EC2-Other: the AWS cost line nobody understands (and where the money leaks)

The label that hides everything

In Cost Explorer, "EC2-Other" is a bucket where AWS dumps EBS, snapshots, data transfer, and NAT Gateway. On a US$5,682 monthly bill, that single line totaled US$896 — and nobody knew what it was made of. Step one is to open it by usage type:

aws ce get-cost-and-usage \
  --time-period Start=2026-02-01,End=2026-03-01 \
  --granularity MONTHLY --metrics UnblendedCost \
  --filter '{"Dimensions":{"Key":"USAGE_TYPE_GROUP","Values":["EC2: EBS - Snapshots","EC2: Data Transfer"]}}' \
  --group-by Type=DIMENSION,Key=USAGE_TYPE --output table

What was leaking

Orphan snapshots — US$343/month. Snapshots from instances that no longer existed were still billed under SnapshotUsage. Deleting them was the biggest one-afternoon saving.

Egress (DataTransfer-Out) — US$305/month. Internet outbound. Putting the origin behind a CloudFront flat-rate (~US$75) would save ~US$612/month — because EC2→CloudFront intra-region is US$0.

gp2 volumes — US$227/month. Migrating gp2 → gp3 cuts ~20% on storage, with no performance loss for most workloads.

Inter-AZ traffic — US$36/month. DataTransfer-Regional-Bytes means EC2 and RDS in different AZs talking to each other. Small here, but it's the signal of a topology anti-pattern.

The naming trap: DataTransfer-Regional-Bytes looks like harmless "regional transfer", but it's the cost of crossing Availability Zones. If it shows up, your app and your database are probably in different AZs.

Order of attack

Orphan snapshots first (immediate saving, zero risk), then gp2→gp3 (cheap and safe), then egress via CloudFront (biggest value, needs an architecture change), and finally review AZ topology. Each item comes from a specific USAGE_TYPE — so the bill stops being a number and becomes a to-do list.

# find snapshots and cross-reference with existing instances
aws ec2 describe-snapshots --owner-ids self \
  --query 'Snapshots[].{Id:SnapshotId,Vol:VolumeId,Size:VolumeSize,Time:StartTime}' --output table
# gp2 volumes that are gp3 candidates
aws ec2 describe-volumes --filters Name=volume-type,Values=gp2 \
  --query 'Volumes[].{Id:VolumeId,Size:Size,AZ:AvailabilityZone}' --output table

Lessons

1. EC2-Other is a black box — open it by USAGE_TYPE. EBS, snapshots, egress, and NAT all live there. Without grouping, you don't know what to cut.

2. A snapshot doesn't die with the instance. Deleted instances leave snapshots billing forever. It's the most common and easiest leak to stop.

3. DataTransfer-Regional-Bytes = cross-AZ cost. It's not "harmless regional"; it's app and database in different AZs.

Conclusion

"Cutting AWS cost" is rarely turning off a server — it's opening the aggregate labels and attacking what leaks. In a single US$896 "EC2-Other" there were US$343 of forgotten snapshots, ~US$612/month recoverable in egress, and ~20% of EBS. The bill doesn't lie; it just arrives aggregated.