The bill suddenly jumps

Symptom

Diagnostic scenario: the minitickets-dev-monthly-cost budget reaches its 50% actual-spend threshold early in the month. The threshold is a budget condition, not a recorded incident or an AWS error response.

Read the error first

AWS Budgets reports spending, not a failed request. Reach / Allowed / Password do not explain a cost increase, though an Allowed error while reading billing data means your investigating identity lacks billing access. Separate actual spend, forecast and credits before comparing numbers.

Decide

flowchart TB
  A[Unexpected spending] --> B[Group by service and day]
  B --> C{Usage type increased?}
  C -->|resource hours| D[Compare uptime, size and count]
  C -->|requests or bytes| E[Compare traffic, retries and storage]
  C -->|usage unchanged| F[Check rates, credits and adjustments]
  D --> G[Review safe containment]
  E --> G
  F --> G

Likely causes

For this dev setup, start here, then follow the billed usage:

1. Hourly services dominate: data, compute and entry stayed on. RDS, Valkey, tasks and ALB cost money while idle.
2. Request/transfer usage dominates: traffic, retry loops or downloads increased; investigate their source.
3. Storage dominates: logs, images or issued assets accumulated despite retention rules.
4. Similar usage, different total: rate, credit or billing adjustments changed. The budget excludes credits, so compare like-for-like totals.

How to check

Console

Billing → Cost Explorer → daily costs → group by Service, then Usage type and Region. Compare equal date ranges and estimated versus finalized data. Budgets → minitickets-dev-monthly-cost → thresholds and delivery address. Match usage with ECS counts, RDS size, Logs storage and request metrics.

CLI

Replace account ID with the account being billed; use its configured local profile.

export AWS_PROFILE=ticketlite
aws budgets describe-budget --account-id <account-id> --budget-name minitickets-dev-monthly-cost --query 'Budget.{Limit:BudgetLimit,Spend:CalculatedSpend,Types:CostTypes}'
aws ecs describe-services --cluster minitickets-dev --services minitickets-dev-api minitickets-dev-web --query 'services[].{Name:serviceName,Running:runningCount,Desired:desiredCount}'

CloudTrail

Follow the expensive service: UpdateService, ModifyDBInstance, or creation events can explain new capacity. CloudTrail is a change record, not the invoice; request/data activity may need separate logging. Compare event time with billed usage, allowing for billing delay.

Fix

Contain the measured source: repair a retry loop, review excess capacity or apply the committed switches through CD. Turning data off deletes dev Postgres and Valkey; it is not a pause. Review data loss and dependencies before that choice. See cost switches.

Prevent

The $20 monthly budget warns at 25%, 50%, 100% actual and 100% forecast. It never stops resources. Keep email delivery checked and review costs after changes in infra/src/budget.ts → createBudget.

Say it in 30 seconds

Say it like this (20-30 seconds)

I compare the same dates and cost basis, then group the increase by service and usage type. Resource hours suggest uptime, size or task count; request and transfer charges suggest traffic or retry loops. I use CloudTrail to correlate configuration changes, while treating billing as delayed evidence. For MiniTickets, the budget only warns. I choose containment after checking dependencies and data loss, because switching the data layer off deletes the dev database.

Advanced: Off still has a cost and billing is delayed

The committed config currently enables data, compute and entry, with CloudFront off. infra/index.ts decides which resources exist. Switching the main layers off leaves queues, tables, S3 assets, ECR and the ticket-signing secret. These can still have request, storage or standing charges; “off” is not a promise of a zero invoice.

infra/src/tickets/storage.ts → createTicketStorage keeps issued tickets and their signing key across those switches. The bucket intentionally has no fixed-age deletion of issued ticket PNGs. ECR and log retention bound other growth, but cannot explain every line of an account-wide bill. Check other projects and regions too.

Budgets uses billing data updated at least daily, so alerts do not cap instantaneous spend. AWS documents its refresh cadence. Do not infer a fresh incident from a delayed budget email alone.