Home › Decoder › AWS bill suddenly increased: find what changed

AWS bill suddenly increased: find what changed

A jump has a shape. Either one day it stepped up and stayed up (something was created or changed), or it climbs day by day (something is growing), or it spiked once (a job, an incident or a retry storm). Cost Explorer can tell you which in a few clicks. This is the order that finds the cause fastest.

Prices quoted are US East (N. Virginia) list prices checked 2026-11-04.

See a sample result

The checks, in order

  1. A step on one day

    Fixed charges start the day a resource is created. Daily view, group by Usage type: a line that goes from 0 or low to a flat new level on one date. Common: a new NAT gateway ($0.045 per hour), a load balancer ($0.0225 per hour), new public IPv4 addresses ($0.005 per hour each). Check CloudTrail for the create events on that date.

    Decoder: NatGateway-Hours: the fixed monthly cost of each NAT gateway

  2. A slope that never flattens

    Storage and logs accumulate. A steadily rising S3 TimedStorage-ByteHrs or CloudWatch Logs storage line means data is kept without expiry. Check lifecycle rules and log group retention.

    Decoder: TimedStorage-ByteHrs: the S3 Standard storage line

  3. A per-GB line that jumped with a deploy

    NAT $0.045 per GB; regional $0.01 per GB each way. NatGateway-Bytes or DataTransfer-Regional-Bytes rising on a day you shipped something: a service now pulling data from S3 through the NAT, calling across AZs, or pulling images on every start.

    Decoder: NatGateway-Bytes: the NAT Gateway data-processing line

  4. Logs that exploded

    $0.50 per GB ingested. CloudWatch IncomingBytes per log group by day; a debug flag or a retry loop shows as a vertical jump in one group.

    Decoder: CloudWatch Logs DataProcessing-Bytes: the log ingestion line

  5. Outbound traffic you did not expect

    $0.09 per GB after the first 100 GB. DataTransfer-Out-Bytes by service and day. A public bucket being scraped or a big download link shared widely shows as a spike.

    Decoder: DataTransfer-Out-Bytes: internet egress on your bill

Checklist

  1. Cost Explorer > Last 2 full months side by side > Group by Service > see which service moved.
  2. Same service > Group by Usage type > which line moved and by how much.
  3. Switch to Daily; mark the date of the step or the start of the slope.
  4. CloudTrail event history around that date for create/modify events (RunInstances, CreateNatGateway, CreateLoadBalancer, AllocateAddress, PutBucketVersioning).
  5. Ask the people who deployed that day; match the change to the line.
  6. Set a Budgets alert or an anomaly alert so the next jump reaches you in days instead of at month end.

Let the export show the jump

Upload a Cost Explorer or CUR CSV. Billtrim reads it in your browser, flags the lines that moved, and gives the dollars and the steps to check each one.

See a sample result

Paste your export: how to export a Cost Explorer CSV or CUR file in two minutes.

Questions people ask

Why does the bill only show up at month end?

Cost Explorer data lags by up to about a day, and invoices are monthly; checking the daily view weekly catches steps early.

Could it be a security incident?

Possibly: unexpected compute, regions you do not use, or sudden egress can indicate compromised credentials. If you see resources you do not recognise, rotate credentials and review CloudTrail before anything else.

Can I get a refund for a spike?

You can ask AWS Support to review unexpected charges, with the specifics of what changed. This page cannot promise an outcome.

Related