DEV Community

Cover image for Stop Recurring AWS Bills
Brian
Brian

Posted on • Updated on

Stop Recurring AWS Bills

#aws #sre #devops #s3

Across AWS Social Media the number of users that are stuck with recurring monthly bills is much higher than I thought it would be:




For those who find themselves in this trap, here are some basic steps you can take to finally stop these recurring bills or find what is driving your cost spike.

Reminder: ALWAYS Set up MFA

Take a few minutes, go to r/aws, and look at the posts over the past week. I bet at least one post sounds like this: "help, I've been hacked, and someone spent thousands of dollars on my account!!". Here's one if you aren't able to find any on your own.

The first question is: "Have you set up MFA on your account?"
The answer is ALWAYS: "No."

Don't be one of the people begging AWS to refund $5K in usage because you didn't set up MFA! What if AWS stops canceling bills from 'hackers' if you don't have MFA? You don't want to be stuck holding someone else's bar tab. Setting up MFA will take ~5 minutes and could save you thousands of dollars or a major headache.

Create a Cost and Usage Report

The first step to fixing a cost problem is figuring out what is driving your cost problem. To do this, you need visibility into what is running in your environment. The Cost and Usage Report is the best resource for AWS users to get visibility into what is running in their accounts.

The Cost and Usage Report (CUR) is the most detailed billing report Amazon has to offer. You can see a line item for every resource, for every hour during a month, with over 100 fields that describe the resources, resource operations, and pricing structure. The CUR contains the same data that drives visualization in Cost Explorer (we all know it isn't a good idea to rely on Cost Explorer.

In my GitHub project, the Developer's Guide to AWS Costs, I created a guide for creating and analyzing your Cost and Usage Report. There is no cost to create a CUR. The only fee you will incur is for s3 storage. This cost will scale with the size of your business: for an individual account or startup, this will be ~$1 per month. This cost would still be less than $~25 per month for large enterprise AWS customers.

To be clear, For an individual user looking to get rid of their lingering AWS costs, this report running for a single day would be less than $0.01 in storage costs. Pay $0.01 for getting rid of a $5 recurring monthly bill? Yes, please!

How to Find the Resources

With the cost and usage report active, here are two straightforward SQL queries to investigate which resources are driving your costs.

First, this query is a high-level summary of the costs for a particular account by AWS Service. Use this query as a high-level view to figure out which AWS Services need to be investigated further.

SELECT
    [lineItem/UsageAccountID],
    [lineItem/ProductCode],
    sum([lineItem/UnblendedCost])
FROM cur;
GROUP BY
    [lineItem/UsageAccountID],
    [lineItem/ProductCode]
ORDER BY
    sum([lineItem/UnblendedCost]);
Enter fullscreen mode Exit fullscreen mode

Now we understand which services are causing our cost issue. Next, we can add the [lineItem/ResourceID] field to see a list of all the resources that are still running. For this example, we are filtering for all EC2 Resources.

SELECT
    [lineItem/ResourceID]
    sum([lineItem/UnblendedCost])
FROM cur
WHERE
    [lineItem/ProductCode] is 'AmazonEC2'
GROUP BY
    [lineItem/ResourceID]
ORDER BY
    sum([lineItem/UnblendedCost]);
Enter fullscreen mode Exit fullscreen mode

Some costs in AWS aren't tied to a resource (of course), so if that last query wasn't able to answer your question, we could replace the [lineItem/ResourceID] field with [lineItem/Operation] and [lineItem/UsageType] to describe the cost categories that are driving cost.

SELECT
    [lineItem/UsageAccountID],
    [lineItem/ProductCode],
    sum([lineItem/UnblendedCost])
FROM cur;
GROUP BY
    [lineItem/UsageAccountID],
    [lineItem/ProductCode]
ORDER BY
    sum([lineItem/UnblendedCost]);
Enter fullscreen mode Exit fullscreen mode

The two queries above aggregate costs for the duration of your report. Adding in the [lineItem/UsageStartDate] field will show costs by hour. This field adds a lot of detail to the report and will help you determine if this is a monthly service charge or a recurring fee for usage.

SELECT
    [lineItem/UsageStartDate],
    [lineItem/UsageAccountID],
    [lineItem/ProductCode],
    sum([lineItem/UnblendedCost])
FROM cur;
GROUP BY
    [lineItem/UsageAccountID],
    [lineItem/ProductCode]
ORDER BY
    sum([lineItem/UnblendedCost]);
Enter fullscreen mode Exit fullscreen mode

The Last Step

Once you figure out and terminate the straggling resources, the last two things you will need to do are:

  1. Delete your Cost and Usage Report
  2. Delete the S3 bucket where your Cost and Usage Report is stored.

Delete the Cost and Usage Report

Search for 'billing' to go to the billing console and click on 'Cost & Usage Reports' on the left banner of your screen. Once on this screen, you will see all the active Cost and Usage Reports in your account. Select the report you created, and click on the 'delete' button (see the screenshot below).

Find and delete your cost and usage report

Delete the S3 bucket.

Search for S3 to go to the S3 console. Once in the S3 console, look for the S3 bucket where your S3 bucket is being saved. Once this bucket is empty, you can select the bucket and click 'Delete'.

Find the S3 bucket where your CUR is stored

Clicking 'delete' will open a new screen where you must type the bucket's name and confirm you want to delete the s3 bucket.

delete your s3 bucket

Billing Freedom

These steps will allow you to see what you're being billed for and have the information you need to stop these recurring AWS bills. If you want a more detailed analysis of your favorite AWS services, check out our project on GitHub. If there are any questions about this process, let me know in the comments below ⬇️.

Content powered by Strake

Top comments (0)

Read next

env0team profile image

OpenTofu: The Open Source Terraform Alternative

env0 Team -

killianmcgrath7 profile image

Stop Leaving Yourself Open to Massive Cloud Bills

Killian McGrath -

vivekpophale profile image

Amazon EMR deployment on EKS

vivekpophale -

nr18 profile image

Compliant infrastructure using infrastructure as code

Joris Conijn -