You open your email and there it is: an AWS invoice for $87, or $400, or worse. You thought you were on the free tier. You barely touched the account. So what happened?
First, take a breath. This is one of the most common problems new AWS users run into, and in many cases it can be fixed. AWS support teams see these situations every day, and they often help first-time customers who made an honest mistake.
This guide walks you through three things: finding exactly what is costing you money, stopping the charges right now, and asking AWS for a refund in a way that actually works.
Step 1: Don’t Panic, But Don’t Wait Either
Charges on AWS keep adding up for as long as the resource is running. Even if you forgot about that test server, it is still billing you every hour. So the order matters: understand the problem quickly, stop the bleeding, then ask for help.
Step 2: Find Out What You Are Being Charged For
Sign in to the AWS console and open the Billing and Cost Management dashboard. Two places will tell you most of what you need.
The Bills page. Go to Bills and pick the current month. You will see charges grouped by service (EC2, S3, RDS and so on) and, if you expand each one, by region. This is the fastest way to spot which service is the problem.
Cost Explorer. Turn it on if you haven’t already (it can take up to 24 hours to show data the first time). Group your costs by Service, then by Region, then by Usage Type. This lets you see exactly which day the cost jumped and what type of usage caused it.
Pay special attention to regions you don’t recognize. If you only ever used one region and suddenly see charges in another, that is a red flag, and we will talk about it below.
Step 3: The Usual Suspects Behind Surprise Bills
After you know which service is charging you, compare it with this list of common causes.
1. EC2 instances you forgot to stop. A running instance bills by the hour. Many people launch one for a tutorial and never terminate it. Remember that stopping an instance stops the compute charge, but attached storage still costs money. Terminating removes it completely.
2. Unattached EBS volumes and old snapshots. When you delete an instance, its storage volume doesn’t always disappear with it. Check EC2 → Volumes and Snapshots for anything marked “available” that you no longer need.
3. Elastic IPs and public IPv4 addresses. AWS charges for public IPv4 addresses, whether or not they are attached to a running resource. An idle Elastic IP you forgot about will quietly cost you every month.
4. NAT Gateways. These are a classic bill-shock item. They charge hourly and charge for data processed, so a single NAT Gateway left running in a test VPC can cost far more than people expect.
5. Load balancers. Application and Network Load Balancers bill hourly, even with zero traffic.
6. RDS databases. A database instance keeps billing while it exists, and backups and storage add to it. Stopping an RDS instance only pauses it temporarily, and AWS starts it again automatically after several days.
7. Data transfer. Moving data out of AWS to the internet, or between regions, costs money. A busy website or a big download can create a bill that surprises you.
8. Free tier expiry or exceeding limits. The free tier doesn’t last forever for most services, and each service has its own usage limits. Note also that the free tier rules for newly created accounts have changed in recent years, so check the current terms on AWS’s official free tier page for your account type.
9. CloudWatch logs and other “small” services. Logging a lot of data can add up slowly without anyone noticing.
10. Compromised credentials. If you see EC2 instances in regions you never used, especially large GPU instances, someone may have gotten hold of your access keys and is using your account for crypto mining. This one needs urgent action, covered next.
Step 4: Stop the Charges Immediately
Once you know the culprit, shut it down.
- Terminate the unused EC2 instances.
- Delete unattached EBS volumes and old snapshots you don’t need.
- Release unused Elastic IPs.
- Delete NAT Gateways, load balancers and RDS instances you aren’t using. Take a snapshot first if you might need the data.
- Check every region. The console only shows one region at a time, which is how forgotten resources hide. Use the region selector, or use Tag Editor or Resource Explorer to search across all regions.
If you suspect your account was compromised, do this right away:
- Change your root password and enable multi-factor authentication (MFA).
- Delete or deactivate all access keys in IAM, and rotate any you still need.
- Remove any IAM users, roles or resources you did not create.
- Open a support case and tell AWS you believe your account was compromised. They have a specific process for this, and it matters for your refund.
Step 5: Request a Refund From AWS
Here is the part most people get wrong. Many users write an angry, vague message or never contact support at all. A clear, honest request works much better.
How to open the case. Go to the AWS Support Center and create a case. Choose Account and billing, then pick the billing category that fits. You do not need a paid support plan for billing questions. Basic support includes access to account and billing help.
What to include. A good request is short, factual and polite. Cover these points:
- Your account ID and the invoice or billing period in question
- Which service and resource caused the charge
- What you believed was happening (for example, “I thought this was covered by the free tier”)
- That you have now stopped or deleted the resource, and when
- What you have done to prevent it from happening again, such as setting budgets and alerts
- A clear request, such as asking for a review of the charges and a credit or refund
A simple example you can adapt:
Hi AWS Billing Team,
I received an unexpected charge of $XX on my invoice for [month]. I was learning [service] and believed my usage was covered by the free tier. I did not realize the [resource] was still running.
I have now terminated the resource and checked all regions for anything else. I’ve also set up a billing alert so this won’t happen again.
This was an honest mistake. Could you please review the charges and consider a one-time courtesy credit? My account ID is [XXXX].
Thank you for your help.
Be patient and honest. Support may reply within a day or two, and they might ask follow-up questions. Never lie or exaggerate. AWS can see your usage history, and honesty is what gets goodwill.
Understand the outcome. AWS does not guarantee refunds. Many first-time cases get a one-time courtesy credit, especially for small, clearly accidental charges. Others get partial help or none, particularly if the usage was real and intended. Refunds are decided case by case, so try to stay realistic.
If your bill came from a compromised account, be sure to say so clearly. These cases are handled differently, and AWS may require you to complete security steps before they review the charges.
Step 6: Make Sure It Never Happens Again
Once the problem is solved, spend ten minutes on prevention. It’s worth far more than the refund.
Create a budget. In AWS Budgets, set a monthly budget as low as you are comfortable with, such as $5 or $10, and add email alerts at 50%, 80% and 100%.
Turn on free tier usage alerts. Enable them in your billing preferences so AWS emails you when you approach free tier limits.
Enable Cost Anomaly Detection. It automatically flags unusual spending patterns and can notify you by email.
Secure your account. Use MFA on the root account, don’t use the root account for daily work, and never put access keys in public code repositories.
Tag and clean up. Tag test resources with something like “temp” and review them weekly. When a project is done, delete everything in it, not just the main server.
Check the pricing first. Before launching a new service, open its pricing page and read what actually costs money. Two minutes of reading can save you hundreds of dollars.
Final Thoughts
A surprise AWS bill feels awful, but it is rarely the end of the world. The usual path is simple: find the service in Cost Explorer, shut down what you don’t need, check every region, and send AWS a clear, honest request for a courtesy review.
Most importantly, set up budgets and alerts today, even if your bill is currently fine. It takes minutes, and it turns a nasty surprise into a small notification.
Have you ever received an unexpected AWS bill? Share what caused it in the comments, because your story might help someone else avoid the same mistake.