Use this runbook when a bill, forecast or cost-anomaly alert is higher than the prior comparable period and nobody can name the change. First action: stop new spend decisions, then group cost by account or subscription, service and usage type for the spike window and the same window last week. Do not terminate compute, NAT, load balancers or disks until you can name the usage type that moved. Credits, reservations, currency and tax lines can look like a spike. If you cannot open billing, bring a billing admin into the same session before you change infrastructure.

Treat a spike as a billing investigation first. Architecture changes come after you can name a service, account and usage type. Longer write-up: Finding unexpected cloud cost increases.

Symptoms

A cost chart steps up, a budget or anomaly alert fires, or the invoice does not match last month. Common companions: a new account, a marketplace charge, a data-transfer line, or a GPU or database SKU that was idle last week. A spike that appears only after credits expire is a rate or credit event, not necessarily new traffic.

Business impact

Unexplained spend burns the remaining budget and can trip a spending limit or payment-method failure. Some providers stop or throttle resources when the billing account cannot pay. Do not promise a savings percentage. Name the driver and stop further unplanned growth.

Immediate checks

  1. Confirm which billing account, payer account, enrollment or Cloud Billing account owns the invoice.
  2. Confirm the timezone and the exact start of the rise. Cost Explorer and Cost Management both delay; same-day numbers are incomplete.
  3. Confirm you have permission to read cost. If you do not, stop and get a billing admin. Guessing from the compute console wastes the first hour.
  4. Write down every change in the same window: deploys, region adds, DR tests, data copies, vendor PoCs, and new marketplace subscriptions.
  5. Compare the spike window to the same length of time in the prior week, with the same grouping.

Provider commands and console paths

AWS. Billing and Cost Management, then Cost Explorer. Group by Service, then Linked account, then Usage type. Cost Anomaly Detection is under the same console if you already enabled it.

aws ce get-cost-and-usage \
  --time-period Start=START,End=END \
  --granularity DAILY \
  --metrics UnblendedCost \
  --group-by Type=DIMENSION,Key=SERVICE

Narrow with --group-by Type=DIMENSION,Key=USAGE_TYPE or LINKED_ACCOUNT once you know the service. End date is exclusive. See the GetCostAndUsage CLI reference.

Azure. Cost Management + Billing, Cost analysis. Scope the subscription or billing account, group by Service name, then Meter, then Resource.

az consumption usage list \
  --start-date START \
  --end-date END

az consumption is preview; Microsoft points new pipelines at Cost Management APIs. For an incident, Cost analysis in the portal is faster. See az consumption usage.

Google Cloud. Billing, then Reports. Group by Service, then Project, then SKU. If you export billing to BigQuery, use that for SKU-level queries after the console view.

gcloud billing accounts list
gcloud billing projects list --billing-account=BILLING_ACCOUNT_ID

Reports themselves are a console feature. See Cloud Billing reports.

Alibaba Cloud. Expenses and Costs (Billing Management), Billing Details. Filter by product name and billing cycle. Do not invent aliyun billing flags here; use the billed-product filter in the console and view billing details.

Interpretation

Match the usage type to a mechanism.

  • Compute hours or vCPU-hours: more instances, a larger SKU, or a job that did not stop.
  • Data transfer, NAT, or egress meters: traffic path change. Continue with NAT gateway cost increase or cross-region traffic cost.
  • Storage GB-month or snapshot counts: backup jobs, forgotten volumes, or a replication setting.
  • Marketplace or third-party: a new listing or a meter that bills on API calls.
  • Credits, reservations or savings-plan coverage falling: the usage may be flat while the net rate rose.

If several services move together, look for a shared cause: a new region, a Kubernetes node group, or a data-copy job.

Safe mitigation

Stop adding capacity in the affected account until you have a named owner. Pause non-production pipelines. If the driver is an idle environment, shut it down after you tag it. Leave production NAT, load balancers, databases and disks running. If the driver is egress, change the path rather than deleting the NAT production still needs. See egress cost planning. Tighten a budget alert on the same scope.

Risky actions to avoid

Do not terminate instances, node groups or NAT gateways from the billing screen. Billing names are not inventory names.

Do not delete the last admin, the logging account, or the billing export while you “clean up unused resources.”

Do not buy a reserved instance, savings plan or committed use discount to paper over a spike you have not explained. Commitments lock in the new usage.

Do not assume the anomaly detector is the invoice. Detectors use models and delay; the bill uses usage.

Validation

Re-run the same cost grouping the next complete day. Usage for that type should stop climbing. Invoice and amortized views can still show the earlier peak. If usage is flat but net cost is still high, you are looking at rate, credit or tax.

Prevention

  1. Require a cost-allocation tag or label (owner, service, environment) on every billable resource that the provider can group.
  2. Put a budget and an alert on the payer (or billing account) and on each production account, subscription or project.
  3. Export billing (AWS CUR, Azure Cost Management export, Google Cloud billing export to BigQuery, Alibaba billing export) so you can query usage type without the console.
  4. Review marketplace and reserved-capacity subscriptions with a named owner and an expiry date.
  5. Keep the provider cost tool as the source of truth for amounts. This site does not publish invoice figures.

Official sources