Home / Research reports / Cloud cost
Why AWS Bills Spike: Seven Common Causes and How to Trace Them
The usual suspects behind surprise AWS charges, and a simple method for finding the resource responsible.
The seven usual causes
- Data transfer and NAT gateway charges from traffic that was never meant to leave a private network.
- Orphaned resources: unattached volumes, old snapshots, idle load balancers and unused Elastic IPs.
- Over-provisioned instances and databases that were sized for a peak long gone.
- Logging and monitoring volume, including verbose application logs and heavy request counts.
- Development and test environments left running outside working hours.
- Compromised credentials used to launch instances in unfamiliar regions.
- Marketplace subscriptions and free-tier allowances that have expired.
How to trace a spike
Start in Cost Explorer. Group by service, then region, then usage type, and compare with the previous period. If tags are present, group by tag to find the owning team. For line-level detail, the Cost and Usage Report shows the exact resource.
A sudden jump in an unfamiliar region or service is a security signal first and a cost problem second.
Keep it from happening again
Set budgets with alerts, turn on cost anomaly detection, enforce a tagging policy, and review the top five cost drivers monthly. Remove access keys that are no longer needed and require multi-factor authentication for privileged users.
When you need AWS Support
If a charge came from a misconfiguration or compromise, collect the timeline, affected resources, the corrective steps taken and the invoice lines in question. A clear evidence pack makes a billing case much easier to review.
Method and limits
This note is a practitioner framework drawn from our audit and campaign work. It contains no client data and no invented statistics. Platforms change often, so confirm current features and rules for your market.