Your AWS bill says you spent $47 last month. On what, exactly?
The Bills page groups charges by service, which helps a little. But the real answer hides in usage types: cryptic codes like USW2-NatGateway-Hours or BoxUsage:t3.micro. Once you can read them, most "mystery" charges explain themselves in about five minutes.
This post is a decoder. No prior billing knowledge needed.
Step 1: Show your costs by usage type
The console's Bills page is too coarse. Use Cost Explorer instead (viewing it in the console is free):
- Open Billing and Cost Management → Cost Explorer.
- Set the date range to the last 3 months and granularity to Monthly.
- Under Group by, choose Usage type.
You now get a chart and table of every usage type, sorted by cost. Three months lets you spot what's growing, not just what's big.
Tip: If one service dominates, add a Service filter (for example, EC2-Other) and keep grouping by usage type. EC2-Other is a common hiding place for NAT Gateway, EBS, and data transfer charges.
Step 2: Understand the anatomy of a usage type
Most usage types follow this pattern:
[region code]-[what you're charged for]:[detail]
For example:
-
USW2-NatGateway-Hours→ US West (Oregon) · NAT Gateway · hours it existed -
APN1-BoxUsage:t3.micro→ Tokyo · EC2 instance hours · instance type t3.micro -
EUC1-EBS:VolumeUsage.gp3→ Frankfurt · EBS storage · gp3 volumes
Region codes you'll see most
| Code | Region |
|---|---|
| USE1 | US East (N. Virginia) |
| USE2 | US East (Ohio) |
| USW1 | US West (N. California) |
| USW2 | US West (Oregon) |
| CAN1 | Canada (Central) |
| EU | Europe (Ireland) |
| EUC1 | Europe (Frankfurt) |
| EUW2 | Europe (London) |
| APN1 | Asia Pacific (Tokyo) |
| APS1 | Asia Pacific (Singapore) |
| APS2 | Asia Pacific (Sydney) |
| SAE1 | South America (São Paulo) |
Two quirks worth knowing:
-
US East (N. Virginia) often has no prefix at all. For many services, a charge there shows up as plain
BoxUsage:t3.microorTimedStorage-ByteHrsinstead ofUSE1-.... If a usage type has no region code, N. Virginia is the usual suspect. -
Two region codes mean data moved between regions.
USE2-USW2-AWS-Out-Bytesis data sent from Ohio to Oregon.
Step 3: Decode the usual suspects
These are the usage types small accounts run into most often. Region prefixes are left off for readability.
Compute and databases
| Usage type | What it means | Billed by |
|---|---|---|
BoxUsage:t3.micro |
An EC2 instance running (On-Demand) | Hours |
InstanceUsage:db.t3.micro |
An RDS database instance running | Hours |
Lambda-GB-Second |
Lambda compute time × memory | GB-seconds |
Request (under Lambda) |
Lambda invocations | Requests |
Storage
| Usage type | What it means | Billed by |
|---|---|---|
EBS:VolumeUsage.gp3 |
EBS disk space (gp3), attached or not | GB-month |
EBS:SnapshotUsage |
EBS snapshots | GB-month |
TimedStorage-ByteHrs |
S3 storage (Standard) | GB-month |
Requests-Tier1 / Requests-Tier2
|
S3 requests (Tier1 ≈ PUT, COPY, POST, LIST; Tier2 ≈ GET and most others) | Requests |
Networking (where surprises usually live)
| Usage type | What it means | Billed by |
|---|---|---|
NatGateway-Hours |
A NAT Gateway existing, even with zero traffic | Hours |
NatGateway-Bytes |
Data processed by a NAT Gateway | GB |
PublicIPv4:InUseAddress |
Public IPv4 addresses attached to resources | Hours |
PublicIPv4:IdleAddress |
Public IPv4 addresses (Elastic IPs) attached to nothing | Hours |
DataTransfer-Out-Bytes |
Data sent from AWS to the internet | GB |
DataTransfer-Regional-Bytes |
Data moving between Availability Zones in the same region | GB |
LoadBalancerUsage |
A load balancer existing | Hours |
Monitoring
| Usage type | What it means | Billed by |
|---|---|---|
DataProcessing-Bytes (under CloudWatch) |
Logs ingested into CloudWatch Logs | GB |
TimedStorage-ByteHrs (under CloudWatch) |
Logs stored in CloudWatch Logs | GB-month |
Notice the pattern: anything ending in Hours usually means "you pay while it exists." Those are the first lines to check when nobody is using your app.
Step 4: Turn a line item into an action
Once you've found your top 3 usage types, this table covers the most common fixes:
| If you see a lot of... | It usually means... | Try this |
|---|---|---|
NatGateway-Hours |
A NAT Gateway left over from a tutorial or an old VPC | Delete it if private subnets don't need internet access |
NatGateway-Bytes |
Traffic to AWS services going through the NAT | Add free gateway endpoints for S3 and DynamoDB |
PublicIPv4:IdleAddress |
Elastic IPs you allocated but don't use | Release them |
EBS:VolumeUsage.* with few instances |
Disks left behind after instances were terminated | Delete unattached volumes |
EBS:SnapshotUsage growing every month |
Automated snapshots with no cleanup | Set a retention policy (for example, with Data Lifecycle Manager) |
DataTransfer-Regional-Bytes |
Chatty traffic across Availability Zones | Keep small, non-critical workloads in one AZ |
DataProcessing-Bytes (CloudWatch) |
Verbose logging | Lower log levels and set log retention |
| A region code you never use | Something launched in the wrong region | Search All regions in Tag Editor |
Bonus: the same view from the CLI
If you prefer the terminal, this prints last month's cost by usage type:
aws ce get-cost-and-usage \
--time-period Start=2026-10-01,End=2026-11-01 \
--granularity MONTHLY \
--metrics UnblendedCost \
--group-by Type=DIMENSION,Key=USAGE_TYPE \
--query "ResultsByTime[0].Groups[?to_number(Metrics.UnblendedCost.Amount) > \`0.01\`].[Keys[0], Metrics.UnblendedCost.Amount]" \
--output text | sort -t$'\t' -k2 -gr | head -20
Change the dates to the month you want. One heads-up: unlike the console, Cost Explorer API calls cost $0.01 per request. Fine for occasional checks, but don't put it in a loop that runs every minute.
Wrapping up
Your AWS bill stops being scary once you can read it:
- Open Cost Explorer and group by usage type over 3 months.
- Read each code as region + what + detail. No prefix usually means N. Virginia.
- Look hardest at anything billed in Hours. That's what you pay for just by existing.
Do this once a month, and surprise charges become rare.
If you want this alongside a full setup routine, I wrote a short PDF guide: a 30-minute action plan (MFA, budget alerts, anomaly detection, an all-regions sweep), copy-paste CLI commands, and a 10-minute monthly checklist. It's $9 on Gumroad: Stop AWS Bill Shock. You don't need it to use anything in this post.
Previous post: 5 Reasons Your AWS Bill Keeps Growing (Even When Nobody Uses Your App)
Sources (checked November 2026)
Top comments (0)