Stop Recurring AWS Bills
Tags: aws, sre, devops, s3
Published: 2022-08-30 13:38:07

Across AWS Social Media the number of users that are stuck with recurring monthly bills is much higher than I thought it would be:

{% embed https://twitter.com/nomoreconfig/status/1557398315238572033 %}
{% embed https://twitter.com/whereistanya/status/1080864493108776961 %}
{% embed https://twitter.com/seakoz/status/1367591450616029189 %}
{% embed https://twitter.com/IsaiBCortez/status/1556780608394629120 %}

For those who find themselves in this trap, here are some basic steps you can take to finally stop these recurring bills or find what is driving your cost spike.
<hr/>

## Reminder: ALWAYS Set up MFA
Take a few minutes, go to [r/aws](https://www.reddit.com/r/aws/), and look at the posts over the past week. I bet at least one post sounds like this: "help, I've been hacked, and someone spent thousands of dollars on my account!!". [Here's one](https://www.reddit.com/r/aws/comments/wq6ofx/aws_billing_adjustment_taxes_still_in_bill/) if you aren't able to find any on your own. 

The first question is: "Have you set up MFA on your account?"
The answer is ALWAYS: "No."

Don't be one of the people begging AWS to refund $5K in usage because you didn't set up MFA! What if AWS stops canceling bills from 'hackers' if you don't have MFA? You don't want to be stuck holding someone else's bar tab. Setting up MFA will take ~5 minutes and could save you thousands of dollars or a major headache.
<hr/>

## Create a Cost and Usage Report
The first step to fixing a cost problem is figuring out what is driving your cost problem. To do this, you need visibility into what is running in your environment. The Cost and Usage Report is the best resource for AWS users to get visibility into what is running in their accounts.

The Cost and Usage Report (CUR) is the most detailed billing report Amazon has to offer. You can see a line item for every resource, for every hour during a month, with over 100 fields that describe the resources, resource operations, and pricing structure. The CUR contains the same data that drives visualization in Cost Explorer (we all know [it isn't a good idea to rely on Cost Explorer](insert link for post).

In my GitHub project, the [Developer's Guide to AWS Costs](https://github.com/getstrake/developer-cost-guide), I created a [guide for creating and analyzing your Cost and Usage Report](https://developer-cost-guide.projects.macroscope.io/guides/guide-01-costandusagereport/). There is no cost to create a CUR. The only fee you will incur is for s3 storage. This cost will scale with the size of your business: for an individual account or startup, this will be ~$1 per month. This cost would still be less than $~25 per month for large enterprise AWS customers. 

To be clear, For an individual user looking to get rid of their lingering AWS costs, this report running for a single day would be less than $0.01 in storage costs. Pay $0.01 for getting rid of a $5 recurring monthly bill? Yes, please!
<hr/>

## How to Find the Resources
With the cost and usage report active, here are two straightforward SQL queries to investigate which resources are driving your costs.

First, this query is a high-level summary of the costs for a particular account by AWS Service. Use this query as a high-level view to figure out which AWS Services need to be investigated further.
```sql
SELECT
	[lineItem/UsageAccountID],
	[lineItem/ProductCode],
	sum([lineItem/UnblendedCost])
FROM cur;
GROUP BY
	[lineItem/UsageAccountID],
	[lineItem/ProductCode]
ORDER BY
	sum([lineItem/UnblendedCost]);
```

Now we understand which services are causing our cost issue. Next, we can add the [lineItem/ResourceID] field to see a list of all the resources that are still running. For this example, we are filtering for all EC2 Resources.
```sql
SELECT
	[lineItem/ResourceID]
	sum([lineItem/UnblendedCost])
FROM cur
WHERE
	[lineItem/ProductCode] is 'AmazonEC2'
GROUP BY
	[lineItem/ResourceID]
ORDER BY
	sum([lineItem/UnblendedCost]);
```

Some costs in AWS aren't tied to a resource (of course), so if that last query wasn't able to answer your question, we could replace the [lineItem/ResourceID] field with [lineItem/Operation] and [lineItem/UsageType] to describe the cost categories that are driving cost.
```sql
SELECT
	[lineItem/UsageAccountID],
	[lineItem/ProductCode],
	sum([lineItem/UnblendedCost])
FROM cur;
GROUP BY
	[lineItem/UsageAccountID],
	[lineItem/ProductCode]
ORDER BY
	sum([lineItem/UnblendedCost]);
```

The two queries above aggregate costs for the duration of your report. Adding in the [lineItem/UsageStartDate] field will show costs by hour. This field adds a lot of detail to the report and will help you determine if this is a monthly service charge or a recurring fee for usage.
```sql
SELECT
	[lineItem/UsageStartDate],
    [lineItem/UsageAccountID],
	[lineItem/ProductCode],
	sum([lineItem/UnblendedCost])
FROM cur;
GROUP BY
	[lineItem/UsageAccountID],
	[lineItem/ProductCode]
ORDER BY
	sum([lineItem/UnblendedCost]);
```
<hr/>

## The Last Step
Once you figure out and terminate the straggling resources, the last two things you will need to do are:
1. Delete your Cost and Usage Report
2. Delete the S3 bucket where your Cost and Usage Report is stored.

### Delete the Cost and Usage Report
Search for 'billing' to go to the billing console and click on 'Cost & Usage Reports' on the left banner of your screen. Once on this screen, you will see all the active Cost and Usage Reports in your account. Select the report you created, and click on the 'delete' button (see the screenshot below).

![Find and delete your cost and usage report](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/mx4j5p6ogitmems6io75.jpg)

### Delete the S3 bucket.
Search for S3 to go to the S3 console. Once in the S3 console, look for the S3 bucket where your S3 bucket is being saved. Once this bucket is empty, you can select the bucket and click 'Delete'. 

![Find the S3 bucket where your CUR is stored](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/41y8agyel62jts1xfjpq.jpg)

Clicking 'delete' will open a new screen where you must type the bucket's name and confirm you want to delete the s3 bucket. 

![delete your s3 bucket](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/locxrtmij8ongpkr5f4j.jpg)


## Billing Freedom
These steps will allow you to see what you're being billed for and have the information you need to stop these recurring AWS bills. If you want a more detailed analysis of your favorite AWS services, check out our [project on GitHub](https://github.com/getstrake/developer-cost-guide). If there are any questions about this process, let me know in the comments below ⬇️.

_Content powered by [Strake](https://getstrake.com)_