# How to read and cut your AWS bill safely

> How to read AWS Cost Explorer and Cost and Usage Reports, the charges that surprise small firms (EC2-Other, NAT Gateway, public IPv4) and safe ways to cut them.

Source: https://wharfcloud.co.uk/guides/how-to-read-and-cut-your-aws-bill · Last updated 21 October 2026 · WharfCloud

Published 21 October 2026. Reading time about 11 minutes.

## Short answer

Start in Cost Explorer grouped by service and then by usage type, over the last three to six months. Most avoidable spend in small accounts sits in a few places: idle or oversized EC2 and RDS instances, "EC2-Other" (EBS volumes, snapshots, NAT Gateway and data transfer), storage that never expires, and public IPv4 addresses. Remove what is idle first, right-size next, and only then buy Savings Plans or Reserved Instances for the steady usage that remains.

## Where to look: Cost Explorer and the Cost and Usage Report

**Cost Explorer** (in the Billing and Cost Management console) is the quickest way in. Set the date range to the last six months, granularity to monthly and group by **Service**. Then change the grouping to **Usage type** for the biggest services. The usage type names look cryptic, but they tell you what you are paying for: `BoxUsage` is instance hours, `EBS:VolumeUsage.gp2` is gp2 disk, `NatGateway-Bytes` is data processed by a NAT Gateway.

The **Cost and Usage Report** (CUR, now delivered through AWS Data Exports) is the full, line-by-line record. It is large, but it is the only place that ties costs to individual resource IDs. AWS documents it in the [CUR user guide](https://docs.aws.amazon.com/cur/latest/userguide/what-is-cur.html).

> **Try it without sharing anything** Our free [AWS bill X-ray](https://wharfcloud.co.uk/tools/aws-bill-xray) reads a Cost Explorer CSV export or a CUR file in your browser and shows spend by service, the biggest movers and plain-English hints. The file never leaves your device.

## The line items that surprise small companies

Table: Common AWS cost surprises and what to check

| Line item | What it usually is | What to check |
| --- | --- | --- |
| EC2-Other | EBS volumes, snapshots, NAT Gateway, data transfer, Elastic IPs | Group by usage type; it is rarely one thing |
| NAT Gateway | An hourly charge plus a charge per GB processed | Private subnets pulling large downloads, or S3 traffic that could use a free gateway endpoint |
| Public IPv4 | Every public IPv4 address, attached or not | AWS has charged per address per hour since 1 February 2024 |
| Data transfer | Traffic out to the internet and between zones or regions | Chatty services split across availability zones; downloads served without a CDN |
| CloudWatch | Log ingestion and storage, custom metrics | Log groups set to never expire; debug logging left on |
| Snapshots | EBS and RDS snapshots kept indefinitely | Snapshots of volumes that no longer exist |

The public IPv4 charge is described in AWS's [announcement](https://aws.amazon.com/blogs/aws/new-aws-public-ipv4-address-charge-public-ip-insights/). For S3 and DynamoDB traffic from private subnets, AWS's documentation states there is no additional charge for using [gateway endpoints](https://docs.aws.amazon.com/vpc/latest/privatelink/gateway-endpoints.html), which can take that traffic off the NAT Gateway.

## Cut in the right order

1. **Delete what is idle.** Unattached EBS volumes, old snapshots, stopped instances nobody owns, unused load balancers and Elastic IPs. Tag first, wait a week, then delete, so nobody loses something they needed.
2. **Set expiry everywhere.** CloudWatch log retention, S3 lifecycle rules (including removing incomplete multipart uploads) and snapshot policies.
3. **Modernise storage.** AWS says gp3 volumes cost up to 20% less per GB than gp2, and the change can be made without detaching the volume. See [EBS volume types](https://aws.amazon.com/ebs/general-purpose/).
4. **Right-size compute.** Use CloudWatch metrics over at least two weeks. Instances that never pass 20 to 30% CPU are candidates for a smaller size or a newer, cheaper family. Change one at a time and watch.
5. **Commit last.** Only once usage is lean, cover the steady baseline with Savings Plans or Reserved Instances. AWS advertises savings of up to 72% compared with On-Demand prices for [Savings Plans](https://aws.amazon.com/savingsplans/), depending on plan type, term and payment option.

Doing it in this order matters. Buy commitments first and you lock in paying for the waste you are about to remove.

## Habits that stop it creeping back

- Set an **AWS Budget** with an email alert at 80% and 100% of your expected monthly spend.
- Turn on **Cost Anomaly Detection** so a sudden jump in one service is flagged within a day or so, not at month end.
- Tag resources with an owner and a purpose. Untagged resources are where waste hides.
- Review the bill monthly with someone who can say what each top line is for.

If you would rather someone else did this, our [AWS cost and security review](https://wharfcloud.co.uk/aws-cost-security-review) does a one-off read-only pass, and [Managed AWS](https://wharfcloud.co.uk/managed-aws) includes a monthly cost report. We never resell AWS: your bill stays between you and AWS.

## Frequently asked questions

### What is EC2-Other on my AWS bill?

A Cost Explorer grouping for EC2-related charges that are not instance hours: EBS volumes and snapshots, NAT Gateway, data transfer and Elastic IP addresses. Group by usage type to see which one it is.

### Why am I paying for public IP addresses?

Since 1 February 2024 AWS charges for every public IPv4 address per hour, whether or not it is attached to a running resource.

### Should I buy a Savings Plan straight away?

Not before removing idle resources and right-sizing. Otherwise you commit to paying for capacity you were about to remove.

### How do I export my bill as a CSV?

In Cost Explorer, set the date range and grouping you want (for example monthly, grouped by service) and use the download CSV option. For line-level detail, set up a Cost and Usage Report export to S3.

## Sources

- [AWS: What are AWS Cost and Usage Reports?](https://docs.aws.amazon.com/cur/latest/userguide/what-is-cur.html)
- [AWS News Blog: New AWS public IPv4 address charge](https://aws.amazon.com/blogs/aws/new-aws-public-ipv4-address-charge-public-ip-insights/)
- [AWS: Gateway endpoints](https://docs.aws.amazon.com/vpc/latest/privatelink/gateway-endpoints.html)
- [AWS: Amazon EBS general purpose volumes](https://aws.amazon.com/ebs/general-purpose/)
- [AWS: Savings Plans](https://aws.amazon.com/savingsplans/)

---

WharfCloud is a trading name of Sunucu Internet Services Consultancy Ltd, registered in England and Wales, company number 12963678. Not VAT registered.
Support: engineers Monday to Friday, 08:00 to 18:00 UK time. Critical incidents: A person responds to critical incidents within 1 hour (Every day, 07:00 to 23:00 UK time). Automated monitoring and automated recovery overnight and at weekends.
Contact: hello@wharfcloud.co.uk · https://wharfcloud.co.uk/contact