All writing

· 1 min read

The five AWS line items behind every surprise bill

NAT gateways, cross-AZ traffic, forgotten resources, CloudWatch logs and egress: where surprise AWS bills come from, and the 20 minutes of setup that catches them.

A bill listing NAT Gateway processing at $0.045/GB, cross-AZ transfer at $0.01/GB twice, forgotten ALBs at $18/mo each, CloudWatch Logs at $0.50/GB and internet egress at about $0.09/GB. The total reads $2,657, with the expected $23 crossed out.

“My $23/mo side project just billed me $2,657.” That post gets written every single week, and it’s almost always the same five line items.

  1. NAT Gateway data processing: $0.045/GB both directions. Your private subnets pulling container images through NAT can quietly add $50–400/mo. Fix: free S3 gateway endpoint + ECR interface endpoints.
  2. Cross-AZ transfer: $0.01/GB each direction, billed on both sides. Chatty services across zones = paying twice for your own internal traffic.
  3. The graveyard: forgotten ALBs ($18/mo each), unattached EIPs, orphaned EBS volumes, four years of snapshots. I’ve audited accounts where this was a third of the bill.
  4. CloudWatch Logs ingestion: $0.50/GB. One debug flag left on in prod can be $300/mo of logs nobody reads.
  5. Egress to the internet: ~$0.09/GB. A scraped public bucket is the actual mechanism behind most overnight horror stories. CloudFront + Origin Access Control fixes it.

The prevention takes 20 minutes: Budgets with 50/80/100% alerts, Cost Anomaly Detection, cost allocation tags from day one, and a weekly Cost Explorer look grouped by usage type.

The bill is observable. Most teams just never wire up the observability.

Which line item has bitten you the hardest?

Written by Abdullah Abdelrazek. Questions, or found something similar?

Reply by email