"Alert Me, Don't Stop Me"
A common and dangerous misconception is that setting a budget will automatically stop your services when you hit the limit. It does not. AWS Budgets is an alarm system, not a circuit breaker. It sends you a notification so you can log in and take action. The resources keep running and keep charging until you manually intervene — or until you have set up automated remediation (covered below).
Think of it like a smoke detector. It tells you the kitchen is on fire. It does not put the fire out.
Types of AWS Budgets
AWS Budgets supports four budget types:
- Cost Budget: Alert when your dollar spend exceeds a threshold (e.g., "Alert me when I spend more than $5").
- Usage Budget: Alert when you consume more than a specific quantity of a service (e.g., "Alert me when I use more than 700 EC2 hours").
- Savings Plans Budget: Track utilization of committed savings plans.
- Reservation Budget: Track utilization of Reserved Instances.
For learners, Cost Budgets are the most important. Usage Budgets are a useful complement because they can catch Free Tier overruns before they translate into a dollar charge.
The Zero-Spend Budget
Every new account should have a "Zero Spend Budget" created on Day 1, before any other action.
- Threshold: $0.01 (one cent).
- Action: Email your personal address.
If you receive this email, it means you have stepped outside the Free Tier. Maybe you used 751 hours of EC2 (one hour over the limit). Maybe you accidentally launched a paid service. Maybe a script is running in the background that you forgot about. The email is your signal to investigate immediately.
AWS now provides a built-in Zero Spend Budget template in the Budgets console — you do not need to configure the threshold manually.
Budget Actions: The Actual Circuit Breaker
AWS Budgets does support automated responses called Budget Actions. These are optional but powerful:
- IAM Policy Attachment: When the budget threshold is breached, automatically attach a restrictive IAM policy to a user or role (e.g., a policy that denies
ec2:RunInstances). - Service Control Policy (SCP): Apply an SCP to an AWS Organizations account to restrict spending at the organization level.
- EC2/RDS Stop: Directly stop EC2 instances or RDS instances in a specified region.
For a learning account, the most practical action is to attach a "deny all EC2 launch" IAM policy to your own user when the budget hits $5. This prevents you from accidentally launching more resources while you investigate.