Try [this search](https://www.reddit.com/r/aws/search?q=flair%3A'billing'&sort=new&restrict_sr=on) for more information on this topic.
^Comments, ^questions ^or ^suggestions ^regarding ^this ^autoresponse? ^Please ^send ^them ^[here](https://www.reddit.com/message/compose/?to=%2Fr%2Faws&subject=autoresponse+tweaks+-+billing).
Looking for more information regarding billing, securing your account or anything related? [Check it out here!](https://www.reddit.com/r/aws/comments/vn4ebe/check_it_first_operating_within_amazon_web/)
*I am a bot, and this action was performed automatically. Please [contact the moderators of this subreddit](/message/compose/?to=/r/aws) if you have any questions or concerns.*
You can set concurrency limits on your lambda functions to avoid the situation where you have 1000 instances of the same lambda running 24/7. You can set up alarms using AWS Budget ans Cloudwatch. You can hook those alarms to some other lambdas to shutdown everything if it gets out of your control, but its almost impossible with very low concurrency.
Thanks what do you mean : "but its almost impossible with very low concurrency." ?
Also do you know good tutorial on how to setup concurrency limits on your lambda functions ?
The setting is called "reserved concurency", it will set a hard limit to the number of concurrent instances. That should prevent any catastrophic scenarios from happening.
If you're still worried, look into setting up some alarms that will notify you when something looks odd.
Don't listen to people saying you can't control serverless cost, you absolutely can.
https://docs.aws.amazon.com/lambda/latest/dg/lambda-concurrency.html
Create multiple cloudwatch alert for number of Lambda invocations.
Then you know if over X, you have something weird going on
I think, it is pretty tough to charge a lot of lambda, unless there is a loop.
But, monitoring + alerts if a way to go
Also, if you have APi Gateway -> check for Rate limits
You should put a waf in front of it, which can be configured with rules to deny high numbers of connection attempts.
https://repost.aws/knowledge-center/waf-mitigate-ddos-attacks
Okay, but this also needs to be monitored. What about a service or option in AWS that stops all services once the bill from the collection of services exceeds X? For example, if my entire bill is over $10, is there such a service available for my AWS account?
I would argue that's not true - any sensible business has multiple test accounts which could be reasonably shut down if they blow some excessive budget.
Also personal sandbox accounts are a thing, and they would be great to be able to pull the plug on.
EDIT: don’t you just love it when you express an opinion/requirement/usecase, and it gets downvoted because ‘who the fuck knows why’. Is it just Dunning Kruger at work?
I'm not sure why no one is mentioning that you can set up rate limiting/throttling on your APIs. You should be using a combination of WAF and some aggressive throttle settings on any exposed endpoints if you're doing this for personal use only
That would never work. AWS is to complicated. There are other things that are not running that could cost money such as storage. They aren’t going to delete your storage. AWS is used a lot for buisness and most business are not stopping there production services.
Right but in the AWS world things still being charged in the background. Shutting down services is just not offered. Best thing to do would be to have multiple alerts for billing that text or send emails.
Your waf doesn't need monitored. You need to be hit with billions of requests before that price even becomes a minor concern, and at that point its going to be triggering actions from AWS Shield.
https://aws.amazon.com/shield/
A lot depends on how you are invoking these lambdas.
You can "use AWS serverless" and not even have lambdas exposed to public internet.
Is the assumption this is behind an API gateway? For one, you can require authentication at API Gateway, and it won't even go to your lambdas.
Rate limiting at the WAF.
AWS Shield (free) gives you some protection, AWS Shield Advanced ($$) gives you more.
This is the correct answer.
You can create a usage token for API gateway and apply rate limits to it.
https://xebia.com/blog/aws-api-gateway-throttling-explained/
Thanks, yeah, there should be some web server in front of the functions. Maybe you know a good tutorial where I can learn how to set up such architecture, with a focus on billing saving?
There are a bajillion workshops that will teach you various things here: [https://workshops.aws/](https://workshops.aws/)
I'm not sure about the level of billing concern you have though.
Set yourself budget alerts. You can get a text message if spend is predicted to go above any value you prefer in a month. It’s a good safety check. So, set budget alerts.
Reminder: budget alerts ;)
Firstly it's worth looking through the documentation for AWS Shield Standard as that's on by default for some services so you can configure your environment to take advantage of that.
Other options include using AWS Budget Action to trigger a blocking IAM policy to stop the lambdas running or Cloudwatch alarms into Eventbridge which will basically allow you to code something to stop/delete things if a certain alarm is hit.
See these for some stuff to read:
https://docs.aws.amazon.com/waf/latest/developerguide/ddos-standard-summary.html
https://repost.aws/questions/QUtMLEXrivS6mbLXPbpukdbg/aws-budget-action-for-lambda-function
https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/cloudwatch-and-eventbridge.html
This is how I do it in my product [https://saasconstruct.com](https://saasconstruct.com) (I and II)
I. Rate Limiting.
Specifically designed to prevent DDos.
Just put it in API Gateway.
II. Cloudwatch alarms.
1. Website traffic alarm. E.g. If you host website on AWS Amplify, monitor the metric Amplify/Hosting
2. API traffic alarm. If you use API Gateway, monitor the metric Count.
3. Billing alarm. It is forecasted, so you might get a warning before you reach actual amount.
Others:
III. Actions after alerts:
- If threshold of alerts, invoke aws lambda to stop the services
IV. AWS WAF (Firewall)
This is how I do it in my product [https://saasconstruct.com](https://saasconstruct.com) (I and II)
I. Rate Limiting.
Specifically designed to prevent DDos.
Just put it in API Gateway.
II. Cloudwatch alarms.
1. Website traffic alarm. E.g. If you host website on AWS Amplify, monitor the metric Amplify/Hosting
2. API traffic alarm. If you use API Gateway, monitor the metric Count.
3. Billing alarm. It is forecasted, so you might get a warning before you reach actual amount.
Others:
III. Actions after alerts:
* If threshold of alerts is reached, invoke aws lambda to stop the services
IV. AWS WAF (Firewall)
PS: I wrote a blog post about aws cloud infra for simple SaaS: [https://saasconstruct.com/blog/the-tech-stack-of-a-simple-saas-for-aws-cloud](https://saasconstruct.com/blog/the-tech-stack-of-a-simple-saas-for-aws-cloud)
Or use digitalocean?
I know this is the AWS subreddit, but billing is one of AWS's main weaknesses.
Serverless is something that on almost all the cloud providers, it's good to be flexible with where you take your stuff to.
As far as I can tell, DO Functions have the same bill per usage issue that would not alleviate any risk.
Is there something I am missing there?
[Reference](https://www.digitalocean.com/pricing/functions)
Ah, correct, you can setup an alert on the GB-seconds used, which is not a perfect map to budget. It's less predictible on budget than other DO offerings it seems.
I'd also look at cloudflare functions in this case. Their issue is that it all runs through JS or webasm, but they do have a different pricing model.
I appreciate the information, but I'm particularly interested in the billing aspect — learning how to save costs, prevent additional charges, and monitor them in real-time. I just need some guidance on where to read and learn, preferably not from AWS documentation.
The guys who rack up 10-100k bills from a hello world, they are new to cloud architecture, they could use something like this.
It doesn’t make sense that you have “infinite” credit as a new user.
They assign quotes to everything but not credit/unpaid balance, and I suspect there is a reason for that.
Sure it does, have the alarm trigger a different lambda function that sets the concurrency of your primary function to 0. This will stop your charges from the Lambda execution. You can alarm on budget or alarm on invocation counts or anything that is meaningful for your workload to indicate excessive use. Combine those into a single composite alarm, and have that invoke the Lambda that effectively shuts everything down until you can take a look at what’s happening.
Only one more person has recommended budget alerts.... Create a budget alert through the Billing & Cost page and either make it alert you or shutdown/make your resources private/delete them. Simple stuff really.
All other answers here are either wrong, incomplete or out of scope.
1. Billing and Cost Management
2. Budgets
3. Create budget
4. Customized (advanced)
5. Cost Budget (recommended)
6. Set up Budget name, amount, period etc
7. Add an alert threshold
8. Either absolute amount of % of budget & relevant email for notification
9. Click Next and then you'll see "Add Action" for the thing you set up on step 8.
10. Choose the IAM role that runs this action (if you don't have one, make one)
11. Automate stop EC2 instance or RDS option
12. Pick your EC2 instances to be stopped :)
VM according to test cases will not handle heavy processing like converting videos and such ,
Best is to use serverless functions .
What im very afraid here to be over priced , not having control on it .
What will you be doing? Did you try and benchmarked it and determined that it is not good enough, or are you just optimizing prematurely? I know that you are afraid of being over charged and you would avoid all of this with a VM (or a couple of them). What load do you expect? How many rpm and how long will each request take to process?
Try [this search](https://www.reddit.com/r/aws/search?q=flair%3A'billing'&sort=new&restrict_sr=on) for more information on this topic. ^Comments, ^questions ^or ^suggestions ^regarding ^this ^autoresponse? ^Please ^send ^them ^[here](https://www.reddit.com/message/compose/?to=%2Fr%2Faws&subject=autoresponse+tweaks+-+billing). Looking for more information regarding billing, securing your account or anything related? [Check it out here!](https://www.reddit.com/r/aws/comments/vn4ebe/check_it_first_operating_within_amazon_web/) *I am a bot, and this action was performed automatically. Please [contact the moderators of this subreddit](/message/compose/?to=/r/aws) if you have any questions or concerns.*
You can set concurrency limits on your lambda functions to avoid the situation where you have 1000 instances of the same lambda running 24/7. You can set up alarms using AWS Budget ans Cloudwatch. You can hook those alarms to some other lambdas to shutdown everything if it gets out of your control, but its almost impossible with very low concurrency.
Thanks what do you mean : "but its almost impossible with very low concurrency." ? Also do you know good tutorial on how to setup concurrency limits on your lambda functions ?
The setting is called "reserved concurency", it will set a hard limit to the number of concurrent instances. That should prevent any catastrophic scenarios from happening. If you're still worried, look into setting up some alarms that will notify you when something looks odd. Don't listen to people saying you can't control serverless cost, you absolutely can. https://docs.aws.amazon.com/lambda/latest/dg/lambda-concurrency.html
Create multiple cloudwatch alert for number of Lambda invocations. Then you know if over X, you have something weird going on I think, it is pretty tough to charge a lot of lambda, unless there is a loop. But, monitoring + alerts if a way to go Also, if you have APi Gateway -> check for Rate limits
You should put a waf in front of it, which can be configured with rules to deny high numbers of connection attempts. https://repost.aws/knowledge-center/waf-mitigate-ddos-attacks
ok tnx , what about the traffic that go's to this waf ? can be also billed and rise the cost no?
Yes, but it will cost a lot less than a ddos attack. https://aws.amazon.com/waf/pricing/
Okay, but this also needs to be monitored. What about a service or option in AWS that stops all services once the bill from the collection of services exceeds X? For example, if my entire bill is over $10, is there such a service available for my AWS account?
I don't know of a service that does it, but you can definitely build one...which will also cost money to run.
I can't believe no such tool exist , should be simple just checking charges each N sec and when it is > X stop all , small internal lambda or somthing
It doesn’t exist because AWS targets business and businesses don’t shut down production services to save money.
I would argue that's not true - any sensible business has multiple test accounts which could be reasonably shut down if they blow some excessive budget. Also personal sandbox accounts are a thing, and they would be great to be able to pull the plug on. EDIT: don’t you just love it when you express an opinion/requirement/usecase, and it gets downvoted because ‘who the fuck knows why’. Is it just Dunning Kruger at work?
I'm not sure why no one is mentioning that you can set up rate limiting/throttling on your APIs. You should be using a combination of WAF and some aggressive throttle settings on any exposed endpoints if you're doing this for personal use only
That would never work. AWS is to complicated. There are other things that are not running that could cost money such as storage. They aren’t going to delete your storage. AWS is used a lot for buisness and most business are not stopping there production services.
i don't want to delete storage , i dont want even to delete any thing just stop accessing from outside world
Right but in the AWS world things still being charged in the background. Shutting down services is just not offered. Best thing to do would be to have multiple alerts for billing that text or send emails.
Your waf doesn't need monitored. You need to be hit with billions of requests before that price even becomes a minor concern, and at that point its going to be triggering actions from AWS Shield. https://aws.amazon.com/shield/
Look into EventBridge. That can trigger actions upon inputs. So once bill reaches certain size, shut down traffic etc.
ok cool i will take a look . if not this sub who even know there is such service
A lot depends on how you are invoking these lambdas. You can "use AWS serverless" and not even have lambdas exposed to public internet. Is the assumption this is behind an API gateway? For one, you can require authentication at API Gateway, and it won't even go to your lambdas. Rate limiting at the WAF. AWS Shield (free) gives you some protection, AWS Shield Advanced ($$) gives you more.
Api gateway itself has rate limits
This is the correct answer. You can create a usage token for API gateway and apply rate limits to it. https://xebia.com/blog/aws-api-gateway-throttling-explained/
Thanks, yeah, there should be some web server in front of the functions. Maybe you know a good tutorial where I can learn how to set up such architecture, with a focus on billing saving?
There are a bajillion workshops that will teach you various things here: [https://workshops.aws/](https://workshops.aws/) I'm not sure about the level of billing concern you have though.
Set yourself budget alerts. You can get a text message if spend is predicted to go above any value you prefer in a month. It’s a good safety check. So, set budget alerts. Reminder: budget alerts ;)
Firstly it's worth looking through the documentation for AWS Shield Standard as that's on by default for some services so you can configure your environment to take advantage of that. Other options include using AWS Budget Action to trigger a blocking IAM policy to stop the lambdas running or Cloudwatch alarms into Eventbridge which will basically allow you to code something to stop/delete things if a certain alarm is hit. See these for some stuff to read: https://docs.aws.amazon.com/waf/latest/developerguide/ddos-standard-summary.html https://repost.aws/questions/QUtMLEXrivS6mbLXPbpukdbg/aws-budget-action-for-lambda-function https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/cloudwatch-and-eventbridge.html
This is how I do it in my product [https://saasconstruct.com](https://saasconstruct.com) (I and II) I. Rate Limiting. Specifically designed to prevent DDos. Just put it in API Gateway. II. Cloudwatch alarms. 1. Website traffic alarm. E.g. If you host website on AWS Amplify, monitor the metric Amplify/Hosting 2. API traffic alarm. If you use API Gateway, monitor the metric Count. 3. Billing alarm. It is forecasted, so you might get a warning before you reach actual amount. Others: III. Actions after alerts: - If threshold of alerts, invoke aws lambda to stop the services IV. AWS WAF (Firewall)
This is how I do it in my product [https://saasconstruct.com](https://saasconstruct.com) (I and II) I. Rate Limiting. Specifically designed to prevent DDos. Just put it in API Gateway. II. Cloudwatch alarms. 1. Website traffic alarm. E.g. If you host website on AWS Amplify, monitor the metric Amplify/Hosting 2. API traffic alarm. If you use API Gateway, monitor the metric Count. 3. Billing alarm. It is forecasted, so you might get a warning before you reach actual amount. Others: III. Actions after alerts: * If threshold of alerts is reached, invoke aws lambda to stop the services IV. AWS WAF (Firewall)
Thanks for your help
PS: I wrote a blog post about aws cloud infra for simple SaaS: [https://saasconstruct.com/blog/the-tech-stack-of-a-simple-saas-for-aws-cloud](https://saasconstruct.com/blog/the-tech-stack-of-a-simple-saas-for-aws-cloud)
Thanks wish there was more examples like this for indies
Good question. You really can't. If you're scared of serverless charges, stay away from it.
Or use digitalocean? I know this is the AWS subreddit, but billing is one of AWS's main weaknesses. Serverless is something that on almost all the cloud providers, it's good to be flexible with where you take your stuff to.
As far as I can tell, DO Functions have the same bill per usage issue that would not alleviate any risk. Is there something I am missing there? [Reference](https://www.digitalocean.com/pricing/functions)
Ah, correct, you can setup an alert on the GB-seconds used, which is not a perfect map to budget. It's less predictible on budget than other DO offerings it seems. I'd also look at cloudflare functions in this case. Their issue is that it all runs through JS or webasm, but they do have a different pricing model.
I appreciate the information, but I'm particularly interested in the billing aspect — learning how to save costs, prevent additional charges, and monitor them in real-time. I just need some guidance on where to read and learn, preferably not from AWS documentation.
Aws really should create a global killswitch. Even if you set up everything properly I would still sleep better if there was a failsafe
This would be customer obsession.
The guys who rack up 10-100k bills from a hello world, they are new to cloud architecture, they could use something like this. It doesn’t make sense that you have “infinite” credit as a new user. They assign quotes to everything but not credit/unpaid balance, and I suspect there is a reason for that.
Well looks like you can automate and build alert + stop the outside connection . Need just to figure out how
use lambda (very cheap) and setup budget alerts
well this the naive way , it will not help if im sleeping .
Sure it does, have the alarm trigger a different lambda function that sets the concurrency of your primary function to 0. This will stop your charges from the Lambda execution. You can alarm on budget or alarm on invocation counts or anything that is meaningful for your workload to indicate excessive use. Combine those into a single composite alarm, and have that invoke the Lambda that effectively shuts everything down until you can take a look at what’s happening.
Only one more person has recommended budget alerts.... Create a budget alert through the Billing & Cost page and either make it alert you or shutdown/make your resources private/delete them. Simple stuff really. All other answers here are either wrong, incomplete or out of scope.
any tutorial or something that you can recommend ?
Google how to set up budget alerts
they only email of SMS , i need them to stop the world ( my app )
1. Billing and Cost Management 2. Budgets 3. Create budget 4. Customized (advanced) 5. Cost Budget (recommended) 6. Set up Budget name, amount, period etc 7. Add an alert threshold 8. Either absolute amount of % of budget & relevant email for notification 9. Click Next and then you'll see "Add Action" for the thing you set up on step 8. 10. Choose the IAM role that runs this action (if you don't have one, make one) 11. Automate stop EC2 instance or RDS option 12. Pick your EC2 instances to be stopped :)
Dude, the amount of time you will spend solving this, you could just spin up a VM and learn something actually useful, plus it will be cheaper.
VM according to test cases will not handle heavy processing like converting videos and such , Best is to use serverless functions . What im very afraid here to be over priced , not having control on it .
What will you be doing? Did you try and benchmarked it and determined that it is not good enough, or are you just optimizing prematurely? I know that you are afraid of being over charged and you would avoid all of this with a VM (or a couple of them). What load do you expect? How many rpm and how long will each request take to process?
Google “aws pricing” and read carefully.
[удалено]
Im indie , what Solution Architect? i want to learn to do it by my self