My AWS Bill Suddenly Doubled: The 20-Minute Triage

Open Cost Explorer, set granularity to daily, group by service, and find the day the line bends. Then group by usage type within that service. In two clicks you know what spiked and when. The cause is almost always one of six things, and you can check all six in about 20 minutes.

Do this before touching anything else. Teams that start deleting resources before they have the daily service-level picture routinely kill the wrong thing and leave the actual cause running.

The single most common cause of a sudden bill jump is a resource someone spun up for a test and never terminated. An oversized EC2 instance, a load-testing cluster, a GPU box for an experiment. It runs 24/7 whether used or not.

Second is storage that accumulates silently: EBS snapshots on a backup policy nobody reviews, CloudWatch log groups with no retention policy, and S3 buckets collecting versioned objects. These grow every day, so the bill climbs a little more each month until someone notices.

Data transfer is the classic invisible spike. A new integration that pulls data cross-region, a misconfigured CDN origin, or a chatty service talking to a database in another availability zone. None of it shows up as a new resource, only as a bigger transfer meter.

NAT gateway deserves its own check because it double-bills: an hourly rate plus a per-GB processing charge. A workload that starts routing large volumes through a NAT gateway can add thousands a month while every dashboard shows the same instance count.

If the spike lands exactly on a month or year boundary, check whether a Savings Plan or Reserved Instance expired. Workloads silently fall back to on-demand rates, which is an instant 30 to 60 percent jump with zero change in usage.

Last is genuine runaway compute: a Lambda function retrying in a loop, a recursive trigger, an autoscaling group whose scale-in policy broke. These are the rarest cause but the fastest growing, so if the daily line is still climbing today, start here instead.

Cost Explorer is an aggregation layer, and I have seen it disagree with the raw Cost and Usage Report in both directions. Before you report a number to anyone, cross-check the CUR. That habit has saved me from presenting wrong figures more than once.

Prevention is boring and cheap: ownership tags enforced on compute and storage, budgets with alerts at 80 and 100 percent, anomaly detection turned on, and log retention set everywhere. A bill that cannot surprise you is the goal.