Find an unexpected cost increase by comparing two time windows at the same grain, then grouping the delta by account or subscription, service and usage type. The architecture owner names the meter that moved: egress, idle GPU, an untagged account, or another usage type, and what design change would stop it. Do not start by deleting NAT gateways or node pools. Confirm the metric (unblended, amortized, actual) and the payer. Documentation dated 2026-08-30 is the billing-product source. Infrastructure health that causes retries belongs to monitoring, not to this allocation path.

The hour-by-hour operational checklist is unexpected cloud cost spike. Optimization after you know the meter is cloud cost optimization.

Assumptions

  • You can query Cost Explorer, Azure Cost Management or Cloud Billing for two comparable windows on the same payer.
  • The metric (unblended, amortized, actual) is stated before you compare. Switching views mid-diff invents a spike.
  • This page isolates the meter. It does not delete NAT gateways, node pools or accounts.
  • Retry storms that inflate usage are a health signal first. Name the path, then allocate.

Compare two windows, then group the delta

Pick a baseline window (last month, or the same weekdays last week) and the spike window. Use the same granularity and the same metric.

aws ce get-cost-and-usage \
  --time-period Start=2026-08-01,End=2026-09-01 \
  --granularity MONTHLY \
  --metrics UnblendedCost \
  --group-by Type=DIMENSION,Key=SERVICE

Run the same command for the prior month. Sort both JSON Groups by Metrics.UnblendedCost.Amount and diff the service names.

Interpretation:

  • EC2-Other or Amazon EC2 jumping with USAGE_TYPE containing DataTransfer or NAT-Gateway is a network path, not a new fleet of API servers. Continue in egress cost planning or NAT gateway cost increase.
  • Amazon Elastic Kubernetes Service plus node-family usage types is cluster capacity. Use Kubernetes cost allocation.
  • A GPU instance family (p5, g6, Standard_NC, a2-) with low application traffic is idle capacity. Use GPU and AI workload cost governance.
  • A new LinkedAccount or subscription in the top of the delta is account sprawl, not a unit-cost change.

Azure: Cost Management cost analysis, group by Service name then Meter. Google Cloud: Cloud Billing reports or BigQuery export, group by service.description then sku.description.

If the native anomaly alert fired on amortized Savings Plan charges after you bought coverage, that is a reporting artifact. Switch the view to unblended or actual cost before you page the app team.

Account, then resource, then architecture

After the service is known, group by linked account, subscription or project. Then by usage type. Then by resource if the provider export supports it.

Tags help only if they were active in both windows. See cloud tagging and cost allocation. Untagged resources in the spike window are a finding, not a reason to stop.

The architecture owner names the meter that moved and whether the design should change: NAT versus a private endpoint, a reservation versus idle GPU, an account that should not exist. Isolation of the meter is not a 24x7 billing SOC.

When the cause is infrastructure health, not a price

Retry storms, failed health checks and crash loops create extra egress, extra Lambda invocations and extra node scale-out. Those are health signals. Investigate them with cloud monitoring with Vigiles, then return to Cost Explorer to confirm the meter quieted. Do not use Vigiles as a cost-anomaly product. Do not use Cost Explorer as an APM.

If nodes are unhealthy and the cluster autoscaler adds capacity, the bill follows the health problem. Fix readiness probes first. The cost line is the receipt.

What not to delete

Do not delete the only NAT gateway in a hub to “stop the bleed” while production still needs egress. Do not terminate the GPU node that is mid-checkpoint. Do not close an AWS account that holds the CloudTrail trail. The runbook lists safe mitigations: scale policies, orphaned load balancers, forgotten snapshots, unused Elastic IPs, forgotten Public IPv4 charges.

Confirm ownership before you stop a resource that has no tag. Platform NAT often looks unowned.

Risks and limitations

Billing data lags. A same-day spike may be incomplete in Cost Explorer and Azure Cost Management.

Credits, credits clawbacks and support charges appear as services. They are not architecture.

Commitment purchases move cost between unblended and amortized views. Native tools and independent FinOps platforms disagree on that presentation. Compare them in native cost tools vs independent FinOps platforms.

The FinOps Foundation describes this loop as inform, optimize, operate. Isolation of the meter is the inform step. Skipping it produces random reserved-instance buys.

Terms: cloud glossary.

Official sources