Why Is My AWS Bill So High? 9 Hidden Charges and 2026 Prices

Most AWS bills I have been asked to look at over fourteen years share a shape: the EC2 instance line is roughly what the team expected, and the total is not. So when someone asks me why is my AWS bill so high, the answer is rarely the servers. It is the meters running beside them: NAT gateways charging per gigabyte, an hourly fee on every public IPv4 address, traffic billed twice as it crosses Availability Zones, volumes attached to nothing, logs kept forever, and control planes on versions nobody upgraded. This post walks through those causes with us-east-1 prices pulled from AWS's public Price List files in October 2026, then covers Savings Plans versus Reserved Instances and what to fix first. The commands live in the companion step-by-step AWS cost reduction checklist.

Why is my AWS bill so high if EC2 looks normal?

Flexera's 2026 State of the Cloud report, a survey of more than 750 cloud decision-makers and users, put self-estimated waste at 29 percent, the first increase in five years. Self-reported, but it matches what I see: waste hides in categories nobody owns.

The console does not help. Cost Explorer files EBS volumes and snapshots, Elastic IPs, data transfer and NAT gateways under one service called EC2-Other, as AWS's Cloud Financial Management blog explains, and public IPv4 charges land under Amazon VPC. A team watching "EC2" sees flat compute and misses that EC2-Other doubled. Read the bill by usage type instead, which names the meter: NatGateway-Bytes, DataTransfer-Regional-Bytes, EBS:SnapshotUsage. In us-east-1 most usage types carry no region prefix; elsewhere they start with a code such as USW2-.

# AWS CLI v2 (syntax per the 2.39 reference). Cost Explorer bills $0.01 per API request.
# Split "EC2 - Other" into usage types for September 2026, biggest first.
aws ce get-cost-and-usage \
  --time-period Start=2026-09-01,End=2026-10-01 \
  --granularity MONTHLY \
  --metrics UnblendedCost \
  --filter '{"Dimensions":{"Key":"SERVICE","Values":["EC2 - Other"]}}' \
  --group-by Type=DIMENSION,Key=USAGE_TYPE \
  --query 'ResultsByTime[0].Groups[].[Keys[0],Metrics.UnblendedCost.Amount]' \
  --output text | sort -t$'\t' -k2 -rn | head -15

# Usage types worth recognising (us-east-1 names, from the AWS Price List):
#   NatGateway-Hours, NatGateway-Bytes     NAT gateway hours and GB processed
#   DataTransfer-Regional-Bytes            cross-AZ traffic, billed on both sides
#   EBS:VolumeUsage.gp2, EBS:SnapshotUsage volumes and snapshots

The Cost Explorer API charges $0.01 per request, so keep it out of tight loops. For line-item detail, a CUR 2.0 export queried with Athena is better, and the guide sets one up.

AWS hidden charges in 2026: the price table

These meters explain most bills that grew while the instance count did not (us-east-1, October 2026, 730 hours a month).

Line item	us-east-1 price (Oct 2026)	One forgotten unit, per month	Source
Zonal NAT gateway	$0.045/hour + $0.045/GB processed	$32.85 idle, plus $45 per 1,000 GB	VPC pricing
Public IPv4 address (in use or idle)	$0.005/hour	$3.65	Price List, AmazonVPC
Cross-AZ data transfer	$0.01/GB out and $0.01/GB in	$20 per 1,000 GB moved	Price List, AWSDataTransfer
Internet egress	$0.09/GB for the first 10 TB, after 100 GB free	$90 per 1,000 GB	Price List, AWSDataTransfer
EBS gp2 / gp3 volume	$0.10 / $0.08 per GB-month	$100 / $80 per 1,000 GB	EBS pricing
EBS snapshots, standard / archive	$0.05 / $0.0125 per GB-month	$50 / $12.50 per 1,000 GB	EBS pricing
CloudWatch Logs ingestion, Standard / IA	$0.50 / $0.25 per GB	$500 / $250 per 1,000 GB	Price List, AmazonCloudWatch
CloudWatch Logs storage	$0.03/GB-month	$30 per 1,000 GB kept	Price List, AmazonCloudWatch
Application Load Balancer	$0.0225/hour + $0.008/LCU-hour	$16.43 with no traffic	ELB pricing
EKS cluster, standard / extended support	$0.10 / $0.60 per hour	$73 / $438	EKS pricing
RDS Extended Support (MySQL 8.0, PostgreSQL 10 to 13), years 1 and 2	$0.10 per vCPU-hour, $0.20 in year 3	$292 for 4 vCPUs, more with Multi-AZ	RDS for MySQL pricing

NAT Gateway cost: why $0.045 per GB adds up

A zonal NAT gateway in us-east-1 costs $0.045 per hour plus $0.045 per GB processed (VPC pricing). The hourly part is small: $32.85 a month, or about $99 for one gateway per AZ. The per-GB part is where bills go wrong, because it applies whatever the source or destination. Traffic from a private subnet to S3 in the same region pays no transfer charge but still pays NAT processing, while a gateway endpoint for S3 or DynamoDB has "no data processing or hourly charges". Image pulls, package installs, log shipping and backups all take that path by default, and internet-bound traffic pays egress on top ($0.09 per GB after 100 GB free).

Agent sandboxes that pip install, clone repositories and download model weights from a private subnet are close to the NAT worst case. PandaStack, my company, runs Firecracker microVMs for that kind of workload, which is why this is the line I check first.

The regional NAT gateway launched in November 2025 spans every AZ from one resource and needs no public subnet, but it is billed at the same $0.045 per hour per AZ and $0.045 per GB, so it fixes sprawl, not the meter. Interface endpoints cost $0.01 per hour in each AZ plus $0.01 per GB (PrivateLink pricing); an endpoint in three AZs ($21.90 a month) beats NAT processing above roughly 630 GB a month. Compute Optimizer now flags NAT gateways with no route table and no traffic over 32 days. For the networking basics, see AWS VPC explained.

Public IPv4 and cross-AZ data transfer charges

Since 1 February 2024 every public IPv4 address costs $0.005 per hour, attached or not; the AWS News Blog announcement cited a rise of more than 300 percent in the cost of acquiring one over five years, and the October 2026 Price List still shows $0.005 for in-use and idle addresses alike. $3.65 a month sounds trivial until you count: an internet-facing load balancer holds one per AZ (ELB pricing confirms they pay it), so does every instance with an auto-assigned public IP and every NAT gateway. Public IP Insights in VPC IPAM, free, shows where they are.

Cross-AZ transfer is the charge people misread most. The Price List bills "regional data transfer" in, out and between EC2 AZs at $0.010 per GB, applied in each direction, so a gigabyte moving from us-east-1a to us-east-1b is billed leaving and arriving. A billing test by Last Week in AWS confirmed the effective two cents, and the CUR documentation says both inbound and outbound regional traffic is charged. Chatty services across three AZs, Kafka replication and cross-zone load balancing all pay it as DataTransfer-Regional-Bytes. On Kubernetes, topology-aware routing helps; see my Kubernetes cost optimization post.

Idle EBS volumes, old snapshots and CloudWatch Logs kept forever

An EBS volume bills for provisioned gigabytes whether anything is attached or not: $0.10 per GB-month for gp2 and $0.08 for gp3 in us-east-1, so converting live gp2 to gp3 cuts that line by 20 percent in place. gp3 includes 3,000 IOPS and 125 MB/s, with extra IOPS at $0.005 per IOPS-month and throughput at $0.04 per MB/s-month (EBS pricing). Orphans come from instances terminated with DeleteOnTermination off, abandoned experiments and Kubernetes volumes with a Retain policy. Compute Optimizer marks a volume unattached after 32 days, and idle below one read or write a day.

Snapshots cost $0.05 per GB-month, or $0.0125 in the archive tier with a 90-day minimum and $0.03 per GB to retrieve. They are incremental, but a daily policy with no expiry grows forever. Two traps: a snapshot behind a registered AMI cannot be deleted until the AMI is deregistered, and Recycle Bin rules keep deleted volumes and snapshots billed at normal rates until retention ends.

CloudWatch Logs charges $0.50 per GB ingested into the Standard class, $0.25 into Infrequent Access, $0.03 per GB-month stored and $0.005 per GB scanned by Logs Insights. Log data "is stored in CloudWatch Logs indefinitely" unless you set retention, and ingesting a gigabyte costs about 17 months of storing it, so verbose logging is paid for on the way in. Since May 2025 Lambda logs are billed as vended logs, dropping to $0.25 per GB after 10 TB a month, with S3 or Firehose delivery from $0.25 per GB. Infrequent Access halves ingestion but drops features and is fixed at log group creation. Logging less beats both; more in observability costs in 2026.

EKS extended support, RDS Extended Support and oversized databases

EKS charges $0.10 per cluster-hour in standard support and $0.60 in extended support (EKS pricing): $73 versus $438 a month. Per the EKS version lifecycle, standard support lasts 14 months, extended support another 12, and extended support is on by default, so a cluster that drifts past its date costs six times as much while running exactly as before. Today 1.31, 1.32 and 1.33 are in extended support; 1.31 is auto-upgraded after 26 November 2026, and 1.34 enters extended support on 2 December 2026. AWS EKS in 2026 covers the options and the EKS upgrade guide the steps.

RDS uses the same model per vCPU. Standard support for RDS for MySQL 8.0 ended this summer, and the RDS user guide dates the start of Extended Support charges to 1 August 2026. The us-east-1 Price List has it at $0.10 per vCPU-hour in years one and two and $0.20 in year three, the same as PostgreSQL 10 to 13 and Aurora MySQL 2. A 4 vCPU instance pays $292 a month extra, or $584 with a Multi-AZ standby, which is billed too (RDS for MySQL pricing). Enrollment shows as EngineLifecycleSupport in describe-db-instances; the practical exit is upgrading to 8.4.

Databases are also the most oversized resource in most accounts, since nobody wants to shrink one before an incident. Compute Optimizer now gives rightsizing and idle recommendations for RDS for MySQL, PostgreSQL and Aurora: evidence a nervous team can act on.

Savings Plans vs Reserved Instances in 2026

Commitments discount compute and databases. NAT processing, transfer, IPv4, EBS, snapshots, logs and extended support do not get cheaper because you signed a Savings Plan. Clean up first and commit to what is left, or you lock the waste in for one to three years. The options as of October 2026:

• Compute Savings Plans: up to 66 percent off, applied across EC2 instance family, size, AZ, Region, OS and tenancy, plus Fargate and Lambda (Savings Plans pricing).
• EC2 Instance Savings Plans: up to 72 percent, for one instance family in one Region.
• Database Savings Plans, launched 2 December 2025: one-year term, up to 35 percent on serverless and 20 percent on provisioned instances, across Aurora, RDS, DynamoDB, ElastiCache, DocumentDB, Neptune and more, in any Region.
• RDS Reserved Instances: up to 69 percent for steady workloads, tied to engine, instance family and Region.

For compute I default to Compute Savings Plans: the extra points from EC2 Instance plans or RIs rarely pay for lost flexibility when you rightsize or move to Graviton. For databases it is a real trade: RDS RIs go deeper than the 20 percent Database Savings Plans give provisioned instances, but the plan survives an engine migration or a move to serverless. Buy in tranches against the baseline you see at 3 a.m., not the peak. You can return a Savings Plan within seven days, in the same calendar month, if the hourly commitment is $100 or less.

What should I fix first on my AWS bill?

Order by the cost of fixing, not by the size of the line:

1. Alerts. A budget and Cost Anomaly Detection cost nothing to set up; anomaly detection needs about ten days of history. The next surprise arrives a day old, not a month old.
2. Provably unused resources. Unattached volumes, unassociated Elastic IPs, load balancers with no requests, snapshots older than any recovery policy.
3. Gateway endpoints for S3 and DynamoDB. Free, minutes of work, and that traffic leaves the NAT meter.
4. Log retention and log levels on every log group.
5. Version debt. EKS and RDS upgrades are projects, but the fee recurs every hour you wait.
6. Rightsizing from Compute Optimizer and Cost Optimization Hub, databases included.
7. Commitments last, sized to what remains.

This is where platform discipline earns its keep in the AI era. Agents and CI pipelines create resources faster than people do, and an agent that spins up a test cluster rarely remembers the volume, IP and log group it left behind. Tags, TTLs and budgets make that cheap to clean up, and CUR 2.0 gained IAM principal attribution for Bedrock inference in April 2026 so token spend can be traced to a caller; the token side is covered in FinOps for AI.

FAQ

Why did my AWS bill go up when nothing changed?

Usually something did change, just not compute: more data through a NAT gateway, more cross-AZ chatter, more logs, accumulating snapshots, or a cluster or database crossing into extended support. Group Cost Explorer by usage type and compare the last two months to see which meter moved.

Is a NAT Gateway worth the cost?

For internet access from private subnets, usually yes. Sending AWS service traffic through it rarely is: S3 and DynamoDB gateway endpoints are free, and interface endpoints beat the $0.045 per GB fee above roughly 630 GB a month per service.

Should I buy Savings Plans or Reserved Instances in 2026?

For EC2, Fargate and Lambda, Compute Savings Plans (up to 66 percent) are the safest default. For databases, compare RDS Reserved Instances (up to 69 percent, inflexible) with Database Savings Plans (up to 20 percent on provisioned instances, flexible across engines and Regions). Commit only after cleanup, and only to your steady baseline.

How much does a public IPv4 address cost on AWS?

$0.005 per hour, about $3.65 a month per address, attached or idle, since 1 February 2024. It shows under Amazon VPC with usage types such as USE1-PublicIPv4:InUseAddress.

This quarter, on any account I was responsible for, I would turn on Cost Anomaly Detection and a budget on day one, add S3 and DynamoDB gateway endpoints to every VPC, set retention on every log group, and put the EKS and RDS end-of-support dates in the team calendar with an owner next to each. Then I would export CUR 2.0, find the top ten usage types, and only then talk about Savings Plans. Nothing on that list is clever. It is the boring hygiene that stops a bill compounding.

Related: Kubernetes Cost Optimization in 2026: 8% CPU Use and What Fixes It, FinOps for AI in 2026 and Self-Hosting vs SaaS in 2026: 37signals Saved $2M a Year. Should You?.