All cheat sheets
Cost Governancecheat sheet

AWS Free Tier

The Free Tier is three different things — 12-month, Always Free, and trials — and knowing which is which is the difference between a permanently-free serverless stack and a $480 month-13 surprise. Plus the un-free traps (NAT Gateway, ALB, unattached EIPs) that bite new accounts.

Last reviewed: July 14, 2026

Prefer step by step? Take the guided AWS Free Tier walkthrough — free, anonymous, interactive.Have an AI assistant? Jump to the copy-paste audit prompt at the bottom of this sheet.

TL;DR: "The free tier" is three things, and conflating them is how people get hurt. 12-Month Free (750 hrs t3.micro EC2, 5 GB S3, db.t3.micro RDS) ends on your account's first anniversary. Always Free (1M Lambda requests, 25 GB DynamoDB, 1 TB CloudFront egress, 50K Cognito MAUs) is permanent. Trials are time-boxed per service. The two failure modes: cliff-diving into a month-13 bill when 12-month items expire, and paying for "un-free" traps (NAT Gateway, ALB, unattached EIPs) that were never free at all. Instrument the account as if the free tier doesn't exist.

The numbers

  • 12-Month → expires at anniversary: t2/t3.micro EC2 ($7.50/mo after), db.t3.micro RDS ($15–20/mo with 20 GB), 30 GB EBS, 5 GB S3, 1M API Gateway calls, ElastiCache/OpenSearch/MQ micro hours.
  • Always Free → permanent: Lambda 1M requests + 400K GB-s, DynamoDB 25 GB + 25 RCU/WCU, CloudFront 1 TB egress + 10M requests, Cognito 50K MAU, SQS 1M, Step Functions 4K transitions.
  • The un-free traps: NAT Gateway ~$32/mo + $0.045/GB (×AZ count), ALB/NLB ~$16–25/mo each, Elastic IP billed $0.005/hr while unassociated or on a stopped instance, CloudWatch Logs $0.50/GB ingest (no free tier), Secrets Manager $0.40/secret, KMS CMK $1/mo, Route 53 zone $0.50/mo.
  • New-account Free Plan: 6 months or $200 credits, whichever first — treat the dollar figure as a real ceiling.
  • Field examples: a bootcamp grad's single NAT Gateway ran up $480 in three weeks (AWS credited it as a first-time gesture); a side project hit a $32/mo month-13 baseline when all 12-month items expired together, later rebuilt serverless to $0.85/mo.

Do this

  1. Set a $5 AWS Budget with alerts on day one — the single most important step; five dollars is well below where real damage happens.
  2. Enable Free Tier usage alerts (Billing preferences, email at 85% of any limit) and add a free Cost Anomaly Detection monitor.
  3. Tear down every tutorial — they don't clean up after themselves and happily leave a $32/mo NAT Gateway behind; prefer VPC endpoints over NAT in the learning phase.
  4. Before the anniversary, audit the Billing → Free Tier page — anything in the 12-month column is about to bill; decide keep/downgrade/delete and snapshot before deleting.
  5. For permanently-free "production," go serverless — Lambda + DynamoDB + CloudFront + Cognito avoids the EC2 anniversary and the ALB/NAT traps; realistic cost ~$0.50–3/mo for a Route 53 zone and small logs.

Gotchas

  • Month 13 is the classic surprise — only the 12-month items expire; DynamoDB and Lambda stay free, so people wrongly assume everything flips (or wrongly assume nothing does).
  • Stopping a free-tier EC2 instance over the weekend converts its "free" Elastic IP into a paid one — EIPs are free only while attached to a running instance.
  • Small-object S3 and chatty apps are dominated by request and log-ingestion charges, not storage — easy to overlook.
  • Surprise bills are often reversible — AWS is generous with first-time accidental charges; open a factual billing case (account age, what happened, amount).

Skip this if

  • You're past small-scale — the free tier saves money on the first ~$20–50/mo only; beyond that the levers are rightsizing, Reserved Instances, and architecture, not chasing free-tier qualification.
  • You just need the alerting that makes the free tier a measured guarantee — that's AWS Budgets plus Cost Anomaly Detection; set them before you rely on the free tier.

Run this audit with your AI assistant

Paste this into Claude, ChatGPT, or any agent that can run the AWS CLI with read-only credentials. It audits your account for exactly the waste this sheet describes — and changes nothing.

You are auditing an AWS account for Free Tier exposure and surprise-bill
risk. Use the AWS CLI with READ-ONLY credentials. Do not create, modify,
or delete anything — report findings and recommended (unapplied) fixes
only.

1. Account age + plan: note the account creation date (12-month clock)
   and whether it's a Free Plan (6 months / $200 credits) or Paid Plan.
   Flag accounts approaching month 11-13 (highest surprise-bill window).
2. 12-month resources about to bill: aws ec2 describe-instances (t2/t3.
   micro), rds describe-db-instances (db.t*.micro), elasticache, es —
   these stop being free at the anniversary. List each with its normal
   post-free rate.
3. Un-free traps: flag NAT Gateways (ec2 describe-nat-gateways, ~$32/mo
   each), ALB/NLB (elbv2 describe-load-balancers, ~$16-25/mo), UNASSOCIATED
   or stopped-instance Elastic IPs (ec2 describe-addresses), io1/io2 EBS,
   VPC interface endpoints, Route 53 zones, KMS CMKs, Secrets Manager
   secrets, and high CloudWatch Logs ingestion.
4. Instrumentation gaps: is there a small AWS Budget + Free Tier usage
   alerts + a Cost Anomaly Detection monitor? Flag if missing.

Report a table: resource | free-tier status (12-mo/always/none) | est.
post-free $/mo | action (keep/downgrade/delete). Plus the instrumentation
gaps. Change nothing.
Works with any assistant that can run shell commands.

Want the guided version?

The AWS Free Tier walkthrough covers this topic interactively — it asks about your setup, branches to what’s relevant, and quizzes you on the tricky parts. Free and anonymous.

Start the walkthrough

More Cost Governance cheat sheets

AWS Billing Conductor

Billing Conductor restructures how a bill is allocated and presented internally — pro-forma invoices with custom rates, markups, and line items — without changing what AWS actually charges. It's an accounting tool for MSPs and complex chargeback, not a savings tool.

AWS Budget Actions

A regular budget emails you; a Budget Action does the thing for you — attach a deny-IAM policy, apply an SCP, or stop tagged EC2/RDS when a threshold breaks. The difference between an alarm and a circuit breaker, and it costs nothing extra.

AWS Budgets

The one cost-governance feature to set up first: a threshold plus a notification that pings you before the bill lands. Forecasted-80% is the single most effective alert AWS offers; first two budgets are free.

AWS Cost and Usage Reports

Cost Explorer is a dashboard; CUR is the database. Every billing line item — one resource × one hour × one usage type, hundreds of columns — dumped to S3 for Athena/QuickSight when the question doesn't fit Cost Explorer's dropdowns. Use CUR 2.0 via Data Exports.