Common AWS billing surprises.

This article walks the repeat offenders we see most often in enterprise AWS estates, the mechanism behind each, and the specific control that stops it recurring. The point is not to memorise a list. It is to move from reacting to last month's invoice to catching the charge in the week it starts.

Why does my AWS data transfer bill keep climbing?

Data transfer is the classic AWS surprise because it is priced per gigabyte, billed after the fact, and almost never modelled at design time. Traffic between Availability Zones, traffic out to the internet, and traffic through a NAT gateway each carry their own rate, and a single chatty service can move terabytes a month without anyone noticing until the bill lands.

The fix is visibility before it is architecture. The Cost and Usage Report breaks transfer down by usage type, so you can see whether the cost is cross zone chatter, internet egress, or NAT processing. Once you can see it, the levers are concrete: collapse cross zone traffic where latency allows, replace NAT gateway paths to AWS services with gateway VPC endpoints, and put a CloudFront layer in front of high volume egress.

Why is a NAT gateway one of the quietest budget eaters?

A NAT gateway charges both an hourly rate and a per gigabyte processing rate on everything that passes through it. The hourly cost is small and predictable. The processing cost is the surprise, because every private subnet that reaches an AWS service through the NAT gateway pays the per gigabyte rate on traffic that a free gateway endpoint would carry at no processing charge.

Why am I paying for commitments I am not using?

Savings Plans and Reserved Instances discount compute in exchange for a commitment you carry whether or not you use it. The surprise appears two ways. Underused coverage means you bought more commitment than your workload consumes, so you pay for idle capacity. Mismatched coverage means a Reserved Instance is pinned to an instance family the team has already migrated away from, so on demand usage runs uncovered alongside a commitment that covers nothing.

Both are avoidable with monitoring. Track commitment utilisation and coverage as standing metrics, size new commitments to a defensible forecast rather than to peak usage, and prefer the flexibility of Savings Plans where the workload mix is still moving. We cover the discipline in depth in the AWS cost optimization guide.

Where does storage quietly accumulate?

Storage surprises are slow. An EBS volume detached when an instance is terminated keeps billing at the full provisioned rate. A snapshot schedule with no retention policy compounds month after month. An S3 bucket with no lifecycle rule keeps every object in the standard tier forever. None of these trigger an alert because nothing is broken. The meter simply runs.

The control is policy, not vigilance. Apply lifecycle rules that move cold S3 data to infrequent access and then to Glacier tiers, set snapshot retention so old copies expire, and run a monthly sweep for unattached volumes. A gp2 to gp3 migration on attached volumes is a standing win on top, often cutting the per gigabyte rate while raising baseline performance.

The repeat offenders at a glance

Every row maps to a usage type you can find in the Cost and Usage Report and an alert you can set today. The cadence that keeps the list from growing back is a monthly spend review, which we describe in the AWS spend review cadence.

Stop the surprises before the next invoice

We read your Cost and Usage Report, find the charges hiding in plain sight, and put the alerts and policies in place that keep them from recurring across AWS, Azure, GCP, and OCI. Our guarantee: we reduce your cloud spend or we reimburse our service fee.