Denshin / Blog / DevOps
The small AWS charges that quietly add up on small projects
Public IPv4 addresses, idle NAT gateways, log groups that never expire, forgotten stacks and incomplete multipart uploads. The small line items we find most often in small AWS accounts, and the one budget alert that catches them.
Denshin Engineering · Engineering Team · 11 October 2026 · 3 min read
Big AWS bills get attention. The ones that hurt small projects are the three and four dollar line items nobody chose, multiplied across environments and left running for a year. These are the ones we find most often when a client asks us to look over their account.
Public IPv4 addresses
Since February 2024 AWS charges for every public IPv4 address, at $0.005 an hour, about $3.60 a month each. That includes addresses on running instances, load balancers and NAT gateways, and Elastic IPs allocated but attached to nothing. A modest setup with a load balancer across two availability zones, a NAT gateway and a couple of instances can carry five or six. Release idle Elastic IPs, and use Public IP Insights in VPC IPAM to see where the rest are.
NAT gateways
A NAT gateway costs around $0.045 an hour in us-east-1, plus about $0.045 per GB processed, and the hourly part runs whether any traffic passes or not. Rates differ by region, Mumbai included, so check the pricing page for yours. That is over $30 a month per gateway before any data, per environment. Gateway endpoints for S3 and DynamoDB are free and keep that traffic off the NAT. Better still, many small apps, such as Lambda functions that only talk to AWS services and public APIs, do not need to sit in a VPC at all.
Logs that never expire
CloudWatch log groups created by Lambda, API Gateway and most other services default to never expiring. Storage is cheap per GB, so it takes a while to notice, and then you have three years of debug output. Set retention on every log group, 14 or 30 days is enough for application logs on most projects, and set it in your infrastructure code so new functions get it too. If personal data ever ends up in those logs, shorter is better for compliance as well, since India's DPDP Rules expect you to stop keeping personal data you no longer need.
Things left behind
- Dev and staging stacks for a feature that shipped six months ago.
- EBS volumes that outlived their instance, and snapshots nobody remembers taking.
- Incomplete multipart uploads in S3. They are billed as storage but do not show in a normal listing. A lifecycle rule that aborts them after seven days fixes it.
- Old object versions in buckets where someone switched on versioning and never added a lifecycle rule.
CloudFront invalidations
The first 1,000 invalidation paths a month are free, then it is $0.005 per path, and a wildcard counts as one path. A deploy script that invalidates every file by name can eat the allowance fast. Hashed asset filenames plus /*, or a short list of entry points, is cheaper and simpler. Our setup is in S3 and CloudFront for an admin heavy SPA.
The setting that catches all of it
Create a monthly budget with an alert at around 80% of what you expect to spend. It takes two minutes in the Billing console, and in our experience it is the only reason most of the above ever gets noticed. Cost Explorer grouped by usage type will then tell you which of these you have.
None of these is a big number alone. But on a project whose whole architecture costs a few dollars a month to run, one forgotten NAT gateway can be most of the bill. Prices above are AWS list prices as of October 2026.
Tags: AWS, Cloud Costs, CloudWatch, Infrastructure
All posts · Work with Denshin