What's actually in a cloud bill

Outcome

By the end of this lesson, you will be able to identify the four line-item categories on any AWS, GCP, or Azure invoice and trace any dollar back to the resource and the usage event that caused it.

New to the cloud? The optional track Cloud, from zero covers the basics first.

1. Concept

A cloud bill is a list of things you rented, and for how long. AWS (Amazon Web Services), GCP (Google Cloud Platform) and Azure (Microsoft’s cloud) are the three big cloud providers, and each sends one. A resource is any one thing you rent from them: a server, a disk, a database.

The idea is that simple. The document is not. A mid-sized company generates hundreds of thousands of separate charges in a month. The detailed file AWS provides for a single account, the Cost and Usage Report (CUR: a spreadsheet-like file with one row per charge), can reach 10 GB. Few people read it end to end. Most scan it, give up, and rely on a dashboard (a screen of summary charts) that has already made the interesting decisions for them.

There is a shortcut, and it holds on every provider. Every charge on a cloud bill is one of four things. Learn the four and you can read any bill without the dashboard deciding for you.

The four things you are ever charged for

1. Time something was running. You are charged for the hours a machine existed and was switched on. Stop it and this charge stops; note that the disk attached to it does not.

Servers are the obvious case. A virtual machine (VM) is a server you rent by the hour; AWS calls it EC2, Google calls it Compute Engine, Azure calls it Virtual Machines. So are the machines underneath a Kubernetes cluster (software that runs many applications across a group of servers), and so are short-lived functions such as AWS Lambda, which run a piece of code on demand and bill per run. The hourly rate depends on four things. The size of the machine, the region it runs in (a region is a geographic location of the provider’s data centres, such as Northern Virginia), the operating system it carries, and whether you committed in advance to using it for a year or more.

2. Bytes you are storing. Charged per gigabyte per month, whether or not anything reads them.

Files kept in S3, Cloud Storage or Blob Storage, the providers’ file-storage services. The disks attached to your servers. The space a database occupies. Backups, and snapshots, which are copies of a disk preserved at a moment in time. Providers offer cheaper tiers for data you rarely touch, at the cost of slower retrieval.

3. Bytes you moved. Charged per gigabyte for data crossing a boundary.

Traffic leaving for the public internet, called egress, is the most expensive kind, and it is the line that surprises finance teams most often. You also pay to replicate data between regions, and to move it between two data centres inside the same region. That last one catches people. Traffic between availability zones is charged on AWS and Google. On AWS it is roughly $0.01 per GB out plus $0.01 per GB in; Google charges about $0.01 per GB. Only traffic that stays inside one zone is free. Azure is the exception: it stopped charging for traffic between its zones in May 2024.

An availability zone is a discrete data centre inside a region; a region normally has three or more.

4. Requests you made. Some services charge per operation rather than per hour.

Every read and write against S3. Every function invocation. Every message on a queue. Every metric your monitoring ingests. Each is a fraction of a cent, which is precisely why the category goes unexamined until it is material.

All four, at a glance

┌─────────────────────────────────────────────────────────┐
│  YOUR CLOUD BILL: 4 line item categories                │
├──────────────────┬──────────────────────────────────────┤
│  COMPUTE TIME    │  EC2 / GCE / Azure VMs               │
│  ~40-60% typical │  K8s nodes · ECS · Lambda            │
│                  │  Cloud Functions · Container Inst.   │
├──────────────────┼──────────────────────────────────────┤
│  STORED BYTES    │  S3 / GCS / Blob Storage             │
│  ~15-30% typical │  EBS / PD / Managed Disks            │
│                  │  RDS storage · snapshots · archives  │
├──────────────────┼──────────────────────────────────────┤
│  MOVED BYTES     │  inter-region replication            │
│  ~5-20% typical  │  internet egress · NAT GW data-proc  │
│                  │  cross-AZ traffic (AWS, GCP), CDN    │
├──────────────────┼──────────────────────────────────────┤
│  API REQUESTS    │  Lambda invocations · S3 GET / PUT   │
│  ~5-15% typical  │  DynamoDB RCU / WCU · Cosmos RUs     │
│                  │  CloudWatch ingestion · queue ops    │
└──────────────────┴──────────────────────────────────────┘

Those percentages move a lot depending on what you run. A company running mostly Kubernetes lands around 60% on compute. An analytics pipeline keeping raw and processed copies of everything can reach 35% on storage. A product serving users worldwide from one region can reach 25% on moved bytes. A product built entirely on functions can put 30% into requests.

One server, several charges

This is the distinction most cost conversations get wrong.

A row on the bill is not the same thing as a resource. One server produces a charge for its running time. Another for the disk attached to it. Another for the backups of that disk. Another for the data it sent out, and another for the monitoring it emitted. Five or six rows. One machine.

So the question “what does this server cost?” gets answered with the hourly rate times 720 hours. That answers one category and ignores three. On a typical production server the other three add 25 to 60 percent on top.

The price on the page, and the price you paid

Every row carries a unit price taken from the provider’s public price list. That published number is the rack rate: the list price, like the price on a shop shelf, before anything you negotiated.

What you actually pay is usually lower, because of commitments (promising the provider a year or more of usage in return for a lower rate), discounts agreed with the provider, or cheap interruptible capacity (spare machines the provider can take back at short notice, called Spot on AWS). The gap between the two is your effective discount.

Both numbers matter, and most tools report only what you paid. That looks helpful and conceals something: if you switch off a machine that was billing at full price, the money you stop spending is the full price. Report a saving at what the resource was actually costing, not at the discounted figure, or your own reporting will understate the work.

2. Demo

Each provider has a console, the website where you manage your account, and inside it a cost tool. If you have access, open it: AWS Cost Explorer, or Google Cloud Console → Billing → Reports, or Azure Portal → Cost Management → Cost Analysis. If you do not, read along with the example below.

Filter to one server you recognise, one that ran all month. Group the results by Usage Type (the provider’s label for what kind of usage a row is). You will get somewhere between four and eight rows. Read each row name and put it in one of the four categories.

Here is a real example, one m5.large server (a mid-sized AWS machine type) in the us-east-1 region (Northern Virginia):

The real total is $96.90. The figure usually quoted, the server row alone, is $69.20: 71% of the true cost. The missing 29% was on the same screen the whole time.

3. Hands-on (5 min: uses your bill, not a product)

1. Open last month's cloud bill. Any provider.
2. Pick one resource you recognise and know ran all month.
3. Find every row belonging to it. Search by its name or ID.
4. Sort those rows into the four categories. Write down four numbers.
5. Add them up, then compare the total to what you assumed it cost.

If the gap is more than 25%, that gap is what your estimates have been missing. Note which of the four categories surprised you most: that is where to look first when you start cutting, and it is usually the same category twice.

Optional, if you have AWS access: you can pull similar numbers from the AWS CLI, the command-line tool for AWS. UnblendedCost means the cost as charged on the day, with no spreading of prepaid discounts. Per-resource cost needs get-cost-and-usage-with-resources, which only works once resource-level data is switched on in Cost Explorer settings and only covers the last 14 days. For a full month, query the CUR by line_item_resource_id. The command below returns the server’s own compute rows only: its disks, snapshots and data transfer are reported under EC2 - Other, and disks and snapshots carry their own resource IDs, so the CUR is the easier way to see all four categories.

aws ce get-cost-and-usage-with-resources \
  --time-period Start=2026-05-06,End=2026-05-20 \
  --granularity DAILY \
  --metrics UnblendedCost \
  --group-by Type=DIMENSION,Key=USAGE_TYPE \
  --filter '{"And":[
              {"Dimensions":{"Key":"SERVICE","Values":["Amazon Elastic Compute Cloud - Compute"]}},
              {"Dimensions":{"Key":"RESOURCE_ID","Values":["i-0abc123def456"]}}
            ]}'

Or in the AWS console (same 14-day limit, daily view): Cost Explorer → Reports → New report → Group by Usage Type → Filter by Resource = <your instance ID>.

Ask for it instead. The same task, asked in one sentence to an AI assistant connected to ZopNight (the cost platform these lessons are built around).

BEFORE  A ZopNight account with one cloud connected. Billing needs one full month synced before the numbers mean anything.
ASK     "What did we spend last month, broken down by provider and by service?"
CHECK   the totals against the bill you just opened. If they disagree you are reading two different cost bases, which is M0.4.

Tools behind it: get_cost_overview (read, Cost), get_cost_breakdown (read, Cost), get_cost_by_provider (read, Cost). Connection details are in the MCP integration docs.

4. Knowledge check

Q1

Your m5.large EC2 instance shows $122 in EC2 charges last month. What is the most accurate estimate of what that instance actually costs your business?

A. Exactly $122, since that is the only figure the bill prints against it
B. Less than $122, because a reserved instance discount probably applies
C. 25 to 60 percent higher: its disks, snapshots, network and monitoring bill too
D. Impossible to say without far more data than the bill itself can show

Q2

A workload’s bill is 25% moved bytes. Which is most likely true? (A NAT Gateway is an AWS device that lets private servers reach the internet, and charges per GB.)

A. The estate runs mostly on cheap interruptible capacity bought from the provider
B. The estate is mostly Kubernetes clusters, with many small services on each
C. It copies data across regions, serves the world from one, or uses a NAT Gateway
D. The estate is built on serverless functions that bill per run, not per hour

Q3

Somebody says “killing this idle server will save us $69 a month.” What is the most accurate reply?

A. Agreed: $69 a month is the full saving to report to finance
B. More, nearer $90 to $110, once its disk, snapshots and monitoring go
C. It saves nothing, because a reserved instance already covers that machine
D. It cannot be turned off, because production systems depend on it

5. Apply

The four categories are how you read any bill, on any provider, with or without a tool. What a cost platform adds is the arithmetic across categories, done for every resource, continuously.

In ZopNight that surfaces in two places:

• Costs → Flow cascades spend from provider to account, region, service, resource type, purchase type and team, so you can see where the money goes and drill in. The diagram is a Sankey: bands whose width is the amount of money, splitting as they move left to right.
• Cloud Estate → Inventory lists every discovered resource with its cost, which is the number that matters when deciding whether to keep something alive.

The stopped-server rule (RC-001) shows why the other categories matter. It fires on a server that has been stopped for 30 days or more. A stopped server bills no compute, so the saving it reports is what keeps billing anyway: the attached disks and any Elastic IP (a fixed public internet address) still tied to the server.

Open ZopNight Costs → Reports (deep link will resolve once you’re logged in)

Related lessons

• L2, CUR, Cost Explorer, Cost Management, BigQuery, pick one (next)
• T0.M0.4.L1: What “rack rate” actually means
• T0.M0.5.L1: AWS cost surface: services that print money

Rule references

• RC-001 Idle EC2 Instance: an instance stopped for 30+ days; the saving is its attached disks and Elastic IP, not compute
• RC-002 Orphaned EBS Volume: catches stored bytes that survive after compute is gone

Glossary terms touched

Rack rate · Effective discount · Egress · NAT Gateway · API request charge