Running T2, T3, T3a and T4g instances with a near-zero CPU credit balance
What does ZopNight detect here?
ZopNight flags a running t2, t3, t3a or t4g EC2 instance whose `CPUCreditBalance` stays below 5 credits on both average and peak across at least 7 days of the 30-day window. The instance is spending credits as fast as it earns them, so it is throttled or paying surplus charges. The fix adds cost; no saving is claimed.
Signal and threshold
| Field | Value |
|---|---|
| Rule IDs | RC-188 |
| Category | performance |
| Severity | medium |
| Metric | CPUCreditBalance |
| Threshold | under 5 credits (average and peak) |
| Evaluation window | 30d |
| Source | ZopNight |
| Permissions used | ec2:DescribeInstances · ec2:DescribeInstanceCreditSpecifications · cloudwatch:GetMetricStatistics |
Where it applies
An empty credit balance means throttling or surplus charges
Burstable instances provide a
baseline level of CPU with the ability to burst,
paid for with CPU credits that each instance earns continuously at a set hourly rate. CPUCreditBalance is the number
of credits accrued; it drains when the CPU bursts faster than credits are earned.
What happens at zero depends on the credit mode. In standard mode, CPU utilization is gradually lowered to the baseline level as accrued credits run low. In unlimited mode, the instance spends surplus credits instead, and if average CPU over 24 hours exceeds the baseline you pay a flat rate per vCPU-hour for the extra. T3, T3a and T4g launch as unlimited by default; T2 launches as standard.
Checking the balance and the credit mode
aws cloudwatch get-metric-statistics \ --namespace AWS/EC2 --metric-name CPUCreditBalance \ --dimensions Name=InstanceId,Value=i-0123456789abcdef0 \ --start-time 2026-08-26T00:00:00Z --end-time 2026-09-25T00:00:00Z \ --period 3600 --statistics Average Maximum
aws ec2 describe-instance-credit-specifications --instance-ids i-0123456789abcdef0Also chart CPUSurplusCreditBalance, which the
credit monitoring guide
describes as surplus credits spent while CPUCreditBalance is zero.
What pushes an instance onto the list
The instance must be running and its type must start with t2., t3., t3a. or t4g.. The
CPUCreditBalance series must have at least 7 days of coverage within the 30-day lookback, and
both its average and its maximum must be below 5 credits. Using the maximum matters: an instance
that rebuilds a healthy balance overnight and drains it by day is not included, only one that never
recovers.
Instances this check ignores
Other burstable families are not evaluated, nor are stopped instances or fixed-performance types. Without enough credit data there is no finding. The check does not read the credit specification, so it flags standard and unlimited instances alike; the fix differs, as the steps below show.
Performance, not savings
There is no savings figure. Every fix costs more: unlimited mode adds surplus charges, and a larger or fixed-performance instance has a higher hourly rate. The point is to stop a workload running slower than it should, or to make surplus charges visible.
Choosing between unlimited mode and a bigger instance
- Check
CPUCreditBalanceandCPUSurplusCreditBalancetogether to see whether the load is spiky or sustained. - For a standard-mode instance with bursty load, switch to unlimited:
aws ec2 modify-instance-credit-specification --instance-credit-specifications "InstanceId=i-0123456789abcdef0,CpuCredits=unlimited". - For sustained high CPU, move to a fixed-performance type such as m5 or c5.
- Watch the metrics for a week after the change to confirm the balance recovers or surplus charges stabilise.