The false +687% in your AWS cost report: why any week that crosses day 1 lies

The alarm that wasn't an alarm

An automated cost report comparing week over week fired two red alerts: Route53 +687% and EC2 +34%. The instinct is to hunt what exploded. But week-over-week AWS cost comparison has a structural bias that produces false positives every time the window crosses the first day of the month.

Mechanism 1: monthly charges land on day 1

Several AWS costs post all at once on day 1: No-Upfront Reserved Instances, Route53 Hosted Zones, monthly fees. If your "week" includes day 1, it sums a whole month's charge against a week that didn't — and the comparison blows up.

The proof: looking at real MONTHLY cost instead of the weekly slice, Route53 had DROPPED -8.9% (US$18.00 → US$16.40) and EC2 had DROPPED -19% (US$218.01 → US$176.54, a c5a.large RI that expired). Real BoxUsage variation was < 0.5%. The "+687%" was a window artifact.

# Instead of week-vs-week, compare MONTHLY cost per service:
aws ce get-cost-and-usage \
  --time-period Start=2026-01-01,End=2026-03-01 \
  --granularity MONTHLY --metrics UnblendedCost \
  --group-by Type=DIMENSION,Key=SERVICE --output table

# And separate HeavyUsage (RI) from BoxUsage (on-demand) — only BoxUsage reflects real use:
aws ce get-cost-and-usage --time-period Start=2026-02-01,End=2026-03-01 \
  --granularity MONTHLY --metrics UnblendedCost \
  --filter '{"Dimensions":{"Key":"SERVICE","Values":["Amazon Elastic Compute Cloud - Compute"]}}' \
  --group-by Type=DIMENSION,Key=USAGE_TYPE --output table

Rule of thumb: week-over-week AWS cost comparison is only trustworthy when NEITHER week crosses day 1. Otherwise, look at the monthly.

Mechanism 2: the calendar effect (31-day months)

The second false-positive generator is subtler: months have 28 to 31 days. An On-Demand instance running 24×7 costs proportionally more in March (31 days) than February (28). The proof is arithmetic:

c5.4xlarge On-Demand, 24x7:
  February (28 days): US$456.91
  March projection (31 days): 456.91 × 31/28 = US$505.86
  Actual March: US$505.85   ✓  (the "increase" is just the calendar)

Bonus: the tool that classified Tax as "Cost Explorer"

In the same report, a "Cost Explorer +1865%" item was alarming — it was the tax charge itself, mislabeled by the billing tool as if it were Cost Explorer service usage. Always doubt a cheap service "exploding": it's often misclassification, not new cost. And while you're at it, hunt the real waste — idle Elastic IPs:

aws ec2 describe-addresses \
  --query 'Addresses[?AssociationId==`null`].[PublicIp,AllocationId]' --output table

Lessons

1. A week crossing day 1 always "rises". RIs and Hosted Zones post all at once on day 1. Compare monthly before sounding the alarm.

2. 31-day months inflate On-Demand ~10%. Normalize by day count before crying "it went up".

3. A cheap service "exploding" = misclassification. Tax labeled as Cost Explorer (+1865%) is a tool artifact, not cost.

Conclusion

Automated cost reports are useful right up to the point they become panic generators. Two mechanisms — day-1 billing and the calendar effect — explain virtually every false weekly spike. Before waking the team, two Cost Explorer commands at monthly granularity show the real direction. Here, the bill was DROPPING while the report screamed +687%.