How I Accidental-Proofed My AWS Student Account: 3 Serverless Automations That Saved My Budget
As an AWS student, my biggest fear was an unexpected 3-figure cloud bill. In this guide, I share how I built 3 automated, serverless guardrails using AWS Lambda, EventBridge, CloudWatch, and AWS Budgets to protect my Free Tier account, prevent idle resource costs, and receive real-time Discord alerts.
Introduction
As a student exploring Amazon Web Services, my biggest fear wasn't failing a certification or running into a complex IAM policy—it was waking up to a unexpected 3-figure invoice on my credit card because I forgot to tear down an EC2 instance or CloudWatch log stream.
While learning AWS, I realized that the Free Tier isn't an automated safety net; it's a quota you have to actively govern.
After a minor scare with an idle RDS database, I decided to stop relying on manual memory and built three lightweight, automated guardrails using AWS Lambda, EventBridge, and AWS Budgets. Here is how I set them up—and how you can deploy them in under 15 minutes.
1. The Auto-Nuke Button: Auto-stopping Idle EC2 Instances
When working on labs or personal projects, it's easy to stop working at night and forget your EC2 instances running.
The Solution: An Amazon EventBridge scheduled rule triggering an AWS Lambda function every day at 8:00 PM to stop any running instance tagged with
Environment: Dev or AutoStop: True.1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
import boto3
ec2 = boto3.client('ec2')
def lambda_handler(event, context):
# Search for running instances with AutoStop tag
instances = ec2.describe_instances(
Filters=[
{'Name': 'instance-state-name', 'Values': ['running']},
{'Name': 'tag:AutoStop', 'Values': ['True']}
]
)
instance_ids = []
for reservation in instances['Reservations']:
for instance in reservation['Instances']:
instance_ids.append(instance['InstanceId'])
if instance_ids:
ec2.stop_instances(InstanceIds=instance_ids)
print(f"Successfully stopped instances: {instance_ids}")
else:
print("No idle instances found to stop.")
Pro-Tip for Students: Tag your resources as soon as you launch them! Combined with standard tagging practices, this simple function prevented me from running up an $80 bill during finals week.
2. Real-Time Budget Alerts via Slack/Discord Webhook
Standard AWS Budget emails often go to spam or get buried under primary inbox notifications.
By combining AWS Budgets → Amazon SNS → AWS Lambda, I routed real-time billing alerts directly to a personal Discord/Slack server channel that I check every hour.
- Create an AWS Budget with a $5.00 limit.
- Set thresholds at 50%, 80%, and 100%.
- Attach an SNS Topic that triggers a Lambda sending a POST payload to your Discord Webhook:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
import json
import urllib.request
DISCORD_WEBHOOK_URL = "https://discord.com/api/webhooks/YOUR_WEBHOOK_URL"
def lambda_handler(event, context):
message = json.loads(event['Records'][0]['Sns']['Message'])
payload = {
"content": f"⚠️ **AWS Budget Alert!**\n> {message.get('Description', 'Budget threshold reached.')}"
}
req = urllib.request.Request(
DISCORD_WEBHOOK_URL,
data=json.dumps(payload).encode('utf-8'),
headers={'Content-Type': 'application/json', 'User-Agent': 'Mozilla/5.0'}
)
urllib.request.urlopen(req)
return {"statusCode": 200}
3. Setting CloudWatch Log Retention Limits
CloudWatch Logs are quiet money drainers. By default, log groups retain logs Forever, which eventually breaches the 5 GB free storage tier.
Using the AWS CLI, I ran a simple script to set retention on all default log groups to 7 days, which is more than enough for student project debugging:
1
2
3
4
# List log groups and set retention to 7 days
aws logs describe-log-groups --query "logGroups[*].logGroupName" --output text | \
tr '\t' '\n' | \
xargs -I {} aws logs put-retention-policy --log-group-name "{}" --retention-in-days 7
Key Takeaways & What I Learned
Building these small guardrails taught me three fundamental AWS principles:
- Event-Driven Governance: Security and cost management are much easier when automated through EventBridge and Lambda.
- Tagging is Critical: You can't manage or automate what you don't track.
- Cloud Ownership: Being a cloud developer isn't just about making things work—it's about making them reliable and cost-efficient.
Are you using any custom guardrails in your sandbox accounts? Let me know in the comments below!
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article