Nobody catches a cloud bill by reading it — by the time the invoice lands, the spike ran for a month. The honest runbook has four parts: triage by top movers before you change anything, know the usual suspects, put free guardrails in place so the next spike pages you instead of the invoice, and rehearse a 30-minute path from spike to fix.
1. Triage by top movers, not by guesswork
Before you delete anything, answer one question: what changed between last month and this month? Every major provider has a cost explorer; sort by absolute dollar change, not percentage (a 900% jump on a $2 service is noise next to a 30% jump on compute):
Look at
How
What it tells you
Cost by service, change vs. prior month
Cost explorer, sorted by $ delta
The 1–3 line items that produced the spike
Cost by tag (team/service/env)
Tag breakdown on the same window
Who owns the mover — and whether it was deliberate
One resource, daily granularity
Drill into the top mover, day-by-day
The date it started — which maps to a deploy, a campaign, or a stuck job
Resist the urge to "optimize" before this step. Teams that start by deleting things delete the wrong things.
2. The usual suspects (small-team edition)
In a decade of bills, the spike almost always lives in one of these — all boring, all preventable:
Egress + NAT gateway. Traffic you didn't notice: big downloads, public assets served from the wrong place, or a NAT gateway charging per GB for the privilege of reaching the internet.
Logs nobody set a retention on. Application logs, flow logs, and request logs defaulting to forever. A chatty microservice can out-earn the instance it runs on.
Retry storms. A slow dependency makes every caller retry ×3; retries make the dependency slower; the bill multiplies while the outage is still "loading".
The forgotten monster. Load test environments left up, a snapshot job that snapshots snapshots, dev instances sized like prod. They never get caught because nobody looks at dev.
A success you didn't budget for. A viral week or a new customer is the good spike — but it still needs a decision: absorb it, resize to reserved capacity, or move heavy assets to a CDN/edge so you stop paying per-pull.
3. Guardrails that cost nothing
Budget alert with a forecast condition. Not just "over $X" — "forecast to hit $Y" alerts while you can still change course. One notification per day, to a channel people actually read.
One anomaly alert per account. Provider anomaly detection is free on most plans; a single alert on total daily spend catches the patterns budgets miss.
Tag or die. Untagged resources are unattributable spend. A simple owner/service tag policy + a weekly untagged-spend report is half the battle.
Auto-stop the obviously ephemeral. Scheduled shutdown for dev/test instances and preview environments. Nobody needs a Saturday-night database cluster they forgot about.
4. The 30-minute triage path
Minutes 0–5: Cost explorer, sorted by dollar change vs. prior period. Write down the top 3 movers.
Minutes 5–10: For each mover, drill to daily granularity and find the start date. Map the date to deploys, launches, or config changes that day.
Minutes 10–20: Kill or fix the actual cause: stop the forgotten instance, set log retention to 30 days, add the missing cache, move public assets off per-pull egress.
Minutes 20–30: Add the guardrail that would have caught this: the budget forecast alert, the anomaly alert, or the retention setting. One guardrail per incident is the rule — that's how the checklist grows without becoming a project.
5. The mistakes that turn a spike into a habit
Cutting capacity during a growth spike. If the cause is revenue, the fix is efficiency (reservations, caching, right-sizing) — not deleting the workload that earned the money.
Alerting on "spend > $X" only. Hard caps are for runaway resources; forecasts are for trends. You need both, and the forecast matters more.
Treating it as finance's problem. The bill is an engineering output: chatty services, unbounded logs, and retry storms are code decisions. Put the top movers in the next retro.
Doing this once a quarter, by hand. The teams that stay ahead look at daily spend for five minutes every week — usually as a scripted check, not a meeting.
Takeaways
Triage by top movers before touching anything. Dollar change, tagged by owner, drilled to the start date.
The spike lives in the boring places: egress, NAT, logs without retention, retry storms, forgotten dev monsters.
Guardrails are free: forecast budget alerts, one anomaly alert, tag discipline, auto-stop for ephemeral environments.
---
The Automation Starter Pack ($19) turns the weekly five-minute spend review, the retention sweep, and the ephemeral-environment shutdown into pick-first workflows that run themselves — which is exactly what this runbook needs to stop being manual. Ops Starter Kit ($14) covers the incident side; Vol. 2 ($27) adds the DR plan and evidence log. Launch week: 30% off any paid kit with code HIVE-LAUNCH30 at checkout (ends Sep 11, 23:30 ACST).