Cost control in practice

Why cloud bills surprise people

With pay-as-you-go pricing there is no purchase order to sign. Anyone with permission can start a large server in seconds, and it keeps charging until someone stops it. The bill arrives at the end of the month, long after the mistake. Most surprise bills are not from heavy use. They come from things people forgot: a test server, a NAT gateway, a disk left behind after an instance was terminated.

Step 1: see the money

AWS Budgets lets you set a monthly amount and get alerts. Use two kinds: actual (you have already spent 80%) and forecasted (at this rate you will spend more than 100% by month end). The forecast alert is the early warning. Alerts go to email or an SNS topic. Budget actions can even apply a restrictive IAM policy or stop EC2 and RDS instances when a limit is hit. Basic budgets are free; check the pricing page for budgets with actions.

{
  "BudgetName": "monthly-10-usd",
  "BudgetLimit": { "Amount": "10", "Unit": "USD" },
  "TimeUnit": "MONTHLY",
  "BudgetType": "COST"
}

[
  {
    "Notification": {
      "NotificationType": "FORECASTED",
      "ComparisonOperator": "GREATER_THAN",
      "Threshold": 80,
      "ThresholdType": "PERCENTAGE"
    },
    "Subscribers": [{ "SubscriptionType": "EMAIL", "Address": "you@example.com" }]
  }
]

Cost Explorer shows past spending and a forecast as graphs you can group by service, Region, account or tag. Cost Anomaly Detection uses machine learning to spot unusual jumps, such as a service that suddenly costs five times more than usual, and emails you a summary.

Tags: knowing whose cost it is

A tag is a key and value label on a resource, like Project=canteen-app. A good tagging strategy picks a few required tags and uses them everywhere: Project, Environment (dev, test, prod), Owner and CostCentre. In the Billing console you must activate them as cost allocation tags; only then can Cost Explorer and the bill be split by them. Enforce tags with infrastructure as code or tag policies in AWS Organizations, and review untagged resources every week.

Step 2: cut the waste

Scheduling dev servers is the easiest big win. A week has 24 × 7 = 168 hours. Office hours of 10 hours × 5 days are 50 hours. Running only in office hours saves 118 of 168 hours, about 70% of the compute cost. Remember that a stopped instance still pays for its EBS volumes and any public IPv4 address.

Step 3: pay less for what stays

• Savings Plans: commit to a fixed spend per hour for 1 or 3 years. Compute Savings Plans also cover Fargate and Lambda. Discounts can be large (AWS quotes up to about 72% for some plans); check the current figures.
• Reserved Instances: a similar commitment for services like RDS.
• Spot Instances: spare capacity at up to 90% off, but AWS can take it back with a 2-minute warning. Good for batch jobs, CI builds and stateless workers.
• Graviton (Arm) instances and Lambda on Arm: usually a lower price for the same work.

Data transfer and Trusted Advisor

Data coming into AWS is free, but data going out to the internet is charged after a free monthly amount, and traffic between Availability Zones is charged too. A chatty app that sends lots of data across zones, or a website serving big files without a CDN, can cost more in transfer than in servers. AWS Trusted Advisor checks your account for cost savings such as idle load balancers and low-use instances; the full set of checks needs a Business or higher support plan.

A student horror story

A final-year student follows a tutorial to build a VPC with private subnets. The tutorial adds a NAT gateway. After the project demo she terminates the EC2 instances and thinks she is done. The NAT gateway and its Elastic IP keep running. At roughly US$0.045 an hour in us-east-1 (prices differ by Region), that is over US$30 a month before any data, and the free tier does not cover it. Two months later her card has been charged several thousand rupees. Another classic: launching a large GPU instance "just to try" and forgetting it over a weekend.

How to avoid it: create a budget with a forecast alert on day one; build labs with infrastructure as code so one command deletes everything; after every lab, check the Billing console and the VPC, EC2 (volumes, Elastic IPs) and NAT gateway pages in every Region you used; and turn on Cost Anomaly Detection. If it happens anyway, delete the resources and contact AWS Support quickly and honestly.

The FinOps idea

FinOps (cloud financial operations) is a practice where engineers, finance and managers share responsibility for cloud cost. The FinOps Foundation describes it in three repeating phases: inform (everyone can see what they spend), optimise (rightsize, schedule, commit) and operate (make it a routine with owners, reviews and targets). Engineers see cost as a design trade-off, just like speed or reliability.