A sharp jump appears on the invoice and nobody remembers changing anything. Something may have changed, expired, replicated, or kept accumulating. Many sudden AWS cost increases can be narrowed through Cost Explorer or the Cost and Usage Report (CUR). Here are eight places we'd check first and the signals each can leave.
First: find the day the line bent
Before hunting suspects, open Cost Explorer, set granularity to daily, set the range to the last three months, and group by Service. If the increase is a step change, the date it starts narrows the search; if it is a slope, look for accumulating usage or changing unit volume. Once you have the date and the service, regroup by Usage Type. Most of the checks below are one more group-by from there.
1. Resources left behind from a finished project
The migration ended. The proof of concept got approved. The resources stayed. Unattached EBS volumes bill per GB-month whether anything uses them. AWS currently charges for public IPv4 addresses whether attached or idle, with documented exceptions such as addresses brought through BYOIP. Load balancers can continue to incur hourly charges with zero targets. A stopped RDS instance still incurs storage charges, and RDS automatically restarts it after seven days.
- Where to look: Cost Explorer grouped by Usage Type. Volume usage lands under EC2-Other; load balancer hours show up under EC2-ELB; public IPv4 charges appear under Amazon VPC. In the CUR,
line_item_resource_idcan identify a resource when resource IDs are enabled and that service supplies one.
2. Data transfer and NAT processing
A NAT Gateway adds hourly and data-processing charges for traffic routed through it. A workload that pulls S3 objects — including ECR image layers — through a NAT Gateway instead of an S3 gateway endpoint can turn a networking path into a material line item. Some cross-AZ paths also charge for data transfer; pricing varies by service and region, so verify the applicable AWS data-transfer terms.
- Where to look: group by Usage Type under EC2-Other and search for
NatGateway-Bytesand anything containingDataTransfer. If NAT bytes dominate, existing VPC Flow Logs can help identify the ENIs and traffic paths involved.
3. Snapshot and log accumulation
Storage that grows forever doesn't spike — it compounds until someone notices. EBS snapshots without a lifecycle or deletion process can keep accumulating storage charges. CloudWatch Logs retains log events indefinitely by default unless a retention period is set; ingestion may be a larger line item than storage.
- Where to look: usage types containing
SnapshotUsage(EBS) andTimedStorage-ByteHrs(CloudWatch and S3). In the CloudWatch console, sort log groups by stored bytes and check retention settings — "Never expire" on a high-volume debug group is worth investigating.
4. Commitment coverage expired
The workload didn't change at all. The one-year Savings Plan or Reserved Instances did — they lapsed, and the same usage started billing at on-demand rates. This is one possible "usage flat, cost up" pattern.
- Where to look: Cost Explorer's Savings Plans and Reservations coverage reports. A coverage percentage that falls off a cliff on the spike date is the answer. Check the inventory pages for expiration dates before the next one lands.
5. Someone raised the autoscaling floor
During an incident, minimum capacity gets bumped from 2 to 8. The incident ends; the minimum doesn't. Scheduled scaling set for a launch stays at launch levels. ECS desired counts creep up. The result is a permanent step up in running hours.
- Where to look: Cost Explorer grouped by Instance Type at daily granularity — running hours step up on a specific day. Then search CloudTrail for
UpdateAutoScalingGroupand ECSUpdateServiceevents around that date to find who and why.
6. New-region duplication
A DR test, S3 Cross-Region Replication, DynamoDB global tables, or copied AMIs put a second copy of your data in another region. That can add storage and inter-region data-transfer charges; the exact mechanics depend on the service and replication pattern.
- Where to look: group by Region. A region that billed near zero last quarter and real money this quarter is the tell. Then group that region by Service to see whether it's storage, replication traffic, or full compute duplication.
7. GPU and AI experiments left running
GPU instances from the p or g families can be materially more expensive than general-purpose instances. SageMaker real-time endpoints can incur instance-hour charges while deployed even with no invocations. Bedrock provisioned throughput uses time-based commitment pricing; verify the current service and region terms.
- Where to look: group by Service and check SageMaker and Bedrock directly; group by Instance Type and scan for g- and p-family names. Anything GPU-shaped that runs nights and weekends deserves a hard question.
8. Storage class drift
Data that was supposed to move to Infrequent Access or Glacier is sitting in S3 Standard because the lifecycle rule was never applied — or filters on a prefix that no longer matches. Versioned buckets keep noncurrent versions billable according to their storage class until a lifecycle rule expires them. Incomplete multipart uploads can continue holding billable storage until a cleanup rule aborts them.
- Where to look: Cost Explorer usage types show
TimedStoragebroken out by storage class — watch the Standard line versus the rest. S3 Storage Lens shows per-bucket growth, noncurrent version bytes, and incomplete multipart bytes without writing a single query.
The pattern
Most suspects above can be narrowed with the same three moves: daily granularity to find the date, group by Service to find the neighborhood, and group by Usage Type to find the mechanism. When Cost Explorer runs out of resolution, CUR resource IDs can add detail when that feature is enabled and the line item carries one. The initial analysis can use billing and inventory data under read-only access; any remediation is separately scoped and client-approved.
If the spike is on this month's bill and you want it traced to specific resources, book the Free AWS Assessment to trace the likely cause and decide whether the remediation belongs in Consulting, Support and Advisory, or your own backlog.