Your First AWS Bill Shouldn't Be a Surprise
Seven common AWS cost traps, from idle EBS volumes to NAT Gateway and data transfer charges, each explained for beginners with a pro tip for experienced builders. Includes a 10-minute checklist to keep your bill predictable.
Your First AWS Bill Shouldn't Be a Surprise
7 cost traps that catch beginners and seasoned engineers alike, and the habits that keep them away.
Almost everyone who uses AWS has a story about an unexpected bill. Beginners get surprised because they don't know what is billed. Professionals get surprised because, at scale, small leaks become large ones.
The good news: most surprise charges come from the same handful of causes. This article walks through seven of them. Each one has a plain explanation for those just starting out and a pro tip for those already running workloads in production.
The 7 cost traps
1. "I stopped the instance, so I'm not paying"
Plain explanation: Stopping an EC2 instance stops compute charges, but its EBS volumes keep existing and keep being billed. Terminating the instance is different from stopping it.
Pro tip: Audit unattached EBS volumes regularly. Set
DeleteOnTermination deliberately in your launch templates instead of relying on defaults.2. Forgotten snapshots and AMIs
Plain explanation: Every backup (snapshot) you take is stored and billed until you delete it. Deleting an AMI does not automatically delete the snapshots behind it.
Pro tip: Use Amazon Data Lifecycle Manager or AWS Backup with retention rules, so old snapshots expire on a schedule instead of on someone's memory.
3. Public IPv4 addresses
Plain explanation: AWS charges for public IPv4 addresses, including Elastic IPs that are allocated but not attached to anything. One idle address is cheap; ten across forgotten accounts add up.
Pro tip: Use the IPv4 insights in Amazon VPC IP Address Manager (IPAM) to find them, and consider IPv6 or private subnets behind a load balancer where possible.
4. The NAT Gateway nobody questioned
Plain explanation: A NAT Gateway lets private resources reach the internet. It is billed per hour and per gigabyte processed, even when traffic is light.
Pro tip: Add VPC gateway endpoints for S3 and DynamoDB so that traffic skips the NAT entirely. In dev environments, ask whether every subnet really needs one.
5. Data transfer out
Plain explanation: Sending data into AWS is generally free; sending it out to the internet, or between Regions, usually is not. A popular file download can cost more than the server hosting it.
Pro tip: Put Amazon CloudFront in front of public content, keep chatty services in the same Availability Zone when resilience allows, and watch cross-Region replication volume.
6. Logs that live forever
Plain explanation: CloudWatch Logs keeps log groups indefinitely by default, and you pay for storage. Verbose debug logging left on in production is a classic culprit.
Pro tip: Set a retention period on every log group (enforce it with infrastructure as code), and move long-term logs to S3 with lifecycle rules to cheaper storage classes.
7. The "quick test" in another Region
Plain explanation: The console shows resources one Region at a time. A test you launched in a different Region keeps running while you look elsewhere and see nothing.
Pro tip: Use Resource Explorer or Cost Explorer grouped by Region to spot strays, and restrict unused Regions with Service Control Policies in AWS Organizations.
A 10-minute safety checklist
Do this once on any account you own, whether it is a personal sandbox or a production payer account.
- [ ] Create an AWS Budget with email alerts at 50%, 80% and 100% of a monthly limit you choose
- [ ] Turn on Cost Anomaly Detection so unusual spikes trigger an alert within a day
- [ ] Open Cost Explorer, group by Service and then by Region, and question anything you don't recognize
- [ ] Check EC2 → Volumes, Snapshots and Elastic IPs for anything unattached
- [ ] Set a retention period on every CloudWatch log group
- [ ] Tag resources with at least
ownerandproject, and activate those tags as cost allocation tags - [ ] Before ending any lab or tutorial, delete what you created (or use a CloudFormation stack so one delete cleans everything up)
We can help each other out! Paste your comments and articles if you are trying to earn the badges!
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article