Skip to main content
performance · aws

Running T2, T3, T3a and T4g instances with a near-zero CPU credit balance

resource types
1
rule IDs covered
1
severity
medium

What does ZopNight detect here?

ZopNight flags a running t2, t3, t3a or t4g EC2 instance whose `CPUCreditBalance` stays below 5 credits on both average and peak across at least 7 days of the 30-day window. The instance is spending credits as fast as it earns them, so it is throttled or paying surplus charges. The fix adds cost; no saving is claimed.

Signal and threshold

How ZopNight evaluates Running T2, T3, T3a and T4g instances with a near-zero CPU credit balance.
Field Value
Rule IDsRC-188
Categoryperformance
Severitymedium
MetricCPUCreditBalance
Thresholdunder 5 credits (average and peak)
Evaluation window30d
SourceZopNight
Permissions usedec2:DescribeInstances · ec2:DescribeInstanceCreditSpecifications · cloudwatch:GetMetricStatistics

An empty credit balance means throttling or surplus charges

Burstable instances provide a baseline level of CPU with the ability to burst, paid for with CPU credits that each instance earns continuously at a set hourly rate. CPUCreditBalance is the number of credits accrued; it drains when the CPU bursts faster than credits are earned.

What happens at zero depends on the credit mode. In standard mode, CPU utilization is gradually lowered to the baseline level as accrued credits run low. In unlimited mode, the instance spends surplus credits instead, and if average CPU over 24 hours exceeds the baseline you pay a flat rate per vCPU-hour for the extra. T3, T3a and T4g launch as unlimited by default; T2 launches as standard.

Checking the balance and the credit mode

Terminal window
aws cloudwatch get-metric-statistics \
--namespace AWS/EC2 --metric-name CPUCreditBalance \
--dimensions Name=InstanceId,Value=i-0123456789abcdef0 \
--start-time 2026-08-26T00:00:00Z --end-time 2026-09-25T00:00:00Z \
--period 3600 --statistics Average Maximum
aws ec2 describe-instance-credit-specifications --instance-ids i-0123456789abcdef0

Also chart CPUSurplusCreditBalance, which the credit monitoring guide describes as surplus credits spent while CPUCreditBalance is zero.

What pushes an instance onto the list

The instance must be running and its type must start with t2., t3., t3a. or t4g.. The CPUCreditBalance series must have at least 7 days of coverage within the 30-day lookback, and both its average and its maximum must be below 5 credits. Using the maximum matters: an instance that rebuilds a healthy balance overnight and drains it by day is not included, only one that never recovers.

Instances this check ignores

Other burstable families are not evaluated, nor are stopped instances or fixed-performance types. Without enough credit data there is no finding. The check does not read the credit specification, so it flags standard and unlimited instances alike; the fix differs, as the steps below show.

Performance, not savings

There is no savings figure. Every fix costs more: unlimited mode adds surplus charges, and a larger or fixed-performance instance has a higher hourly rate. The point is to stop a workload running slower than it should, or to make surplus charges visible.

Choosing between unlimited mode and a bigger instance

  1. Check CPUCreditBalance and CPUSurplusCreditBalance together to see whether the load is spiky or sustained.
  2. For a standard-mode instance with bursty load, switch to unlimited: aws ec2 modify-instance-credit-specification --instance-credit-specifications "InstanceId=i-0123456789abcdef0,CpuCredits=unlimited".
  3. For sustained high CPU, move to a fixed-performance type such as m5 or c5.
  4. Watch the metrics for a week after the change to confirm the balance recovers or surplus charges stabilise.

See it fire on your bill.

Connect an account read-only. The first findings land in minutes.

472 rule families across 353 resource types on 22 platforms. Every threshold, metric, and IAM action is documented on these pages before you grant anything.

472 rule families documented
353 resource types covered
read-only default access level
Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console· Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console·