Read an AWS Bill in 20 Minutes

Open the AWS Bill Analyzer in another tab. Click Load a sample bill. Everything below comes from that file. It has three months and 21 line items, shaped like a Cost Explorer export from a mid-sized account.

The data is illustrative. It is not a real customer’s bill. The analysis is real. The file runs through the same code that runs when you drop in your own CSV. Every number quoted below is on your screen too. Follow along. Nothing here is restated from memory.

The total is not the useful number

The sample bill totals $184,625 across three months: $57,790, then $59,835, then $67,000. A finance summary would lead with $184,625. It is the least useful number on the page, because the money is already spent.

Direction matters more. The bill grew every month. The tool takes the last month, $67,000, and projects it to a full year: $804,000. It calls this “a simple run-rate, not a forecast model.” That is the right level of confidence. The tool only multiplies the last month by twelve.

This is a better number to open a review with than the three-month total. It shows where the bill goes if nothing changes.

One line is 70.7% of the bill

Scroll to the composition chart. One bar dominates: EC2 Compute, $130,500, which is 70.7% of every dollar in the file. RDS Multi-AZ is next at $9,750. Then come internet egress at $9,300, S3 Standard storage at $7,800, CloudWatch Logs at $5,250, and NAT Gateway at $4,350. All five together do not reach a third of what EC2 costs alone.

This concentration is not a problem by itself. Most stacks have a dominant compute line, because compute does the work. It does change where a review spends its time. A 5% swing in EC2 moves more money than a 50% swing in NAT Gateway.

When one line is this large, understand it instance type by instance type. Do that before you look at the long tail below it.

The one thing to do today

The tool flags 16 things in this file: 1 marked act, 7 marked watch, and 8 marked info. Only the single act finding needs work today. Find it in the “what changed” section. CloudWatch Logs Ingestion was $550 the month before. Last month it was $4,200, up 664%.

A jump like this usually has one findable cause. A feature may have shipped with debug-level logging left on. An alarm may be stuck firing in a loop. A service may log full request bodies and not a sampled fraction.

Ordinary growth rarely explains it. Ordinary growth does not move a number 664% in one month.

The monitoring bill nobody budgets for explains why observability spend drifts away from the infrastructure it watches. The observability cost calculator prices the CloudWatch and Datadog settings, so you know which to check first.

The new line nobody approved

Below the movers sits a line that did not exist the month before: “New Feature Launch - Video Streaming,” $0 to $900. A new charge like this is usually fine. Somebody shipped something, and this is its cost.

But a charge that is “usually fine” still deserves a five-second look. Look before it is ten months old and nobody remembers approving it. Anatomy of a runaway bill collects cited cases where nobody took that look. Cost alerts explain how to get a notice the week a new line appears. Without one, you may find it three quarters later in a review.

The quiet watch list

Under the lines that grab attention, three sit at moderate, steady amounts. NAT Gateway is $4,350. Cross-AZ data transfer is $2,460. gp2 EBS volumes are $2,760. None of them spiked. None of them is new.

That is why people skip them. It is also why they deserve a look. A small cost that never spikes keeps running unnoticed, as long as nobody checks.

The AWS Bill Decoder explains what each of these usage-type codes bills for. What data transfer costs goes deeper. Read it if egress and cross-AZ traffic are a real share of your own bill.

What a three-month CSV cannot tell you

Everything above came from 21 line items and three months of history. That is already more structure than a raw Cost Explorer export gives you. A real review needs more.

EC2 at $130,500 does not say which team provisioned it. When it moves, nobody is there to call. A bill that rises 15% might mean traffic rose 15%, which is a fine result. It might also mean nothing user-facing changed. Without a unit to divide by, you cannot tell which.

A line item with inconsistent tags cannot be split by team or environment later. This stays true no matter how urgently someone asks. Cost allocation and tagging covers the practice. The tag coverage analyzer checks how much of your own bill has tags good enough to attribute.

Run your own file

You needed only a CSV and a browser tab. Export a Cost Explorer report of your own. Drop it into the AWS Bill Analyzer. The file stays in your browser. Nothing uploads anywhere.