Read an AWS Bill in 20 Minutes

Open the AWS Bill Analyzer in another tab and click Load a sample bill. Everything below is that file: three months and 21 line items, shaped like a mid-sized account’s Cost Explorer export. It’s illustrative data, not a real customer’s bill. The analysis is real, though: the file runs through exactly the same code that runs when you drop in your own CSV, so every number quoted below is on your screen too. Follow along; nothing here is restated from memory.

The number that isn’t the interesting number

The sample bill totals $184,625 across three months: $57,790, then $59,835, then $67,000. That $184,625 is the number a finance summary would lead with, and it’s the least useful one on the page, because it’s already spent. What matters is the direction. The bill grew every month, and the tool projects the last month, $67,000, out to a full year: $804,000. It calls that “a simple run-rate, not a forecast model,” which is the right amount of confidence to put in it: all it does is multiply June by twelve. That’s a more useful number to open a review with than the three-month total, because it points at where this is headed if nothing changes.

One line is 70.7% of the bill

Scroll to the composition chart and one bar dominates: EC2 Compute, $130,500, 70.7% of every dollar in the file. RDS Multi-AZ comes next at $9,750, then internet egress at $9,300, S3 Standard storage at $7,800, CloudWatch Logs at $5,250, and NAT Gateway at $4,350. Add all five of those together and they still don’t reach a third of what EC2 costs on its own.

That concentration isn’t a problem by itself. A dominant compute line is normal for most stacks, since compute is usually the thing doing the actual work. What it changes is where a review spends its time: a 5% swing in EC2 moves more money than a 50% swing in NAT Gateway. When one line is this large, it’s the line worth understanding instance type by instance type, ahead of the long tail sitting underneath it.

The one thing to do today

The tool flags 16 things in this file: 1 marked act, 7 marked watch, and 8 marked info. Only the single act finding needs anything done today, and it’s easy to spot in the “what changed” section: CloudWatch Logs Ingestion was $550 the month before and $4,200 last month, up 664%.

A jump like that usually traces to one specific, findable cause: a feature that shipped with debug-level logging left on, an alarm stuck firing in a loop, or a service that started logging full request bodies instead of a sampled fraction. It rarely traces to ordinary growth, because ordinary growth doesn’t move a number 664% in a single month. The monitoring bill nobody budgets for goes into why observability spend detaches from the infrastructure it watches this easily, and the observability cost calculator prices out which CloudWatch and Datadog settings are worth checking first.

The new line nobody approved

Below the movers sits a line that wasn’t there the month before at all: “New Feature Launch - Video Streaming,” $0 to $900. A brand-new charge like that is usually fine; somebody shipped something, and this is what it costs. But “usually fine” is exactly the kind of charge that deserves a five-second look before it’s ten months old and nobody remembers approving it. Anatomy of a runaway bill collects real, cited cases where that five-second look never happened, and cost alerts covers how to get notified the week a new line appears instead of finding it three quarters later in a review.

The quiet watch list

Underneath the line items that grab attention, three sit at moderate, steady amounts: NAT Gateway at $4,350, cross-AZ data transfer at $2,460, and gp2 EBS volumes at $2,760. None of them spiked. None of them are new. That’s why they’re easy to skip past, and it’s why they’re worth a look anyway: a small cost that never spikes is the kind that just keeps running, unnoticed, for as long as nobody checks. The AWS Bill Decoder explains what each of these usage-type codes actually bills for, and what data transfer actually costs is the deeper read if egress and cross-AZ traffic make up a real share of your own bill.

What a three-month CSV can’t tell you

Everything above came from 21 line items and three months of history, already more structure than a raw Cost Explorer export gives you on its own. A real review still needs more than that. EC2 at $130,500 doesn’t say which team provisioned it, so there’s no owner to call when it moves. A bill up 15% could mean traffic is up 15% too, a fine outcome, or it could mean nothing user-facing changed at all; without a unit to divide by, there’s no way to tell which. And a line item that isn’t tagged consistently can’t be split by team or environment later, no matter how urgently someone asks. Cost allocation and tagging covers the practice, and the tag coverage analyzer checks how much of your own bill is tagged well enough to attribute.

Run your own file

None of this needed anything beyond a CSV and a browser tab. Export a Cost Explorer report of your own and drop it into the AWS Bill Analyzer; it stays exactly where you dropped it, in the browser, never uploaded anywhere.