A higher cloud bill rarely comes from one big mistake. It is usually several small things that each looked harmless: a test server nobody switched off, a backup rule that keeps everything, a discount that quietly expired. The good news is that the same few causes come up again and again.

Before you start, open the cost tool for your cloud (AWS Cost Explorer, Azure Cost Management or Google Cloud Billing reports) and compare this month with last month, grouped by service. The service that grew most tells you which suspects to check first.

1. Credits or the free tier ran out

Startup credits, migration funding and free-tier allowances hide the real cost of what you run. When they end, the bill can jump overnight even though nothing changed. Check: the credits page in your billing console, and the expiry date of every credit you received.

2. A discount commitment expired

Reserved instances, savings plans and committed use discounts last one or three years. When one ends, the same servers go back to full price. Check: the expiry dates of your commitments, and put renewals in a calendar with three months’ notice.

3. Something was left running

A load test, a demo for a client, a copy of production for one bug. Each was meant to last a day. Check: list everything created in the last 60 days, and anything without an owner tag. Switch non-production off at night and at weekends; a server that runs only in working hours costs about a third as much.

4. Leftovers: unattached disks, old snapshots and unused IP addresses

When a server is deleted, its disks, snapshots and addresses often stay behind and keep billing. On AWS, every public IPv4 address now costs US$0.005 an hour whether or not it is attached to anything, about US$3.60 a month each. Small, but they add up across dozens. Check: unattached volumes, snapshots older than your retention rule, and idle public IPs.

5. Data transfer

Moving data into a cloud is usually free. Moving it out to the internet, between regions, and in some cases between availability zones is not. A new video feature, a partner pulling large files, or a backup copied to another region can each add a line you have never seen before. Check: the data transfer lines in the bill, by region and direction. A content delivery network (CloudFront, Azure Front Door or Cloud CDN) in front of heavy downloads often costs less than serving them straight from your servers.

6. NAT gateways

A NAT gateway lets private servers reach the internet, for example to download updates. On AWS it is charged per hour and per gigabyte processed, US$0.045 for each in the US East region (prices vary by region). If your servers pull large container images or send logs out through it, the per-GB charge can exceed the cost of the servers. Check: NAT gateway data processed, and whether private endpoints to your cloud’s own services would avoid it.

7. Logs and monitoring

Someone turned on debug logging to chase a problem and never turned it off. Log ingestion is charged per gigabyte on all three clouds, and keeping logs forever adds storage on top. Check: which apps send the most log data, the log level in production, and how long each log group is kept.

8. Servers that only grow

Auto-scaling that adds servers at busy times but never removes them, or a database moved to a bigger size during a crisis and left there. Check: the CPU and memory use of your biggest servers and databases over the last month. If they rarely go above 30 to 40%, they are probably too big.

9. Storage and backups that keep everything

Storage is cheap per gigabyte, which is why nobody watches it. Backups with no expiry, old versions of files kept forever, and data that is never read sitting in the most expensive storage class all grow every month. Check: backup retention rules, lifecycle rules that move old data to cheaper classes, and the largest storage buckets.

Stop the next surprise

• Budgets with alerts on every account or subscription, at 50%, 80% and 100% of the monthly plan.
• Anomaly alerts. AWS Cost Anomaly Detection, Azure’s cost anomaly alerts and Google Cloud’s anomaly detection flag unusual spend within a day or so, instead of at month end.
• Tags or labels for owner, app and environment on everything, so every cost has a name next to it.
• A monthly 30-minute review of the top ten cost lines with whoever owns them.

A 30-minute check you can run today

1. Compare this month with last month by service. Note the top three increases.
2. Check credit and commitment expiry dates.
3. List resources with no owner tag, and anything created in the last 60 days.
4. Delete unattached disks and idle IPs you are sure are unused (snapshot first if in doubt).
5. Look at data transfer, NAT and log lines for anything new.
6. Set a budget alert if you don’t have one.

When to get help

If the bill has grown three months in a row, nobody can say who owns the biggest cost lines, or credits are about to run out, it is worth a second pair of eyes. A fresh look usually finds savings in the first hour, because the people closest to a system are the ones who stopped seeing what it costs.

Where DevOps TechLab fits

Finding out why the bill went up is the first thing we do in a cost review. We look at your AWS, Azure or Google Cloud bill with you, name the three biggest leaks in writing, and fix the ones you want fixed. Most clients start with a 20-minute call and a read-only look at their billing.