What's actually in a cloud bill

Outcome

By the end of this lesson, you will be able to identify the four line-item categories on any AWS, GCP, or Azure invoice and trace any dollar back to the resource and the usage event that caused it.

1. Concept

A cloud bill is a list of things you rented, and for how long.

The idea is that simple. The document is not. A mid-sized company generates hundreds of thousands of separate charges in a month. The detailed file AWS provides for a single account, the Cost and Usage Report, can reach 10 GB. Few people read it end to end. Most scan it, give up, and rely on a dashboard that has already made the interesting decisions for them.

There is a shortcut, and it holds on every provider. Every charge on a cloud bill is one of four things. Learn the four and you can read any bill without the dashboard deciding for you.

The four things you are ever charged for

1. Time something was running. You are charged for the hours a machine existed and was switched on. Stop it and this charge stops; note that the disk attached to it does not.

Servers are the obvious case: EC2 on AWS, Compute Engine on Google, Virtual Machines on Azure. So are the nodes underneath a Kubernetes cluster, and so are short-lived functions such as Lambda. The hourly rate depends on four things. The size of the machine, the region it runs in, the operating system it carries, and whether you committed in advance to using it for a year or more.

2. Bytes you are storing. Charged per gigabyte per month, whether or not anything reads them.

Objects in S3, Cloud Storage or Blob Storage. The disks attached to your servers. The space a database occupies. Backups, and snapshots, which are copies of a disk preserved at a moment in time. Providers offer cheaper tiers for data you rarely touch, at the cost of slower retrieval.

3. Bytes you moved. Charged per gigabyte for data crossing a boundary.

Traffic leaving for the public internet is the most expensive kind, and it is the line that surprises finance teams most often. You also pay to replicate data between regions, and to move it between two data centres inside the same region. That last one catches people. Traffic between availability zones is charged on AWS, Google and Azure alike. Roughly $0.01 per GB, in each direction. Only traffic that stays inside one zone is free.

An availability zone is a discrete data centre inside a region; a region normally has three or more.

4. Requests you made. Some services charge per operation rather than per hour.

Every read and write against S3. Every function invocation. Every message on a queue. Every metric your monitoring ingests. Each is a fraction of a cent, which is precisely why the category goes unexamined until it is material.

All four, at a glance

┌─────────────────────────────────────────────────────────┐
│  YOUR CLOUD BILL: 4 line item categories                │
├──────────────────┬──────────────────────────────────────┤
│  COMPUTE TIME    │  EC2 / GCE / Azure VMs               │
│  ~40-60% typical │  K8s nodes · ECS · Lambda            │
│                  │  Cloud Functions · Container Inst.   │
├──────────────────┼──────────────────────────────────────┤
│  STORED BYTES    │  S3 / GCS / Blob Storage             │
│  ~15-30% typical │  EBS / PD / Managed Disks            │
│                  │  RDS storage · snapshots · archives  │
├──────────────────┼──────────────────────────────────────┤
│  MOVED BYTES     │  inter-region replication            │
│  ~5-20% typical  │  internet egress · NAT GW data-proc  │
│                  │  cross-AZ traffic (all clouds), CDN  │
├──────────────────┼──────────────────────────────────────┤
│  API REQUESTS    │  Lambda invocations · S3 GET / PUT   │
│  ~5-15% typical  │  DynamoDB RCU / WCU · Cosmos RUs     │
│                  │  CloudWatch ingestion · queue ops    │
└──────────────────┴──────────────────────────────────────┘

Those percentages move a lot depending on what you run. A company running mostly Kubernetes lands around 60% on compute. An analytics pipeline keeping raw and processed copies of everything can reach 35% on storage. A product serving users worldwide from one region can reach 25% on moved bytes. A product built entirely on functions can put 30% into requests.

One server, several charges

This is the distinction most cost conversations get wrong.

A row on the bill is not the same thing as a resource. One server produces a charge for its running time. Another for the disk attached to it. Another for the backups of that disk. Another for the data it sent out, and another for the monitoring it emitted. Five or six rows. One machine.

So the question “what does this server cost?” gets answered with the hourly rate times 720 hours. That answers one category and ignores three. On a typical production server the other three add 25 to 60 percent on top.

The price on the page, and the price you paid

Every row carries a unit price taken from the provider’s public price list. That published number is the rack rate: the list price, before anything you negotiated.

What you actually pay is usually lower, because of commitments made in advance, discounts agreed with the provider, or cheap interruptible capacity. The gap between the two is your effective discount.

Both numbers matter, and most tools report only what you paid. That looks helpful and conceals something: if you switch off a machine that was billing at full price, the money you stop spending is the full price. Report a saving at what the resource was actually costing, not at the discounted figure, or your own reporting will understate the work.

2. Demo

Open your provider’s cost tool: AWS Cost Explorer, or Google Cloud Console → Billing → Reports, or Azure Portal → Cost Management → Cost Analysis.

Filter to one server you recognise, one that ran all month. Group the results by Usage Type. You will get somewhere between four and eight rows. Read each row name and put it in one of the four categories.

Here is a real example, one m5.large server in the us-east-1 region:

The real total is $96.90. The figure usually quoted, the server row alone, is $69.20: 71% of the true cost. The missing 29% was on the same screen the whole time.

(Annotated screenshot: production team to capture this exact view with orange callouts on each row tagging the category. Asset path: assets/screenshots/M0.1_L1_cost_explorer_one_instance.png.)

3. Hands-on (5 min: uses your bill, not a product)

1. Open last month's cloud bill. Any provider.
2. Pick one resource you recognise and know ran all month.
3. Find every row belonging to it. Search by its name or ID.
4. Sort those rows into the four categories. Write down four numbers.
5. Add them up, then compare the total to what you assumed it cost.

If the gap is more than 25%, that gap is what your estimates have been missing. Note which of the four categories surprised you most: that is where to look first when you start cutting, and it is usually the same category twice.

You can pull the same numbers from the AWS CLI:

aws ce get-cost-and-usage \
  --time-period Start=2026-04-01,End=2026-05-01 \
  --granularity MONTHLY \
  --metrics UnblendedCost \
  --group-by Type=DIMENSION,Key=USAGE_TYPE \
  --filter '{"Dimensions":{"Key":"RESOURCE_ID","Values":["i-0abc123def456"]}}'

Or in the console: Cost Explorer → Reports → New report → Group by Usage Type → Filter by Resource = <your instance ID>.

Ask for it instead. The same task you just did in the console, asked in one sentence.

BEFORE  A ZopNight account with one cloud connected. Billing needs one full month synced before the numbers mean anything.
ASK     "What did we spend last month, broken down by provider and by service?"
CHECK   the totals against the bill you just opened. If they disagree you are reading two different cost bases, which is M0.4.

Tools behind it: get_cost_overview (read, Cost), get_cost_breakdown (read, Cost), get_cost_by_provider (read, Cost). The full catalogue is at zop.dev/learn/mcp-tools.

4. Knowledge check

Q1

Your m5.large EC2 instance shows $122 in EC2 charges last month. What is the most accurate estimate of what that instance actually costs your business?

A. Exactly $122, since that is the figure printed against it
B. Less than $122, because a reserved instance discount applies here
C. Likely 25 to 60 percent higher, because disks, snapshots, network and monitoring also charge against it
D. Impossible to say without a good deal more data than the bill shows

Q2

A workload’s bill is 25% moved bytes. Which is most likely true?

A. The estate runs mostly on cheap interruptible capacity
B. The estate is mostly Kubernetes
C. It copies data between regions, serves global users from one region, or routes egress through a NAT Gateway
D. The estate is built on serverless functions

Q3

Somebody says “killing this idle server will save us $69 a month.” What is the most accurate reply?

A. Agreed, and that is the full saving to report
B. The saving is larger, nearer $90 to $110, once its disk, snapshots and monitoring go too
C. It saves nothing, because a reserved instance already covers that machine
D. It cannot be turned off, because production depends on it

5. Apply

The four categories are how you read any bill, on any provider, with or without a tool. What a cost platform adds is the arithmetic across categories, done for every resource, continuously.

In ZopNight that surfaces in three places:

• Reports → Cost Breakdown splits one resource across the four categories, with the amount per row.
• Reports → Cost Breakdown → Flow cascades from provider to account to service to type, so you can see the four categories per dimension and drill in. The diagram is a Sankey: bands whose width is the amount of money, splitting as they move left to right.
• Reports → Resources lists every resource with its total lifetime cost across all four categories, which is the number that matters when deciding whether to keep something alive.

The idle-server rule (RC-001) calculates savings from the full cost, compute plus storage plus snapshots, rather than the compute row alone. That is the figure that survives being checked by finance.

Open ZopNight Reports → (deep link will resolve once you’re logged in)

Related lessons

• L2, CUR, Cost Explorer, Cost Management, BigQuery, pick one (next)
• T0.M0.4.L1: What “rack rate” actually means
• T0.M0.5.L1: AWS cost surface: services that print money

Rule references

• RC-001 Idle EC2 Instance: uses the full-cost rollup, not just the EC2 row
• RC-002 Orphaned EBS Volume: catches stored bytes that survive after compute is gone

Glossary terms touched

Rack rate · Effective discount · Egress · NAT Gateway · Snapshot · gp3 · API request charge