Keel

How do you work out which service is driving your AWS bill?

By the Keel team · Last checked · 4 min read

Short answer

Open AWS Cost Explorer, group costs by service over the last few months, and pick the service that grew most. Then group that service by usage type and region to see exactly what is being charged, and use cost allocation tags to tie it to an environment or feature.

  • Up to 24 hours

    For new tag keys to appear for activation, then up to 24 hours more to activate

    Source: AWS Billing docs, Oct 2026

  • 12 months

    How far back a cost allocation tag backfill can go

    Source: AWS Billing docs, Oct 2026

Where do you see which service is driving your AWS bill?

You see which service is driving your AWS bill in AWS Cost Explorer, by grouping costs by Service over a monthly or daily view.

The Bills page shows the same totals per service, but Cost Explorer lets you compare months and drill down, which is what finding a cause needs.

  1. Open Cost Explorer in the Billing and Cost Management console.
  2. Set the date range to the last three to six months, monthly granularity.
  3. Group by Service.
  4. Note the two or three services that cost the most and the one that grew fastest. They are often different.

How do you drill down from an AWS service to the exact charge?

To drill down from a service to the exact charge, filter Cost Explorer to that service and group by Usage type.

Usage types name the actual meter being charged, such as instance hours, storage, data transfer or NAT gateway hours, so they turn a vague service total into a specific cause.

Common usage types behind a growing AWS bill
Service in Cost ExplorerUsage type to look forUsual cause
EC2-OtherNatGateway-Hours, NatGateway-BytesNAT gateways running in every zone, or heavy traffic through them
Amazon Virtual Private CloudPublicIPv4 in-use or idle addressPublic IPv4 addresses, charged hourly
EC2-OtherEBS volume and snapshot usageOld volumes and snapshots nobody deleted
Amazon RDSInstance usage and storageOversized instances, Multi-AZ on non-production
Several servicesData transfer out or between regionsTraffic leaving AWS, or chatty cross-zone services
CloudWatchLog ingestion and storageVerbose logging and no retention period

Then group the same filter by Region and by Linked account. An unexpected region is worth checking for resources nobody meant to create.

How do cost allocation tags help find what is driving an AWS bill?

Cost allocation tags let you split the bill by your own labels, such as environment, service or team, so you can see that staging costs as much as production or that one feature owns most of the database spend.

They only work once the tags are on your resources and activated in the billing console.

  • Pick two or three keys and use them everywhere, for example environment, service and owner.
  • Apply them through your infrastructure as code, so new resources are tagged automatically.
  • Activate the keys under Cost allocation tags in the Billing console. AWS says new keys can take up to 24 hours to appear there and up to another 24 hours to activate.
  • From the management account, you can request a backfill of up to twelve months, but only for periods when the tag was already on the resource.

Why is EC2-Other often the biggest line on an AWS bill?

EC2-Other is often a big line because it groups charges that are not EC2 instance hours, including NAT gateways, EBS volumes and snapshots, and some data transfer.

Teams look at their small instance count and assume compute is cheap, while EC2-Other quietly grows.

Grouping EC2-Other by usage type almost always shows the cause in one step. The guide on why an AWS bill is high with almost no users covers the most common always-on charges in detail.

What should you do once you know which service is driving your AWS bill?

Once you know which service is driving your AWS bill, decide whether the cost is waste, growth or a sign of a design choice, because each needs a different fix.

Waste gets removed, growth gets planned for, and design choices get reviewed with whoever owns that part of the system.

  • Waste: idle instances, unattached volumes, old snapshots and unused IP addresses. Remove them, through infrastructure as code where possible.
  • Growth: costs rising in line with customers. Check whether steady usage is ready for a commitment, as in Savings Plans or Reserved Instances.
  • Design: NAT gateway traffic, cross-zone chatter or verbose logs. These need a change to how the system is built, so plan them like any other piece of engineering work.

How do you keep track of what drives your AWS bill each month?

Keep track by reviewing the bill by service and usage type every month, with tags in place, and by letting anomaly alerts catch sudden jumps between reviews.

A short monthly habit beats a long investigation once the bill has doubled.

The monthly AWS cost review checklist gives the full routine, and how to stop a surprise AWS bill covers the alerts that work between reviews.

Can you explain your AWS bill today?

Tick each item you could do right now.

  • Name the three services that cost the most last month.
  • Name the usage type behind your biggest service.
  • Split the bill between production and everything else.
  • Say why last month was higher or lower than the month before.
  • Point to an anomaly alert or budget that would catch a sudden jump.

Decision point: Four or five ticks: your bill is under control. Two or fewer: spend an hour in Cost Explorer this week using the steps above.

Sources

  1. AWS docs, Analyzing your costs with AWS Cost Explorer (checked October 2026)
  2. AWS docs, Activating user-defined cost allocation tags (checked October 2026)
  3. AWS docs, Backfill cost allocation tags (checked October 2026)
  4. AWS, Amazon VPC pricing (NAT gateway) (checked October 2026)
  5. AWS News Blog, New charge for public IPv4 addresses (July 2023)
  6. AWS docs, Detecting unusual spend with AWS Cost Anomaly Detection (checked October 2026)

Keep reading

Keel is an AWS release and recovery operations service for SaaS teams of 3 to 15 developers, provided by Bargainn Services Ltd, a UK company registered at Companies House (16497746). Registered office: 3rd Floor, 86-90 Paul Street, London, EC2A 4NE, United Kingdom.