# AWS cost guardrails
## The rule
No automation runs in an account without billing alarms. An agent that can launch resources can launch expensive ones.
## Setup
1. In billing preferences, turn on billing alerts (needed before CloudWatch can see charge data).
2. Create a CloudWatch billing alarm on estimated charges in us-east-1. Start with a low threshold; raise it deliberately.
3. Create AWS Budgets with alerts at 50, 80, and 100 percent of expected spend, wired to email or SNS.
4. Tag everything the agent creates: owner, project, and a ttl or purpose tag. Untagged resources get terminated in review.
## Operating discipline
1. Stop, do not just leave running: GPU instances, large RDS instances, NAT gateways, and load balancers cost money while idle.
2. Check CloudWatch metrics before upsizing anything. Bigger is not a fix for a slow query.
3. Review the Cost Explorer weekly for the agent's tagged resources. Surprises get investigated the same day.