AWS Builder Center

Builder Center

CASE FILE: THE CLOUD BILL MYSTERY

CASE FILE: THE CLOUD BILL MYSTERY

Paste your AWS bill, get film noir narration pointing to the top 5 cost culprits with fixes.

THE CALL

It came in at 2 AM. Another student. Another AWS bill he didn't understand.
"Detective, my bill is $180. I only ran two EC2 instances for a weekend hackathon. How?"
I've seen this case a hundred times. Always the same story. Kid spins up resources. Forgets about them. Bill arrives. Panic.
I asked for the evidence. He sent me a CSV. Fifty rows. Service names, dollar amounts, dates. A wall of numbers that might as well be hieroglyphics.
I found the culprit in fifteen seconds. RDS database. Still running. Four dollars a day, every day, for six weeks straight.
He forgot it existed.
That's the thing about cloud bills. The real damage hides in plain sight. You're looking at EC2 charges thinking that's the problem. Meanwhile RDS is bleeding you dry in the background.
Most people don't know where to start. They see the total, panic, and either ignore it or pay it without understanding why.
I built Cloud Bill Detective to solve that exact problem. Ten seconds. Top five culprits. One-line fix for each. No hand-waving.
Live URL: https://d7pivvtomso2i.cloudfront.net 

THE METHOD

The Detective works like any good investigation. Gather evidence. Analyze patterns. Identify suspects. Present the facts.
You paste your AWS bill. CSV format or plain text, doesn't matter. The Detective:
1. Parses the data
Extracts service names and costs. Handles messy formatting (commas in numbers, inconsistent capitalization, duplicate entries for same service).
2. Aggregates the suspects
"Amazon EC2" and "EC2" and "Elastic Compute Cloud" all get rolled into one line item. No double-counting.
3. Sorts by damage
Biggest costs first. If something only cost you $0.12, we're not investigating it.
4. Pulls the top 5
These are your culprits. Everything else is noise.
5. Looks up the fix
Pre-written recommendations based on real AWS pricing. Not AI-generated guesses. Actual fixes that work.
6. Narrates the case
Film noir style. Bedrock (Claude Haiku 4.5) takes the numbers and writes 3-4 sentences that sound like a detective closing a case.

THE EVIDENCE

Every case needs hard proof. Here's what the Detective found in three real student bills from my AWS community:
CASE #1: THE FORGOTTEN DATABASE
Bill total: $180.43
Top culprit: RDS ($89.10)
Secondary suspects: EC2 ($52.30), S3 ($21.15), Lambda ($12.88), CloudWatch ($5.00)
Narration:
"The case came in at 2 AM. Total damage: $180.43. Five suspects lined up, but one stood out. RDS, bleeding $89.10—more than half the take. The alibi didn't hold."
Fix: "Stop the database or switch to Reserved Instance for 50% savings."
CASE #2: THE STORAGE HOARDER
Bill total: $95.67
Top culprit: S3 ($67.40)
Secondary suspects: CloudFront ($15.22), EC2 ($8.45), Lambda ($3.10), API Gateway ($1.50)
Narration:
"Storage doesn't lie. $67.40 sitting in S3, probably old backups nobody remembers. CloudFront stood nearby, moving data that shouldn't exist. Clean house or pay the rent."
Fix: "Move old data to Glacier, save 70% on storage costs."
CASE #3: THE RUNAWAY COMPUTE
Bill total: $210.15
Top culprit: EC2 ($178.90)
Secondary suspects: Data Transfer ($18.25), EBS ($10.00), CloudWatch ($2.50), SNS ($0.50)
Narration:
"EC2 burned through $178.90 like it had somewhere to be. On-demand pricing, no reservations, running 24/7. Amateur hour. The fix writes itself."
Fix: "Switch to Reserved Instances for 60% savings or use Spot for dev/test."
Every number is real. Every fix is based on actual AWS pricing documentation. The Detective doesn't guess.

THE TECH

The stack is clean:
Frontend: S3 + CloudFront. Static HTML. One text box, one button.
Backend: Python Lambda with Function URL. No API Gateway, no extra layers.
AI: Amazon Bedrock. Claude Haiku 4.5. Cheap, fast, good enough for narration.
Infrastructure: AWS CDK (TypeScript).
When you submit a bill:
  1. Lambda receives raw text
  2. Checks if it's CSV format or plain text
  3. Parses service names and costs (regex + csv module)
  4. Aggregates by service (handles duplicate names)
  5. Sorts descending by cost
  6. Takes top 5
  7. Looks up hardcoded fixes from a dictionary
  8. Sends data to Bedrock for narration
  9. Returns JSON: { narration, top_culprits, fixes }
  10. Frontend displays results
Total time: 2-3 seconds for most bills under 100 rows.
Here's the parsing logic:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
def parse_csv_bill(csv_text: str):
reader = csv.DictReader(io.StringIO(csv_text))
costs = []

for row in reader:
service = row.get('Service', row.get('service', 'Unknown'))
cost_str = row.get('Cost', row.get('cost', '0'))

# Strip commas, extract float
cost_match = re.search(r'[\d.]+', cost_str.replace(',', ''))
if cost_match:
cost = float(cost_match.group())
if cost > 0:
costs.append({'service': service, 'cost': cost})

return costs
No magic. Just parsing and sorting.

THE NARRATION

Numbers are boring. Nobody reads a spreadsheet for fun.
But wrap it in a detective story? People pay attention.
The narration is generated by Bedrock with a specific system prompt:
1
2
3
4
5
6
7
8
9
10
11
You are a hardboiled detective closing a case about AWS cost overruns.

Given:
- Total bill: $X
- Top culprit: ServiceName ($Y)
- Other suspects: [list]

Write 3-4 sentences in film noir style. Be dramatic but factual. Don't repeat the full cost breakdown—that's shown separately. Tease the top culprit, hint at the others.

Temperature: 0.8 (vary the style each time)
Max tokens: 150 (keep it tight)
The result varies every time you run it, but the structure stays consistent. Open with the setup. Reveal the main culprit. Close with implication.
Examples:
"The bill landed heavy. $160.43, all told. I lined up the usual suspects, but RDS stood out—$89 bleeding slow and steady. The others? Accessories to the crime."
"They called it a weekend project. The meter didn't care. EC2 ran wild, racking up $178.90 like nobody was watching. Because nobody was."
"Storage never forgets. $67.40 sitting in S3, probably files from a project six months dead. The CloudFront charges? Just moving ghosts around."
The narration doesn't invent savings numbers or promise miracles. It sets the scene. The fixes (shown separately) do the real wo

THE LIMITS

The Detective can't see everything. Here's what it misses:
Trend analysis: One bill is a snapshot. Can't tell you "RDS went up 40% this month" without historical data.
Reserved capacity opportunities: If you're running steady workloads, Reserved Instances or Savings Plans might save you money. But the Detective can't see usage patterns from a single bill.
Tagging: If you're already tagging resources by project/team/environment, Cost Explorer is better. The Detective is for people who aren't doing that yet.
Forecasting: It tells you what happened. Not what will happen if you don't change anything.
Think of it as triage. Not a full financial audit. You paste a bill, find out what's bleeding money right now, and get a starting point for fixes.
For anything more sophisticated, you need Cost Explorer, AWS Budgets, or a real FinOps practice.

THE VERDICT

If you're staring at an AWS bill and don't know where to start, the Detective gives you a place to begin.
The narration is theater. The fixes are real.
Paste your bill. See what's costing you. Fix it or don't. But at least you'll know.
Live URL: https://d7pivvtomso2i.cloudfront.net 
Built for AWS Agent Challenge 2026.
Case closed.
# agents
Any opinions in this article are those of the individual author and may not reflect the opinions of AWS.
Enjoyed reading this content? Let the author know!

Your likes, comments, shares, and saves help creators reach more builders.

Loading recommendations

Loading article