Your AWS bill is roughly double what it was last month and someone has asked you to explain it. This is a triage sequence that gets you to a defensible answer in about half an hour, in the order that eliminates the most possibilities soonest.
The mistake most people make is opening Cost Explorer and staring at the total. The total is the thing you already know. Start by splitting it.
First, confirm the increase is real
Before investigating a cause, rule out the artefacts. Three produce apparent doublings that have nothing to do with usage.
A partial first month makes the second month look like a spike when it is simply the first full one. Check whether the account or a major service started mid-cycle.
Support and tax lines are charged as a percentage. If your Business Support plan is 10% of spend, it rises with everything else and inflates the apparent increase. Filter charge type to Usage before you compare.
A refund or credit in the prior month lowers the baseline rather than raising the current figure. Compare against two months back as well as one.
If the increase survives all three, it is real.
Establish whether volume or unit cost moved
This single split determines which of two entirely different investigations you run.
Volume moved means you are consuming more of something — more instance hours, more requests, more gigabytes stored. The cause is usually a change your team made.
Unit cost moved means you are paying more for the same consumption. The cause is usually a commitment expiring, a region change, or a move between instance families or storage classes.
In Cost Explorer, group by Usage Type and compare the same period month over month. If usage quantity is flat and cost is up, it is unit cost. If both moved together, it is volume.
Unit cost increases are the ones people miss, because nothing in the engineering org changed. A Savings Plan or Reserved Instance reaching the end of its term will raise your bill materially without a single deploy.
Isolate the service and the account
Group by Service and sort by absolute change rather than by total. The largest service is often not the one that moved — a $12,000 EC2 line that grew 4% matters less than a $200 line that became $9,000.
Then repeat inside the top movers, grouping by Linked Account. In an organisation with several accounts, this usually collapses the investigation to one team immediately.
If your accounts are not separated by team or environment, this is the step that fails, and it is worth fixing before the next incident rather than during it.
Find the day it started
Switch the granularity to daily and look at the top service. You are looking for the shape of the change, and there are three, each pointing somewhere different.
A step change — flat, then a jump to a new flat level — means something was created or a configuration changed. There is a deploy, a Terraform apply, or a console action on that date.
A ramp — gradually rising — means something is growing. Storage accumulating, a table filling, a log group without a retention policy.
A spike and return — up for a period, then back down — means a job ran. A backfill, a migration, a load test that nobody turned off promptly.
The date is the most useful single fact in the whole investigation, because it converts an open question into "what changed on the eleventh".
Match the date to a change
With a service, an account and a date, the cause is usually one query away. Check deploy history, infrastructure-as-code merges, and CloudTrail for Create and Modify events on that service in that window.
Five causes account for most AWS doublings:
- A resource created and left running — the classic being a large instance or managed database spun up for a test.
- Data transfer — cross-AZ, cross-region or NAT Gateway traffic introduced by a topology change. This one rarely correlates with an obvious deploy and is the hardest to spot.
- Storage growth — S3 without lifecycle rules, EBS snapshots accumulating, CloudWatch log groups with no retention.
- A commitment expiring — Savings Plan or RI term ending, moving workloads to on-demand rates.
- A runaway process — retries, a loop, or a log stream writing continuously.
If none fits, the remaining candidate is a compromised credential, and the shape is distinctive: sudden, large, and concentrated in a service the account does not normally use.
Write the answer down
Whoever asked will ask again next quarter. Record the service, the account, the date, the cause and the fix. Two lines is enough, and it turns the next investigation into a comparison rather than a fresh start.
Then close the detection gap
The diagnostic above works. The problem is that you ran it three weeks after the cause, because AWS billing is retrospective and nobody was watching daily.
A resource burning a fixed amount per day costs thirty times more caught at month end than caught on day one. That multiple is the actual cost of a surprise bill — not the hourly rate of the thing that caused it.
Closing the gap means a daily signal against a per-service baseline, delivered to where the team works, so a step change is visible on the day it happens rather than in the invoice. StackSpend connects AWS with read-only access and flags deviations the same day, which turns this thirty-minute diagnostic into a two-minute confirmation.
FAQ
Why did my AWS bill double with no deploys?
The most common causes without a deploy are a Savings Plan or Reserved Instance expiring, storage accumulating past a threshold, data transfer introduced by a networking change, or support and tax lines rising in proportion. Check unit cost before assuming usage grew.
How do I find which AWS service caused the increase?
Group by Service in Cost Explorer and sort by absolute change month over month rather than by total spend. The service with the largest bill is frequently not the one that moved.
How far back does AWS Cost Explorer data go?
Cost Explorer retains up to 12 months of history by default, with daily granularity. Hourly and resource-level granularity must be enabled separately and does not backfill, so enable it before you need it.
Can a compromised AWS key double my bill?
Yes, and quickly. The signature is a sudden, large increase concentrated in a service your account does not normally use, often in an unfamiliar region. Treat that pattern as a security incident before treating it as a cost one.
