Incident and cost-spike procedures: NAT, egress, Kubernetes spend, IAM lockout, failover, DNS, certificates and quotas.
Autoscaling failed when the group did not move toward the size the policy asked for, or when new instances never became healthy. A delayed scale-in is often configuration. Check the cooldown before you call the autoscaler broken. Related: quota exhaustion if the activity text is a limit.
A quota is a documented cap on how much of a service an account, subscription or project may use. Exhaustion looks like an outage. Read the applied limit, then free usage or ask for more.
Match the meter to a path. The bill will not tell you if the copy was a DR test, an artifact pull or a replica you forgot. Background: egress cost planning and cross-region disaster recovery.
Compare authoritative answers to recursive answers before you rewrite the zone. Failover context: region failover. Clients hit the wrong load balancer, an old IP, or NXDOMAIN. Some networks work and others do not. A recent record change "did not take." Failover records stay on the unhealthy endpoint. Split-horizon answers differ from the public zone.
Read the certificate on the wire first. The console object you think is attached may not be the one clients see. Browsers show a date error. API clients log certificate has expired or a hostname mismatch. A listener, CloudFront or Front Door custom domain, API Gateway, or ingress still presents the old leaf. ACM or Certificate Manager shows PENDING_VALIDATION on a renewal that never finished.
Lockout means you cannot administer the account with the identities you normally use. Recover with a pre-created emergency identity. Leave the existing admins in place until you can sign in. Design: multi-cloud identity.
A Kubernetes bill is a bundle: control plane, workers, disks, load balancers, NAT, logs and often GPU. Allocation comes after you know which of those moved. See Kubernetes cost allocation.
NAT cost has two parts: time the gateway exists, and traffic it translates. Most surprises are traffic. Related: egress cost planning and unexpected cost spike.
Failover is a rehearsed control. Choose the standby region before the incident. If the standby was never built, this runbook cannot invent it. Context: cross-region disaster recovery.
Treat a spike as a billing investigation first. Architecture changes come after you can name a service, account and usage type. Longer write-up: Finding unexpected cloud cost increases.