Search code examples
securityamazon-web-servicescloudbilling

Does AWS cloud provides an option to cap the billing amount?

We had a bill shock scare in our corporate account when someone got access to the secure keys and started a lot of m3.large spot instances (50+) on the aws account.

The servers ran overnight before it was found and the bill went over $7000 for the day.

We have several security practices set up on the account after the incident including

key rotation
password minimum length
password expiry
Billing alerts
Cloudwatch
Git precommit hooks to look for AWS keys

I am yet to find a way to cap the bill amount to a desired top threshold.

Does AWS provide a method of setting a cap on the bill(daily/monthly) ? Is there any best practices on this front which can be added to the measures pointed out above to prevent unauthorized use ?

Solution

  • Amazon does not have a mechanism to "take action" in cases where bills skyrocket. You can do what you've already done:

    • Setup billing alerts to monitor for a skyrocketing bill
    • Setup good security practices to ensure that people cannot mess with your AWS account

    But also, you can:

    • Setup internal company policies so that employees don't accidentally cause unnecessary charges
    • Ensure you're using IAM roles and policies appropriately so that no one can do the wrong thing

    There's a good reason why AWS won't do anything active: what exactly would you expect them to do? Doing anything that isn't inline with your business practices could totally damage your company.

    For example, you have an autoscaling group managing a small fleet of EC2 instances. One day, your company gets some unexpected good press and your website activity goes through the roof, launching new EC2 instances to meet the demand, and blasts past your billing alert. If AWS were to terminate or stop EC2 instances to prevent your bill from going nuts, then your customers wouldn't be able to access your website. This could cause damage to your company reputation, or worse.

    If you want to take action, you can setup a trigger on the billing alert and handle it yourself according to your business needs. That's how AWS is built: it gives you the tools; you need to use those tools in a way that best suit your business.