Free Tier, Budgets and Cost Alerts

By the end of this lesson you will be able to

• Explain the Free Tier as it works today: the free plan and the paid plan for new accounts, credits, always-free offers, and the legacy 12-month Free Tier of older accounts.
• Create an AWS Budgets budget with actual and forecasted alerts, send it to email and an SNS topic, and know how late its data can be.
• Use budget actions to limit damage automatically, and explain why no AWS feature is a hard spending cap on a paid account.
• Choose the right tool for each cost question: Budgets, Cost Explorer, Cost Anomaly Detection, CloudWatch billing alarms, the Cost and Usage Report, cost allocation tags.
• List what keeps charging after you stop or terminate an instance, and clean up an environment in an order that leaves nothing billing behind, in every Region.
• Set up a brand-new account safely in the first ten minutes.

#Why the bill comes first

On AWS you never sign a purchase order. You click Launch, a meter starts, and at the end of the month AWS adds up every meter. That is the whole point of pay-as-you-go: no upfront cost, no waiting, no limit. It is also the risk. Nothing in a paid account stops spending on its own:

• a test NAT gateway you forgot costs about $1 a day whether or not anything uses it;
• a stopped instance still pays for its disks and its Elastic IP;
• an access key pushed to a public repository can be found by bots within minutes and used to start expensive instances in Regions you never open;
• a resource in another Region stays invisible in the console while it bills all month.

So before you build anything, you set up the tools that tell you what you are spending, warn you before you overspend, and, if you want, act for you. That is this lesson. It takes ten minutes, and every lab in the rest of the course assumes you have done it.

#The Free Tier today

The AWS Free Tier changed on 15 July 2025. What you get depends on when the account was created.

#New accounts: free plan or paid plan

Since 15 July 2025, every new account picks a plan at sign-up:

The extra $100 comes in $20 for each of five starter activities, such as launching an EC2 instance, building a Lambda function, creating an RDS database, trying Amazon Bedrock and setting up a cost budget in AWS Budgets. The budget you will make in this lesson earns you $20.

A free-plan account is automatically upgraded to the paid plan if it joins AWS Organizations, sets up an AWS Control Tower landing zone, or signs certain contracts. If someone invites your free account into the company’s organization, set up budgets first: from the moment you accept, overspending is possible.

#Always free

More than 30 services have monthly allowances that never expire, on both plans (for example a number of Lambda requests and some DynamoDB storage every month). Inside those limits the usage costs nothing; above them it is paid from credits, and on the paid plan from your card once the credits are gone. Always check the current limits on the Free Tier page: they are per month and per account, and they change.

#Older accounts: the legacy Free Tier

Accounts created before 15 July 2025 keep the old model: 12 months of free offers counted from sign-up (for example 750 hours a month of a micro instance, 30 GB of EBS storage and 5 GB of S3 storage), plus always-free offers and trials. Two traps catch almost everyone:

• 750 hours is one instance, all month. A month has about 730 hours, so two micro instances running all month use about 1,460 hours. The 710 extra hours are billed, even in month one.
• The 12 months end silently. On the anniversary the account stays open and the same resources start costing full price. Nothing is stopped for you.

#Where you see the bill

Everything about money lives in the Billing and Cost Management console:

• Home: month-to-date spend, the forecast for the month, the top services, and links to the other tools.
• Bills: the charges for any month by service and by Region, and the invoices. The first place to look for a charge you cannot explain.
• Free Tier: how much of each free allowance you have used this month and the forecast to the end of the month. On the free plan it also shows the remaining credits and days.
• Credits, Payments, Billing preferences (alert settings, invoice delivery, the default currency).

#AWS Budgets: your first line of defence

A budget is an amount you expect to spend (or use) in a period, with alerts that fire when actual or forecast numbers cross thresholds you choose. Budgets is the tool for “tell me before”.

#What you can budget

Each budget has a period: daily, monthly, quarterly, yearly, or a custom date range (which does not renew; set a reminder). The amount can be fixed, planned (a different amount per month) or auto-adjusting (calculated from your recent spend). A cost budget can include or exclude credits, refunds, taxes and upfront fees: to see what your resources really cost while credits are paying for them, exclude credits.

For a first budget, two templates do almost everything:

• Zero spend budget: alerts you the first time spend goes above $0.01. Perfect for a learning account that should cost nothing.
• Monthly cost budget: a fixed monthly amount with alerts at 85% and 100% of actual spend and 100% of the forecast.

#Actual and forecasted alerts

Every budget can have several alerts. Each alert has:

• a type: actual (spend so far this period) or forecasted (where AWS predicts the period will end);
• a threshold: a percentage of the budget or an absolute amount;
• recipients: up to 10 email addresses and one SNS topic per alert.

The difference is the whole point of this section:

• An actual alert can only fire after the money is spent. It fires once per budget period.
• A forecasted alert fires when the projected end of the period crosses the threshold, often days before any money has really been spent. It can fire again in the same period if the forecast drops below and rises again.
• Forecasts need about five weeks of usage history. On a brand-new account, a forecasted alert cannot fire yet, so add actual alerts at lower thresholds too (for example 50% and 80%).

#Where alerts go

Email is direct. An SNS topic gives you every other channel: SMS, more email lists, a Lambda function that does something, or a Slack or Microsoft Teams channel through Amazon Q Developer in chat applications (the service formerly called AWS Chatbot). For SNS to work, the topic’s access policy must allow budgets.amazonaws.com to publish, and every email subscription must be confirmed with the link SNS sends.

#How fresh the numbers are

Budgets does not watch your resources. It reads billing data, which is updated at least once a day and usually up to three times a day, hours after the usage happened. So:

• an alert can arrive hours after the threshold was crossed;
• by the time you read it, the spend has moved on;
• a budget is not a spending cap. Nothing stops at the threshold unless you attach an action, and even an action acts on hours-old data.

#Budget actions

An action is something AWS Budgets does for you when a threshold is crossed, either automatically or after you approve it in a notification. There are three kinds:

1. Apply an IAM policy to users, groups or roles, typically one that denies launching new resources.
2. Apply a service control policy (SCP) to an account or OU, from the organization’s management account (the multi-account version of the same idea, chapter 20).
3. Stop specific EC2 or RDS instances that you select.

Budgets runs the action with an IAM role you give it. Two limits are worth knowing:

• Stopping instances does not stop their storage and address charges.
• If the instances belong to an Auto Scaling group, the group simply launches replacements. Combine the stop with a second action that removes the group’s permission to launch, or scale the group to zero.

#What Budgets costs

Watching budgets and receiving alerts is free. Your first two action-enabled budgets are free; each further one costs $0.10 a day. Scheduled budget reports cost $0.01 each.

#The other cost tools

Budgets answers “warn me”. Other questions need other tools.

#Cost Explorer: look back, look ahead

Cost Explorer turns billing data into charts and tables you can slice by service, Region, account, usage type, tag, by day or month (and by hour or resource, for the last 14 days, if you turn that on). It also:

• forecasts your spend, now for up to 18 months ahead;
• recommends Savings Plans and Reserved Instances from your usage (lesson 4.4), and shows how well you use the ones you have;
• is free in the console; its API costs $0.01 per request.

You must enable it once (it can take up to a day for data to appear). What it does not do is alert. A forecast that nobody opens warns nobody.

#Cost Anomaly Detection: “this is not like you”

Anomaly Detection uses machine learning on your history to learn what is normal for each service (or account, tag, or cost category) and tells you when spend breaks the pattern, such as a one-day spike or a sudden jump that stays. A slow, steady rise looks like normal growth to it, so a forecasted budget alert catches that one (lesson 25.4). You do not set a dollar threshold for “unusual”; you only choose how big an anomaly must be before you hear about it. Each alert names the root cause it found: service, account, Region, usage type. Alerts go out individually through SNS or as a daily or weekly email summary.

It is free, and when you enable Cost Explorer, AWS sets it up for you with a monitor for all AWS services and a daily summary. It is the tool most likely to catch a leaked access key being used to run GPU instances in a Region you never use, long before a budget threshold is reached.

#CloudWatch billing alarms: the older way

Before Budgets existed, you watched the bill with a CloudWatch alarm:

1. In Billing preferences, turn on Receive CloudWatch billing alerts (this cannot be turned off afterwards).
2. Switch the console to US East (N. Virginia), us-east-1. Billing metrics live only there, but they cover every Region.
3. Create an alarm on the metric EstimatedCharges in the AWS/Billing namespace (total, or per service), in USD, and notify an SNS topic.

It still works, and the exam still asks about the us-east-1 detail. But a billing alarm only compares the month-to-date total: no forecast, no filters, no actions. For new setups AWS recommends Budgets.

#The Cost and Usage Report and cost allocation tags

• The Cost and Usage Report (CUR), now created through Data Exports, is the most detailed data AWS has about your bill: a line per resource per hour or day, written as files to an S3 bucket. You query it with Athena or load it into a reporting tool. It is the answer when a question asks for the most granular billing data or for analysis with SQL.
• Cost allocation tags let you see costs by project, team or environment. You tag resources (for example project=shop), then activate the tag key in the Billing console. Only activated tags appear in Cost Explorer, budgets filters and the CUR, and only for costs from the activation onwards (it can take up to a day to show up). Since March 2024 the management account can request a backfill of up to 12 months, which works only for months in which the resources already carried the tag. AWS also offers generated tags such as aws:createdBy.

#Which tool for which question

#What keeps charging after you “stop”

The most common surprise bill is not a big server. It is a pile of small things that were never deleted. Three words mean three different things on the bill:

The usual suspects (rough us-east-1 prices, October 2026, to show the scale):

• EBS volumes: billed per GB-month while they exist, attached or not, running instance or not (gp3 about $0.08 per GB-month). A volume in the available state is attached to nothing and still billed (lesson 5.1).
• EBS snapshots and AMIs: snapshots outlive the volume they came from (about $0.05 per GB-month). An AMI keeps its snapshots alive: deregister the AMI, then delete the snapshots.
• Public IPv4 addresses: since February 2024, every public IPv4 address costs about $0.005 an hour, in use or idle (about $3.65 a month). Terminating an instance does not release its Elastic IP (lesson 3.6). An auto-assigned public IP is released when the instance stops, so it stops costing.
• NAT gateways: about $0.045 an hour (about $33 a month) plus a charge per GB processed. There is no stop: delete it, then release its Elastic IP (lesson 3.4).
• Load balancers: billed per hour (an ALB about $16 a month) plus capacity units, even with no traffic. No stop: delete.
• RDS: a stopped database still pays for storage and backups, and AWS starts it again after 7 days. Delete it (decide whether you want a final snapshot, which is billed too).
• S3: storage per GB-month and requests; a bucket must be emptied before it can be deleted.
• Other Regions: EC2, EBS, VPCs and most services are Regional. The console shows only the Region you selected, so a forgotten instance in Singapore stays invisible from Virginia.
• Small monthly items that add up: Route 53 hosted zones, KMS keys, Secrets Manager secrets, CloudWatch log storage, data transfer out to the internet.

#A clean-up checklist

1. Find everything, in every Region

   Open Bills for the current month and look at the charges by Region and service, or group Cost Explorer by Region. To list resources across Regions, use AWS Resource Explorer, the Tag Editor, or the CLI loop in “Try it yourself”.

2. Delete from the outside in

   Load balancers and target groups first, then Auto Scaling groups (or the group launches new instances), then instances, then NAT gateways, then databases. Each layer depends on the one after it.

3. Delete the leftovers terminate does not touch

   Volumes in the available state, Elastic IPs (including the NAT gateway’s), old snapshots and AMIs, empty S3 buckets, unused VPCs.

4. Check again tomorrow

   Billing data lags by hours. Look at the Bills page the next day: the daily cost should be at or near zero. If not, the remaining line tells you the service and the Region.

#A new account’s first ten minutes

1. Protect the root user

   Turn on MFA for the root user, and do not create access keys for it (lesson 2.3). A stolen root password is the most expensive mistake there is.

2. Create two budgets

   A zero spend budget (or a small monthly cost budget) for the learning account, and a monthly cost budget with a forecasted alert at 100% and actual alerts at 50%, 80% and 100%. Send them to your email and, if a team is involved, to an SNS topic.

3. Let your IAM user see the bill

   As root, turn on IAM user and role access to Billing information, then do your daily work as an IAM user or through IAM Identity Center, never as root.

4. Turn on Cost Explorer

   This also switches on Cost Anomaly Detection with its default monitor and daily summary.

5. Pick a home Region and tag what you create

   Work in one Region so leftovers are easy to find, and tag every resource with at least a project key so costs can be grouped later.

#Try it yourself

Replace 111122223333 with your account ID and you@example.com with your address.

# 1. A $10 monthly cost budget: forecasted alert at 100%, actual alerts at 50% and 80%
aws budgets create-budget --account-id 111122223333 \
  --budget '{"BudgetName":"monthly-10","BudgetLimit":{"Amount":"10","Unit":"USD"},"TimeUnit":"MONTHLY","BudgetType":"COST"}' \
  --notifications-with-subscribers '[
    {"Notification":{"NotificationType":"FORECASTED","ComparisonOperator":"GREATER_THAN","Threshold":100,"ThresholdType":"PERCENTAGE"},
     "Subscribers":[{"SubscriptionType":"EMAIL","Address":"you@example.com"}]},
    {"Notification":{"NotificationType":"ACTUAL","ComparisonOperator":"GREATER_THAN","Threshold":50,"ThresholdType":"PERCENTAGE"},
     "Subscribers":[{"SubscriptionType":"EMAIL","Address":"you@example.com"}]},
    {"Notification":{"NotificationType":"ACTUAL","ComparisonOperator":"GREATER_THAN","Threshold":80,"ThresholdType":"PERCENTAGE"},
     "Subscribers":[{"SubscriptionType":"EMAIL","Address":"you@example.com"}]}]'

# 2. What did I spend this month, per service? (Cost Explorer API: $0.01 per call)
aws ce get-cost-and-usage \
  --time-period Start=$(date -u +%Y-%m-01),End=$(date -u -d tomorrow +%Y-%m-%d) \
  --granularity MONTHLY --metrics UnblendedCost \
  --group-by Type=DIMENSION,Key=SERVICE

# 3. Where will the month end?
aws ce get-cost-forecast \
  --time-period Start=$(date -u -d tomorrow +%Y-%m-%d),End=$(date -u -d "$(date -u +%Y-%m-01) +1 month" +%Y-%m-%d) \
  --metric UNBLENDED_COST --granularity MONTHLY

# 4. A CloudWatch billing alarm (billing alerts must be enabled first; note the Region)
aws cloudwatch put-metric-alarm --region us-east-1 \
  --alarm-name estimated-charges-over-20 \
  --namespace AWS/Billing --metric-name EstimatedCharges --dimensions Name=Currency,Value=USD \
  --statistic Maximum --period 21600 --evaluation-periods 1 \
  --threshold 20 --comparison-operator GreaterThanThreshold \
  --alarm-actions arn:aws:sns:us-east-1:111122223333:billing-alerts

# 5. Leftovers in every Region: instances, unattached volumes, idle Elastic IPs, NAT gateways
for r in $(aws ec2 describe-regions --query 'Regions[].RegionName' --output text); do
  echo "== $r"
  aws ec2 describe-instances --region "$r" \
    --query 'Reservations[].Instances[].[InstanceId,State.Name,InstanceType]' --output text
  aws ec2 describe-volumes --region "$r" --filters Name=status,Values=available \
    --query 'Volumes[].[VolumeId,Size,"unattached volume"]' --output text
  aws ec2 describe-addresses --region "$r" \
    --query 'Addresses[?AssociationId==null].[PublicIp,AllocationId,"idle Elastic IP"]' --output text
  aws ec2 describe-nat-gateways --region "$r" --filter Name=state,Values=available \
    --query 'NatGateways[].[NatGatewayId,"NAT gateway"]' --output text
done

Direct budget emails need no confirmation, but an SNS email subscription delivers nothing until its confirmation link is clicked. Run step 4 with any Region other than us-east-1 and it fails to find the metric.

#Summary

Key takeaways

• Pay-as-you-go has no limit. On a paid account nothing stops spending by itself; you need alerts before you build.
• Free Tier (since 15 July 2025): new accounts choose a free plan (up to $200 in credits, selected services, never charged, closes after 6 months or when credits run out, 90 days to upgrade) or a paid plan (same credits, all services, charged beyond the credits). Joining AWS Organizations upgrades a free plan automatically. Legacy accounts: 12 months of offers (750 hours = one instance all month), then full price, silently.
• Billing access: only root by default; root must turn on IAM user and role access to Billing information, and users still need a billing policy.
• AWS Budgets: cost, usage, RI and Savings Plans budgets; actual alerts (after the fact, once per period) and forecasted alerts (before, need ~5 weeks of history); up to 10 emails + 1 SNS topic per alert; data refreshes a few times a day, so it is not a cap. Budget actions: IAM policy, SCP, or stop EC2/RDS instances, automatic or approved; watch out for Auto Scaling groups. Monitoring is free; 2 action-enabled budgets free.
• Cost Explorer: analyse and forecast (up to 18 months), Savings Plan/RI recommendations, no alerts. Cost Anomaly Detection: machine learning, no threshold, root cause, on by default with Cost Explorer. CloudWatch billing alarm: EstimatedCharges, us-east-1 only, actual only. CUR / Data Exports: line-item detail in S3. Cost allocation tags: must be activated, apply from then on (backfill of up to 12 months on request).
• Stop ≠ stop paying. EBS volumes, snapshots, Elastic IPs, NAT gateways, load balancers, RDS storage (and RDS restarts after 7 days), S3 and resources in other Regions keep billing. Delete from the outside in, release addresses, check every Region, look again the next day.

Self-check: Free Tier, budgets and cost alerts30 questions