Billing Surprises: Find What Is Costing Money

Sign in and add the Cost Explorer helper:

cd C:\aws-lab
aws login --profile saat-admin
$env:AWS_PROFILE = 'saat-admin'
$v = Get-Content C:\aws-lab\saat-vpc.json | ConvertFrom-Json
$end = (Get-Date).ToString('yyyy-MM-dd'); $start = (Get-Date).AddDays(-30).ToString('yyyy-MM-dd')
function Get-CostBy([string]$Key, [string]$FilterFile) {
  $extra = if ($FilterFile) { @('--filter', "file://$FilterFile") } else { @() }
  $r = aws ce get-cost-and-usage --time-period "Start=$start,End=$end" --granularity MONTHLY --metrics UnblendedCost --group-by "Type=DIMENSION,Key=$Key" @extra --output json | ConvertFrom-Json
  $r.ResultsByTime | ForEach-Object { $_.Groups } | Group-Object { $_.Keys[0] } | ForEach-Object { [pscustomobject]@{ Name = $_.Name; USD = [math]::Round(($_.Group | ForEach-Object { [double]$_.Metrics.UnblendedCost.Amount } | Measure-Object -Sum).Sum, 2) } } | Sort-Object USD -Descending | Select-Object -First 5 | Format-Table -AutoSize
}

1See where the money went

Paste this whole block. It shows the top services and Regions for the last 30 days:

Get-CostBy SERVICE
Get-CostBy REGION

You should see something like this:

Name                                    USD
----                                    ---
Amazon Relational Database Service     4.82
EC2 - Other                            3.16
Amazon Elastic Compute Cloud - Compute 2.40
Amazon Virtual Private Cloud           1.12
AWS Key Management Service             0.61

Name           USD
----           ---
ap-south-1   11.48
global        0.49
ap-southeast-1 0.21

Your numbers depend on how many labs you’ve run. The SQL Server lessons put RDS near the top; “EC2 – Other” is the one people don’t understand, so look inside it next.

2Look inside “EC2 – Other”

Paste this whole block:

'{ "Dimensions": { "Key": "SERVICE", "Values": ["EC2 - Other"] } }' | Set-Content ec2-other.json
Get-CostBy USAGE_TYPE ec2-other.json

You should see something like this:

Name                             USD
----                             ---
APS3-EBS:VolumeUsage.gp3        1.02
APS3-NatGateway-Hours           0.94
APS3-PublicIPv4:InUseAddress    0.53
APS3-EBS:SnapshotUsage          0.33
APS3-PublicIPv4:IdleAddress     0.21

Now the charges have names: gp3 volumes, NAT gateway hours (Lesson 9), public IPv4 addresses in use and idle, and snapshots. “Idle address” means an Elastic IP attached to nothing, which is pure waste.

3Turn on Cost Anomaly Detection

Paste this whole block, using your own email address. It reuses an existing services monitor if AWS already created one:

$email = 'you@example.com'
$mon = aws ce get-anomaly-monitors --query "AnomalyMonitors[?MonitorDimension=='SERVICE'].MonitorArn | [0]" --output text
if (-not $mon -or $mon -eq 'None') {
  '{ "MonitorName": "saat-service-monitor", "MonitorType": "DIMENSIONAL", "MonitorDimension": "SERVICE" }' | Set-Content monitor.json
  $mon = aws ce create-anomaly-monitor --anomaly-monitor file://monitor.json --query MonitorArn --output text
}
@{ SubscriptionName = 'saat-daily-anomalies'; MonitorArnList = @($mon); Subscribers = @(@{ Type = 'EMAIL'; Address = $email }); Frequency = 'DAILY'; ThresholdExpression = @{ Dimensions = @{ Key = 'ANOMALY_TOTAL_IMPACT_ABSOLUTE'; MatchOptions = @('GREATER_THAN_OR_EQUAL'); Values = @('5') } } } | ConvertTo-Json -Depth 6 | Set-Content sub.json
aws ce create-anomaly-subscription --anomaly-subscription file://sub.json --query SubscriptionArn --output text

You should see something like this:

arn:aws:ce::111122223333:anomalysubscription/1a2b3c4d-5e6f-7a8b-9c0d-e1f2a3b4c5d6

From now on, if any service’s spending jumps by USD 5 or more beyond what’s normal for you, a daily email says which one. It stays on after this lesson.

4Sweep every Region for things that cost money

Paste this whole block. Find-Spenders.ps1 stays in C:\aws-lab; a full sweep takes a minute or two:

$fs = @'
param([string[]]$Regions)
if (-not $Regions) { $Regions = (aws ec2 describe-regions --query "Regions[].RegionName" --output text) -split '\s+' | Where-Object { $_ } }
$found = 0
foreach ($r in $Regions) {
  $checks = @(
    @('NAT gateway', (aws ec2 describe-nat-gateways --region $r --filter Name=state,Values=pending,available --query "NatGateways[].NatGatewayId" --output text)),
    @('Unused Elastic IP', (aws ec2 describe-addresses --region $r --query "Addresses[?AssociationId==null].PublicIp" --output text)),
    @('Unattached volume', (aws ec2 describe-volumes --region $r --filters Name=status,Values=available --query "Volumes[].[VolumeId,Size]" --output text)),
    @('Running instance', (aws ec2 describe-instances --region $r --filters Name=instance-state-name,Values=running --query "Reservations[].Instances[].[InstanceId,InstanceType]" --output text)),
    @('RDS instance', (aws rds describe-db-instances --region $r --query "DBInstances[].[DBInstanceIdentifier,DBInstanceStatus]" --output text)),
    @('Load balancer', (aws elbv2 describe-load-balancers --region $r --query "LoadBalancers[].LoadBalancerName" --output text)))
  foreach ($c in $checks) {
    foreach ($line in (($c[1] | Out-String) -split '\r?\n')) {
      if ($line.Trim() -and $line.Trim() -ne 'None') { '{0,-15} {1,-18} {2}' -f $r, $c[0], ($line -replace '\s+', ' ').Trim(); $found++ }
    }
  }
}
if ($found -eq 0) { "Nothing running or left behind in $($Regions.Count) Regions." }
'@
$fs | Set-Content C:\aws-lab\Find-Spenders.ps1
.\Find-Spenders.ps1

You should see something like this:

Nothing running or left behind in 17 Regions.

If anything shows up that you didn’t expect, that’s your leak. Running this before you log off each day is the cheapest habit in the cloud.

✅ Checkpoint: You’ve seen your top services, Regions and EC2 – Other usage types, Cost Anomaly Detection has a daily subscription, and Find-Spenders.ps1 swept every enabled Region.