Across AWS Social Media the number of users that are stuck with recurring monthly bills is much higher than I thought it would be:

Andras Szabo 🇭🇺🇩🇪

@nomoreconfig

AWS sends me a bill of 0.95 $ every month. But I'm too lazy to figure out why 😂

16:07 PM - 10 Aug 2022

Tanya Reilly

@whereistanya

After several attempts to stop paying AWS 80c every month I spent an hour searching the console and finally found the stray service I hadn't deleted. And I was *sure* I had it this time until... I just got an AWS bill for 23c. This thing is the goddamn Hotel California.

16:32 PM - 03 Jan 2019

Jonathan Kozolchyk

@seakoz

My personal AWS bill is $0.13 every month. I put some stuff in S3 a long time ago and don't remember what. Wedding photos maybe? It's going to have to get a lot more expensive before I go looking.

21:43 PM - 04 Mar 2021

isai.btc

@isaibcortez

I got random AWS messages on Saturday didn’t think anything of it. All of a sudden I got hit with a $9k and $2k AWS elastic compute bill for Friday / Saturday, but my devs didn’t work those days. @AWSSupport please help 😖😖😖 my average is $450 per month 😭😭😭

23:13 PM - 08 Aug 2022

For those who find themselves in this trap, here are some basic steps you can take to finally stop these recurring bills or find what is driving your cost spike.

Reminder: ALWAYS Set up MFA

Take a few minutes, go to r/aws, and look at the posts over the past week. I bet at least one post sounds like this: "help, I've been hacked, and someone spent thousands of dollars on my account!!". Here's one if you aren't able to find any on your own.

The first question is: "Have you set up MFA on your account?"
The answer is ALWAYS: "No."

Don't be one of the people begging AWS to refund $5K in usage because you didn't set up MFA! What if AWS stops canceling bills from 'hackers' if you don't have MFA? You don't want to be stuck holding someone else's bar tab. Setting up MFA will take ~5 minutes and could save you thousands of dollars or a major headache.

Create a Cost and Usage Report

The first step to fixing a cost problem is figuring out what is driving your cost problem. To do this, you need visibility into what is running in your environment. The Cost and Usage Report is the best resource for AWS users to get visibility into what is running in their accounts.

The Cost and Usage Report (CUR) is the most detailed billing report Amazon has to offer. You can see a line item for every resource, for every hour during a month, with over 100 fields that describe the resources, resource operations, and pricing structure. The CUR contains the same data that drives visualization in Cost Explorer (we all know it isn't a good idea to rely on Cost Explorer.

In my GitHub project, the Developer's Guide to AWS Costs, I created a guide for creating and analyzing your Cost and Usage Report. There is no cost to create a CUR. The only fee you will incur is for s3 storage. This cost will scale with the size of your business: for an individual account or startup, this will be ~$1 per month. This cost would still be less than $~25 per month for large enterprise AWS customers.

To be clear, For an individual user looking to get rid of their lingering AWS costs, this report running for a single day would be less than $0.01 in storage costs. Pay $0.01 for getting rid of a $5 recurring monthly bill? Yes, please!

How to Find the Resources

With the cost and usage report active, here are two straightforward SQL queries to investigate which resources are driving your costs.

First, this query is a high-level summary of the costs for a particular account by AWS Service. Use this query as a high-level view to figure out which AWS Services need to be investigated further.

SELECT
    [lineItem/UsageAccountID],
    [lineItem/ProductCode],
    sum([lineItem/UnblendedCost])
FROM cur;
GROUP BY
    [lineItem/UsageAccountID],
    [lineItem/ProductCode]
ORDER BY
    sum([lineItem/UnblendedCost]);

Now we understand which services are causing our cost issue. Next, we can add the [lineItem/ResourceID] field to see a list of all the resources that are still running. For this example, we are filtering for all EC2 Resources.

SELECT
    [lineItem/ResourceID]
    sum([lineItem/UnblendedCost])
FROM cur
WHERE
    [lineItem/ProductCode] is 'AmazonEC2'
GROUP BY
    [lineItem/ResourceID]
ORDER BY
    sum([lineItem/UnblendedCost]);

Some costs in AWS aren't tied to a resource (of course), so if that last query wasn't able to answer your question, we could replace the [lineItem/ResourceID] field with [lineItem/Operation] and [lineItem/UsageType] to describe the cost categories that are driving cost.

SELECT
    [lineItem/UsageAccountID],
    [lineItem/ProductCode],
    sum([lineItem/UnblendedCost])
FROM cur;
GROUP BY
    [lineItem/UsageAccountID],
    [lineItem/ProductCode]
ORDER BY
    sum([lineItem/UnblendedCost]);

The two queries above aggregate costs for the duration of your report. Adding in the [lineItem/UsageStartDate] field will show costs by hour. This field adds a lot of detail to the report and will help you determine if this is a monthly service charge or a recurring fee for usage.

SELECT
    [lineItem/UsageStartDate],
    [lineItem/UsageAccountID],
    [lineItem/ProductCode],
    sum([lineItem/UnblendedCost])
FROM cur;
GROUP BY
    [lineItem/UsageAccountID],
    [lineItem/ProductCode]
ORDER BY
    sum([lineItem/UnblendedCost]);

The Last Step

Once you figure out and terminate the straggling resources, the last two things you will need to do are:

1. Delete your Cost and Usage Report
2. Delete the S3 bucket where your Cost and Usage Report is stored.

Delete the Cost and Usage Report

Search for 'billing' to go to the billing console and click on 'Cost & Usage Reports' on the left banner of your screen. Once on this screen, you will see all the active Cost and Usage Reports in your account. Select the report you created, and click on the 'delete' button (see the screenshot below).

Delete the S3 bucket.

Search for S3 to go to the S3 console. Once in the S3 console, look for the S3 bucket where your S3 bucket is being saved. Once this bucket is empty, you can select the bucket and click 'Delete'.

Clicking 'delete' will open a new screen where you must type the bucket's name and confirm you want to delete the s3 bucket.

Billing Freedom

These steps will allow you to see what you're being billed for and have the information you need to stop these recurring AWS bills. If you want a more detailed analysis of your favorite AWS services, check out our project on GitHub. If there are any questions about this process, let me know in the comments below ⬇️.

Content powered by Strake