Unexpected cloud bill: the first 48 hours

In the first 48 hours, confirm the charge is real, stop the source (rotate the leaked key or kill the runaway job in every region), write a UTC timeline, then open a billing case with AWS or Google Cloud. Don't count on a refund. We'd run those hours in-house and hire help only for the guardrails afterwards: keys, permissions, caps and alerts.

How to respond to a surprise cloud bill in the first 48 hours

A surprise bill is two jobs with two owners and two clocks. An engineer stops the spend in hours. A billing administrator asks the provider to look at the charge, with evidence and no guarantee. Keep them separate, or the second job waits behind the first.

1. Check the number is real (first hour)

Open the billing console and group costs by service, project or account, and region. You're looking for the one line that jumped.

Cost reports lag, so a flat chart doesn't prove the spend has stopped. On AWS, Cost Explorer only works 24 hours after you switch it on, so enable it now if you never have.

2. Stop the source

If a key leaked, replace it. Follow the order for your cloud.

Google Cloud API key: open Credentials, pick the key, choose Rotate key, update your app, then delete the old key.
Google Cloud service account key: create a new one, deploy it, disable the old one, then delete it.
AWS access key: create a new one, deactivate the old one (don't delete it yet), test the app, then delete the old one.

On AWS, also delete any root access keys you don't need. If a job or loop is the cause, stop the job first, then the schedule that restarts it.

Rotating before you revoke avoids an outage, and a hard stop ends the cost at once. Our take: if the app earns revenue, rotate, deploy and revoke, and do it fast. If it doesn't, stop the key now and fix the outage later.

3. Find what else is running

Check every region, including ones you've never used. Look for VMs, buckets, service accounts, IAM users and keys you didn't create. Google's Logging audit logs and AWS CloudTrail Event history show who created them and when.

If you want to keep a machine as evidence, take an EBS snapshot first. Once you've identified a resource as unauthorized, and after the snapshot, delete it.

4. Write the timeline, then open the billing case

Gather what a reviewer needs: UTC times for the first spike, discovery and the key revocation, the service and key behind the excess, last month's bill for comparison, and what you changed.

On Google Cloud, a Billing Account Administrator opens the billing case. Compromise cases go to Cloud Billing Customer Care, and Google says it reviews billing adjustments on an individual basis.

On AWS, open Support Center, Create case, then Account and billing support. It's free for all account owners. Billing cases run by web or phone, with no chat, so expect to write the case up rather than talk it through. If AWS sent you an irregular-activity notice, answer it in the Support Center too.

5. Don't open with a chargeback

Google documents that a bank dispute goes to Google for review. If Google disagrees but the bank sides with you, the account shows an overdue balance, and you pay it to keep your services running. Your bank is the last step, not the first.

Example: $11,600 on the 9th

Take a seed-stage B2B app that normally pays $1,800 a month on Google Cloud. On the 9th the console shows $11,600 month-to-date, and one Gemini API key in one project accounts for 90% of it. That's 0.9 x $11,600, or $10,440.

Hour 1: confirm the service and project behind the jump.
Hour 2: rotate the key and restrict it.
Day 1: list resources in every project and region, and pull the audit-log window.
Day 2: open the billing case for the $10,440 tied to that key, not the whole bill, with the UTC timeline attached.

In the forecast, book the month at $11,600.

Will AWS or Google Cloud take the charge back?

Maybe. Neither Google's nor AWS's billing documentation states criteria for a reversal, so no one can give you your odds.

What's published is narrow. Google's refund button on the Payment overview page is for unused funds, not promo credits or an amount due, so it isn't the route for an abuse bill. AWS says to open a support case for any bill inquiry or appeal.

Plan the budget as if the money is gone. Send the request anyway, with the timeline.

Why didn't the budget stop it, and what does?

Because a Google budget with alerts only doesn't cap anything. Google's budget documentation says the first alert on a new budget can take several hours, so a leaked key runs unchecked until then.

Google's spend cap budgets do pause usage, within limits. They cover one project and one service: the Gemini API, Gemini Enterprise Agent Platform (formerly Vertex AI), Cloud Run or Cloud Run functions. They're monthly, and they trigger on estimated gross cost above 100% of the budget. New usage for that service then pauses until the next period or until you edit the budget.

Enforcement isn't instantaneous, so you stay responsible for overage that accrues during the reporting lag. Persistent resources keep billing.

If the project and service that leaked is one of those four, set a cap on it, at a number you'd accept losing. For everything else, your ceiling is key restrictions, least-privilege permissions and an anomaly alert, and you have to build all three.

Who owns cloud cost after this: your team, a contractor, or the agency?

Our judgment, in three cases.

Your team owns it if one engineer can name the top services, owns the infrastructure code and can hold the billing administrator role. Do the clean-up in a week.

A short DevOps engagement fits when nobody owns the account, which is common when the founders built the product themselves. The scope is key and IAM clean-up, budgets and caps, anomaly alerts, a runbook and a handover. Ask for a fixed price after a one-day audit.

If an agency built the app, ask them to hand over the credentials and the keys they created. Don't leave their keys live.

If a runaway LLM call is the cause, the fix may be product, not infrastructure: see when an AI feature's API bill outruns its revenue. For the slow leaks, right-sizing before the credits end covers the routine work. And if you're asking what an engineer for this costs, our software development cost guides and what a European development team costs are the next read.

What this means for your budget

Book the excess as lost, as above, and treat the provider's answer as upside.

Decide the owner this week, and put the name in writing. Then buy a ceiling before the next feature that calls a metered API. A cap or a restricted key is a small job next to a loop with no limit, which costs whatever it runs up before someone notices.

If cash is tight after this month, what to cut next, in order of reversibility shows where the next dollars are easiest to find.

Hardening your cloud account with a DevOps engineer through HighCircl

If nobody on the team owns the cloud account, the 48 hours are still yours to run. The engineer comes after, for the guardrails: keys, permissions, caps and alerts. HighCircl can match you with a senior DevOps engineer within 72 hours, and there's no minimum hour commitment, so you can scope it to the audit and the fixes. Hire a DevOps engineer through HighCircl.

FAQ

How do I get a refund from Google Cloud after a leaked key?

Contact Cloud Billing Customer Care to report the compromise and discuss billing adjustments, which Google reviews on an individual basis. The refund button on the Payment overview page is for unused funds, not abuse charges. Nothing guarantees a credit, so plan as if you'll pay it.

Can AWS reverse charges from a compromised key?

You can ask. Open an Account and billing support case and attach your timeline. AWS says that's the route for bill inquiries and appeals, and its billing documentation states no criteria for reversals.

Does a Google Cloud budget stop spending?

An alerts-only budget doesn't. Spend cap budgets can pause usage, but only for the Gemini API, Gemini Enterprise Agent Platform, Cloud Run and Cloud Run functions, one project and one service at a time. You stay responsible for overage during the reporting lag.

What do I do first if a cloud API key leaks?

Rotate it. Create the new key, update your app, then delete the old one. On AWS, deactivate the old key first and delete it after the app works.