Field notes
AWS cost fix guides
Nine times out of ten a surprise AWS bill is not a traffic spike or a bug. It is a handful of resources that bill per hour whether or not anything uses them, sitting in states the console describes as healthy. Each note here takes one, gives the actual monthly figure, and hands you a script that finds every instance of it in your account.
A cost dashboard tells you a number went up. These notes tell you which resource, why it charges when idle, what it costs, and how to remove it without breaking something. Every script reports first and needs an explicit resource id plus --apply before it deletes anything — these operations are irreversible, which is not true of anything in /email/.
Cost and zombie resources
An idle NAT Gateway still costs about $32 a month
A NAT Gateway bills per hour whether or not a single byte crosses it. One left behind after a VPC redesign is about $32 a month for nothing.
Public IPv4 is charged even when it is attached
Most advice says an Elastic IP only costs money when unattached. Since February 2024 every public IPv4 address is charged hourly, attached or not.
Unattached EBS volumes bill exactly like attached ones
Terminating an instance does not delete every volume it used. Whatever survives keeps billing at the full rate, and nothing on the console flags it.
Orphaned EBS snapshots outlive the volumes they came from
Deleting a volume does not delete its snapshots. They keep billing at $0.05 per GB-month, and nothing in AWS prunes them for you.
CloudWatch log groups keep everything forever by default
A new log group has no retention policy, so logs are kept indefinitely. Ingestion is $0.50 per GB and storage keeps accruing on data nobody will read.
Untagged resources make cost attribution impossible
Cost Explorer can only group by tags you activated in the billing console. Untagged resources land in a bucket nobody can attribute to a team or a customer.
These are the ones I keep hitting. If yours is broken in a way none of them describes, tell me on LinkedIn — it is usually how the next note gets written.