AWS bill shock is usually a forgotten account, not a hack

In 2014 a Hacker News user wrote that the scariest thing about AWS was accidentally going broke while learning it. The thread is still right.

The threads that go viral mix two different failures. A stolen key that mines crypto is a security incident. GuardDuty, SCPs, and a broken-glass process belong there. unusd.cloud will not replace that.

The other failure is quieter, and it is the one we built for. Someone opened an account for a proof of concept. The company moved on. Three years later the bill is still landing. Or a sandbox in ap-southeast-2 that nobody has logged into since the last reorg. Reddit is full of those: $15k because services kept running, $20k on an account nobody remembered.

Why the console is a bad watchdog

AWS will sell you more capacity in seconds. It will not nag you when that capacity goes idle. Budgets help if someone set them, on the right account, with an email that still works. Cost Anomaly Detection flags spend shape. It does not say "this NAT has no traffic" or "this EBS volume is detached."

If you are a platform lead, you already know the pattern. Dev accounts sprawl. Tags are optional. The person who created the cluster left. Finance sees the total. Engineering sees 90 accounts and 20 regions.

What to do before the screenshot lands

1. Put a budget and an anomaly alert on every account, including the ones you think are empty.
2. Scan for idle and orphaned resources on a schedule, in every region, not when someone has a free afternoon.
3. Send the result to people who can act (Slack, Teams, email), and a short rollup to people who sign the invoice.

That third point is the gap Cost Explorer leaves. A director will not live in the billing console. A weekly digest they can forward beats a 40-tab investigation after month close.

unusd.cloud runs those scans with a read-only role. The first pass is free. For the hack-shaped bills, lock down IAM and turn on GuardDuty. For the forgotten-account bills, look at what is still running.