General 40% Bill Increase with RI Expiration

Bill Spike Diagnosis: General Increase (40%)

Systematic Investigation Framework

When the service causing a spike is unclear, follow this priority order:

Step 1: Identify Top Cost Drivers

Cost Explorer navigation:

1. Go to AWS Console -> Cost Explorer
2. Date range: Last 2 months (compare current vs previous)
3. Group by: Service
4. Filter: Show only EC2, RDS, S3, Lambda
5. Look for which service bar shows the largest absolute dollar increase

Step 2: Check Reserved Instance Status FIRST

Given your context about expiring RIs, this is the most likely culprit:

# Check all reserved instances and expiration dates
aws ec2 describe-reserved-instances \
  --filters "Name=state,Values=active,retired" \
  --query 'ReservedInstances[*].{
    InstanceType:InstanceType,
    Count:InstanceCount,
    Start:Start,
    End:End,
    State:State
  }' \
  --output table

Compare End dates to the start of your spike month.

Top 5 Cost Spike Culprits (Ranked by 40% Increase Likelihood)

Quick Investigation Commands

Get exact cost by service (last 2 months):

aws ce get-cost-and-usage \
  --time-period Start=2025-12-01,End=2026-01-31 \
  --granularity MONTHLY \
  --metrics BlendedCost UnblendedCost \
  --group-by Type=DIMENSION,Key=SERVICE \
  --filter '{
    "Dimensions": {
      "Key": "SERVICE",
      "Values": ["Amazon Elastic Compute Cloud - Compute", "Amazon Relational Database Service", "Amazon Simple Storage Service", "AWS Lambda"]
    }
  }'

Check EC2 on-demand vs reserved usage:

aws ce get-cost-and-usage \
  --time-period Start=2025-12-01,End=2026-01-31 \
  --granularity MONTHLY \
  --metrics BlendedCost \
  --group-by Type=DIMENSION,Key=PURCHASE_OPTION \
  --filter '{
    "Dimensions": {
      "Key": "SERVICE",
      "Values": ["Amazon Elastic Compute Cloud - Compute"]
    }
  }'

Look for shift from “Reserved Instance” to “On Demand” usage.

Check all running EC2 instances:

aws ec2 describe-instances \
  --filters "Name=instance-state-name,Values=running" \
  --query 'Reservations[*].Instances[*].{
    ID:InstanceId,
    Type:InstanceType,
    LaunchTime:LaunchTime,
    Name:Tags[?Key==`Name`]|[0].Value
  }' \
  --output table

Check RDS reserved instances:

aws rds describe-reserved-db-instances \
  --query 'ReservedDBInstances[*].{
    InstanceClass:DBInstanceClass,
    Count:DBInstanceCount,
    Start:StartTime,
    State:State
  }' \
  --output table

40% Increase: Likely Root Causes

1. EC2 Reserved Instance Expired (70% probability)

Why this fits:

• You mentioned RIs expiring soon
• 40% increase is typical when RIs expire (on-demand is 50-100% more expensive)
• Most common cause of predictable 30-50% spikes

Cost impact calculation:

Example: 10x m5.large instances
- Reserved: ~$0.069/hour = $500/month
- On-demand: ~$0.096/hour = $700/month
- Increase: $200/month (40%)

How to fix:

• Purchase new Reserved Instances (1-year term for flexibility)
• Consider Savings Plans (more flexible than RIs)

2. RDS Reserved Instance Expired (25% probability)

Why this fits:

• Same pattern as EC2 RIs
• RDS on-demand is 50-70% more expensive than reserved
• Commonly bundled with EC2 RIs that expire together

Resolution Steps

If Reserved Instances Expired:

Step 1: Review RI utilization

aws ce get-reservation-utilization \
  --time-period Start=2025-12-01,End=2026-01-01 \
  --granularity MONTHLY

Step 2: Purchase new EC2 Reserved Instances

Console approach (recommended for first-time):

1. EC2 Console -> Reserved Instances -> Purchase Reserved Instances
2. Select instance type matching your running instances
3. Choose term: 1-year (more flexible) or 3-year (cheaper)
4. Payment: All Upfront (cheapest), Partial Upfront, or No Upfront

CLI approach:

# Search for available RIs
aws ec2 describe-reserved-instances-offerings \
  --instance-type m5.large \
  --product-description "Linux/UNIX" \
  --filters "Name=duration,Values=31536000" \
  --max-results 5

# Purchase (use offering ID from above)
aws ec2 purchase-reserved-instances-offering \
  --reserved-instances-offering-id <offering-id> \
  --instance-count 10

Expected cost reduction: 30-40% back to previous baseline

Step 3: Consider Savings Plans (more flexible)

# Get Savings Plan recommendations
aws ce get-savings-plans-purchase-recommendation \
  --savings-plans-type COMPUTE_SP \
  --term-in-years ONE_YEAR \
  --payment-option NO_UPFRONT \
  --lookback-period-in-days SIXTY_DAYS

Prevention Measures

Immediate:

aws budgets create-budget \
  --account-id $(aws sts get-caller-identity --query Account --output text) \
  --budget '{
    "BudgetName": "MonthlyBudget",
    "BudgetLimit": {
      "Amount": "1400",
      "Unit": "USD"
    },
    "TimeUnit": "MONTHLY",
    "BudgetType": "COST"
  }' \
  --notifications-with-subscribers '[{
    "Notification": {
      "NotificationType": "ACTUAL",
      "ComparisonOperator": "GREATER_THAN",
      "Threshold": 80
    },
    "Subscribers": [{
      "SubscriptionType": "EMAIL",
      "Address": "your-email@example.com"
    }]
  }]'

This week:

# Enable AWS Cost Anomaly Detection
aws ce create-anomaly-monitor \
  --anomaly-monitor '{
    "MonitorName": "ServiceLevelMonitor",
    "MonitorType": "DIMENSIONAL",
    "MonitorDimension": "SERVICE"
  }'

Long-term:

• Create calendar event for 90 days before next RI expiration
• Set up AWS Budgets report emailed monthly

What NOT to Do

1. Don’t panic and shut down instances - Verify root cause first with Cost Explorer
2. Don’t purchase RIs for fluctuating workloads - Check utilization >=80% first
3. Don’t purchase 3-year RIs without analysis - Start with 1-year for flexibility
4. Don’t buy RIs without optimization - Right-size instances first
5. Don’t ignore AWS Budgets setup - Free features that prevent future surprises

Next Steps

1. Within 1 hour: Run Cost Explorer check to identify exact service
2. Within 4 hours: Run RI expiration check to confirm hypothesis
3. Within 24 hours: Purchase new RIs or Savings Plans if expiration confirmed
4. Within 1 week: Set up budget alerts and cost anomaly detection