse: everything you have to check so the bill drops to zero, in order.
Before you start: what each thing means
- Region
- Each place in the world where Amazon has data centres. The console shows one at a time; you have to go through every one you have ever used.
- Terminate
- Delete an EC2 machine for good. Stopping is not terminating: a stopped machine still gets charged for its disk.
- EBS volume
- The disk of an EC2 machine. If it is not deleted when the machine is terminated, it stays "available" and gets charged.
- Snapshot
- A copy of a disk, a machine or a database. It is charged for as long as it exists, even if what it copied is gone.
- Elastic IP / static IP
- A fixed internet address. It is charged while it is reserved, whether or not it is in use.
- Hosted zone
- The file for a domain in Route 53. It has a fixed monthly cost even if the domain is not used.
- Cost Explorer
- The AWS screen for seeing spend by service and region. It is the tool for finding what slips past you.
Step by step
Start with the bill, not the console
Billing, Bills, current month: the list of services with an amount tells you exactly what is still charging and in which region. That is your to-do list. Also open Cost Explorer grouped by service and by region for the last three months: anything showing an amount above zero is what you need to go looking for. Write down the regions that appear.
Machines, disks and IPs, region by region
In each region on your list, EC2 console: Instances: terminate the ones you no longer need (and make an image first if you might ever need them again). Volumes: delete those in the "available" state (no machine attached). Elastic IPs: release the ones that are not associated. Snapshots and AMIs: deregister the images and delete their snapshots, except for the final copy you want to keep. Load balancers and NAT gateways, if there were any: delete them; they charge by the hour even with no traffic.
Lightsail, which is separate
Lightsail has its own console and does not appear in EC2. Go in and check, again region by region: Instances (a stopped one is still charged), Databases, Storage (additional disks), Networking (unattached static IPs, load balancers, distributions) and Snapshots, of machines as well as disks and databases.
Databases and storage
RDS: stopped instances start up again on their own after seven days and resume charging; delete the ones you do not need, with a final snapshot if you want to keep the data, and check manual Snapshots. S3: buckets cannot be deleted while they have content; empty them (the "Empty" button) and delete them, or leave them if they are the archive you want to keep and give them a lifecycle rule. Also check EFS and Backup if you ever used them.
What always gets forgotten
- Route 53: every hosted zone charges per month. Delete those for domains you no longer use (first empty their records, except NS and SOA). And remember that domains registered in Route 53 renew and charge every year: turn off auto-renewal if you do not want them.
- CloudWatch: log groups that grow forever. Delete them or set a retention period.
- Secrets Manager, KMS: each secret and each customer-managed key charges per month.
- Support plans: cancelled under Support, Plans.
- Reserved Instances and Savings Plans: they cannot be cancelled; you pay until they expire. At the very least, do not renew.
- SES, SNS, Lambda: normally cents, but a function that runs every minute for no reason keeps adding up.
Check the following month (and set a budget)
Create a 1-dollar budget in Budgets with an alert at 100%: if something is still charging, you will find out by email. When the month closes, go back to Bills: the list should be empty or contain only what you decided to keep (a final snapshot, a DNS zone). If something shows up, Cost Explorer by region tells you where it is. If you really are not coming back, you can close the account from Account, but only once the bill is at zero: closing does not delete resources, and whatever was left may keep being billed.
What can go wrong
I cannot find where a small charge comes from
Cost Explorer, filter by that service, group by region and then by usage type. The usage type name usually describes the resource (for example "EBS:SnapshotUsage" or "ElasticIP:IdleAddress"). With the region and the type, go to that service's console in that region and there it is.
I cannot delete a security group or a network
Something is still using them. The error message usually says what. Default networks (VPCs) do not need to be deleted: they cost nothing.
I deleted a disk with data I wanted
If it had a snapshot, create a volume from it. If not, it is gone. That is why the order matters: first the image or final snapshot, then delete.
I closed the account and bills keep arriving
Resources were left behind. AWS keeps a period after closure during which you can reopen the account to finish cleaning up; do it as soon as possible and contact billing support if needed.
In Simplio
In Simplio the Costs screen lists every object in every AWS account with its estimated monthly cost, across all regions at once, and flags what is doing nothing: disks without a machine, unattached IPs, old snapshots, stopped databases. You select what is surplus and delete it with two-factor, with a final snapshot if you want. The next day, the end-of-month forecast tells you whether it is already at zero.
The same task, in AWS and in Simplio
| In the AWS console | In Simplio | |
|---|---|---|
| Finding everything that charges | Bills, Cost Explorer, 6 different consoles, region by region: a long half hour and things that slip through | Costs screen: every object in every account with its estimated cost, including loose disks, unused IPs and snapshots, all regions together |
| Deleting it | One by one in its own console and region | Multi-select and delete with two-factor, with an optional final snapshot |
| Checking it is down to zero | Next month's bill | The end-of-month forecast on the Costs screen, the next day |