How do you stop a surprise AWS bill?

Why do surprise AWS bills happen?

Surprise AWS bills happen because AWS charges for whatever is running, not for what you meant to run, and nothing stops the spending by default.

Most spikes come from a short list of causes: a test environment nobody turned off, a NAT gateway or idle database charging by the hour, a loop in code that calls a paid service millions of times, logs kept forever, data transfer that grew with traffic, or leaked access keys used to start expensive instances.

If your bill is high every month rather than spiking once, the cause is usually different. The guide on why an AWS bill is high with almost no users covers the always-on costs that build up quietly.

Can you set a hard spending limit on AWS?

For a normal paid AWS account there is no general setting that stops every charge at a fixed amount, so protection has to come from alerts and automated actions you configure yourself.

AWS Budgets can warn you and run actions, but billing data refreshes at least once a day rather than in real time, so an alert tells you about spending that has already happened.

New customers have one partial exception. Since July 2025, new AWS accounts can start on a free account plan with up to $200 in credits, which ends after 6 months or when the credits run out, whichever comes first, and the customer chooses when to move to a paid plan. A production SaaS will be on a paid plan, so it needs the controls below.

Which AWS billing alerts should a small team set up first?

Set up a monthly AWS Budgets cost budget with alerts on actual and forecast spend, and keep Cost Anomaly Detection switched on.

Those two cover most surprises for a small team, and both are free to run at this scale.

Two details matter. Forecast alerts need about 5 weeks of usage history before they fire, so a brand new account relies on actual-spend alerts at first. And each alert can go to up to 10 email addresses and one Amazon SNS topic, so send them to a shared channel rather than one founder's inbox.

Cost Anomaly Detection has been switched on automatically for accounts that enabled Cost Explorer on or after 27 March 2023. The default monitor emails the account's main address when a service is more than $100 and more than 40% above its expected spend. Check that the email address is one someone reads.

How do AWS budget actions stop spending automatically?

AWS budget actions run when a budget crosses a threshold, either automatically or after you approve them, and can apply an IAM policy, apply a service control policy, or stop specific EC2 or RDS instances.

That makes them the nearest thing to a spending brake that a paid account has.

• Deny new resources: apply an IAM policy or service control policy that blocks launching new EC2 instances or databases once a dev or test account reaches its budget.
• Stop named instances: target specific EC2 or RDS instances, such as a staging database, so they stop when the budget is hit.
• Require approval for production: set actions on production budgets to wait for a person, because stopping a live database is worse than an expensive day.

AWS notes one trap: if an instance belongs to an Auto Scaling group, stopping it makes the group replace it. A stop action only works there if a second action also removes the permissions the group uses to launch instances.

How do you stop leaked keys or runaway code from running up an AWS bill?

Some of the worst surprise bills come from leaked credentials or code that runs out of control, and both are cheaper to prevent than to clean up.

Treat these as part of cost control, not just security.

• Turn on MFA for the root user and every person with console access.
• Avoid long-lived access keys. Use roles, and use GitHub's OpenID Connect integration so CI does not need stored AWS keys.
• Use a service control policy to deny regions you never use, so stolen keys cannot quietly start servers elsewhere.
• Set log retention on CloudWatch log groups instead of keeping logs forever.
• Add lifecycle rules to S3 buckets that collect uploads, exports or backups.
• Put limits on anything that can loop, such as reserved concurrency on Lambda functions and maximum sizes on Auto Scaling groups.

What should you do in the first hour after an AWS bill spike?

In the first hour, find the service and usage type behind the spike in Cost Explorer, stop or shrink the resource causing it, and then work out how it got there.

Do not delete anything you have not identified first.

1. Open Cost Explorer, group by service and set daily granularity to see when the jump started.
2. Group the top service by usage type and by region. An unfamiliar region is a warning sign of leaked keys.
3. Find the resource itself and stop, scale down or restrict it.
4. If you find resources nobody launched, rotate credentials and check CloudTrail before anything else.
5. Open a billing case with AWS Support and explain what happened. Credits are sometimes given for genuine mistakes but are not guaranteed.
6. Add the alert or budget that would have caught it a day earlier.

How much does it cost to protect against a surprise AWS bill?

Protecting against a surprise AWS bill costs almost nothing in AWS fees: budget alerts are free, Cost Anomaly Detection has no additional cost, and your first two action-enabled budgets are free each month.

The real cost is attention, because alerts only help if someone reads them and acts.

That is why a monthly review matters as much as the alerts. The monthly AWS cost review checklist covers what to look at each month, and the guide to Savings Plans and Reserved Instances covers what to do once spending is steady.

Is your AWS account protected against a surprise bill?

Tick each item that is true for your account today.