The 10-minute AWS bill check: 5 lines

Why five lines are enough

Most AWS bills for small teams are not big because of one bad decision. They grow a little every month from things nobody switched off: a database from a test, snapshots from a migration two years ago, logs that are kept forever by default. None of it breaks anything, so nobody looks.

The good news is that most of that quiet waste usually sits in the same five lines. You can check all five in about ten minutes, with read-only access, without changing anything. If a line looks wrong, you write it down and decide later.

Prices below are AWS list prices for US East (N. Virginia) at the time of writing. Your region may differ, so check the pricing pages linked at the bottom.

Before you start: open Cost Explorer

Cost Explorer is the AWS screen that breaks your bill down by service and by type of usage.

Sign in to the AWS console and open Billing and Cost Management, then Cost Explorer.
Set the date range to the last 3 full months and the granularity to Monthly.
Set Group by to Service. This is your overview.
For the deeper checks below, switch Group by to Usage type. A usage type is the line item AWS actually bills, for example USE1-NatGateway-Bytes.

Prefer the command line? This prints last month's cost per usage type (adjust the dates):

aws ce get-cost-and-usage \
  --time-period Start=2026-09-01,End=2026-10-01 \
  --granularity MONTHLY --metrics UnblendedCost \
  --group-by Type=DIMENSION,Key=USAGE_TYPE

Now go line by line.

1. Data transfer: paying to move your own data

What it is. AWS charges when data leaves AWS for the internet, and also when it moves between zones or regions inside AWS. The first 100 GB per month out to the internet is free across your account. After that, it adds up per gigabyte.

Where to find it. In Cost Explorer grouped by Usage type, look for names containing DataTransfer-Out-Bytes (to the internet) and DataTransfer-Regional-Bytes (between availability zones, which are separate data centers in one region).

Good looks like: data transfer is a small share of the bill and moves with your traffic.

Red flags:

Transfer costs grow faster than your user numbers.
Large DataTransfer-Regional-Bytes: your app and database may sit in different zones and talk all day.
Big files (video, images, downloads) served straight from servers or storage instead of through a content delivery network (a CDN, which caches files close to users).

2. NAT gateway: the toll booth most teams forget

What it is. A NAT gateway lets servers in a private network reach the internet. It bills twice: for every hour it exists (about $0.045 per hour, roughly $33 a month each) and for every gigabyte it processes (about $0.045 per GB). Teams often create one per zone and then forget them.

Where to find it. NAT charges hide inside the EC2-Other service. In Cost Explorer, filter Service to EC2-Other, group by Usage type, and look for NatGateway-Hours and NatGateway-Bytes. To list them: VPC console, then NAT gateways, or run:

aws ec2 describe-nat-gateways --query 'NatGateways[].[NatGatewayId,State,VpcId,SubnetId]' --output table

Repeat for each region you use.

Good looks like: one gateway per zone that actually has private servers, and modest bytes.

Red flags:

NAT gateways in a VPC (your private network on AWS) that has no running servers.
High NatGateway-Bytes while your servers mostly talk to S3 or DynamoDB. AWS offers free gateway endpoints for S3 and DynamoDB so that traffic skips the NAT gateway entirely.

3. Idle databases: paying full price for 2% use

What it is. A managed database (Amazon RDS) bills by the hour whether anyone uses it or not, plus storage. Staging, test and "temporary" databases tend to outlive their purpose.

Where to find it. RDS console, then Databases. For each one, open Monitoring and check CPU and database connections over the last two weeks. Or list them:

aws rds describe-db-instances --query 'DBInstances[].[DBInstanceIdentifier,DBInstanceClass,MultiAZ,DBInstanceStatus]' --output table

Good looks like: every database has a name you recognize, an owner, and real connections.

Red flags:

Zero or near-zero connections for weeks.
A test database set to Multi-AZ (a paid standby copy in a second zone, which roughly doubles the cost).
A production database that has averaged under 10% CPU for months, sized for a launch that is long over.
A "stopped" database you think is free. RDS still bills storage and backups while stopped, and it starts itself again after 7 days.

4. Old snapshots and unattached disks

What it is. Snapshots are point-in-time copies of disks or databases. They cost about $0.05 per GB per month (standard tier) and never expire unless something deletes them. Unattached disks (EBS volumes) left behind by deleted servers keep billing at full price.

Where to find it.

EC2 console, then Snapshots (under Elastic Block Store). Sort by Started to see the oldest.
EC2 console, then Volumes. Filter Volume state to Available, which means attached to nothing.
RDS console, then Snapshots, tab Manual. Manual database snapshots are kept until you delete them.

aws ec2 describe-volumes --filters Name=status,Values=available \
  --query 'Volumes[].[VolumeId,Size,CreateTime]' --output table
aws ec2 describe-snapshots --owner-ids self \
  --query 'Snapshots[].[SnapshotId,VolumeSize,StartTime,Description]' --output table

Good looks like: snapshots follow a clear schedule (for example, daily for 14 days) and old ones are removed automatically.

Red flags:

Snapshots older than a year with no description.
Any volume in the Available state.
Hundreds of snapshots created by a script nobody remembers.

Before deleting any snapshot, confirm it is not your only backup of something. A snapshot you cannot restore from is just a cost, but one you need is worth keeping.

5. Logs kept forever

What it is. CloudWatch Logs stores your application and service logs. By default a log group keeps data indefinitely (the setting shows as Never expire). Storage costs about $0.03 per GB per month, and ingesting logs costs about $0.50 per GB, so noisy debug logging can cost more than the server writing it.

Where to find it. CloudWatch console, then Logs, then Log groups. Look at the Retention column and the Stored bytes column. Or list every log group with no retention set:

aws logs describe-log-groups \
  --query 'logGroups[?!retentionInDays].[logGroupName,storedBytes]' --output table

To fix one in the console: click the current value in the Retention column, choose a value under Expire events after, then Save.

Good looks like: every log group has a retention period you chose on purpose (often 14 to 90 days, longer only where a rule requires it).

Red flags:

Most groups say Never expire.
A single group holding hundreds of GB.
DataProcessing-Bytes for CloudWatch growing month over month, a sign of debug logging left on in production.

The printable checklist

After the ten minutes

Add up the red flags. For many small teams the five lines together are a meaningful share of the bill, and most fixes are small. Two things worth doing before you change anything:

Set an AWS Budget (Billing and Cost Management, then Budgets) with an email alert at 80% of your normal monthly spend, so a jump is noticed within days.
Turn on Cost Anomaly Detection in the same console, so unusual spend on one service sends an alert.

Not sure your setup has these gaps at all? The 2-minute check asks twelve questions and gives you one thing to fix today for each gap.

Free AWS bill check

Want us to read your AWS bill?

Read-only access. In 48 hours, every dollar you could stop paying, ranked. You keep the report.

Free AWS bill check

Want a second pair of eyes?

If you would rather have someone go through it with you, the free review reads three months of your bill with view-only access and returns the 3 fixes worth doing first, each in dollars per month. You can do every fix yourself.

Free AWS bill check