Is the AWS Free Tier actually free?

Free plan vs Paid plan: how new AWS accounts work

When you create a new AWS account, AWS offers two account tiers: the Free account plan and the Paid account plan. Both plans give you $100 USD in credits right away. You can also pick up an extra $100 USD in credits by finishing specific activities and trying out key services, which brings your potential starting balance to $200 USD.

Where they split is what happens when those credits run out.

The Free plan is built for zero financial risk. It gives you access to over 90 services for up to 6 months without overage fees. You cannot be charged on the Free plan unless you manually convert to a Paid plan or activate paid-only services. To keep your account from running up debt, AWS blocks access to hardware purchases and certain services that would chew through your credit balance too fast. The account closes automatically after 6 months or as soon as your credits are exhausted.

The Paid plan keeps your workloads running continuously, but it comes with financial liability. You get access to short-term trials and services that are unavailable on the Free plan, such as Amazon Bedrock AgentCore. Paid plan accounts can also use Promotional Credits, which Free plan accounts cannot use. The trade-off is standard billing: as soon as your credits expire, run dry, or touch uncovered services, AWS bills you at standard pay-as-you-go pricing.

Both plans give you access to over 30 Always Free services that carry monthly allowances. On both plans, if your monthly usage stays within those limits, you pay nothing. If you are on the Paid plan and exceed an Always Free allowance or a short-term trial limit, your available AWS Free Tier credits automatically cover the difference until the credits run out.

Why did your Free Tier account get charged?

If you received an unexpected charge on what you thought was a free account, you are running on the Paid plan, or you activated a paid-only feature. The charges that catch developers most often are not runaway compute clusters, but tiny infrastructure defaults that quietly accrue hourly fees.

Public IPv4 address fees

Every in-use public IPv4 address associated with a resource costs $0.005 per hour. Idle public IPv4 addresses sitting unattached in your account also cost $0.005 per hour. These rates apply across all AWS commercial regions, US GovCloud, AWS China, and AWS Local Zones.

When you launch an Amazon EC2 instance in a default VPC, AWS assigns it a public IPv4 address by default. Other services like Amazon RDS, Amazon ECS, Amazon EKS, Amazon EMR, and Amazon WorkSpaces also spin up public IPv4 addresses to give resources internet connectivity.

These address charges are calculated in one-second increments with a 60-second minimum. If you use Amazon-provided contiguous IPv4 blocks, the price jumps to $0.008 per hour per address, and AWS bills partial hours as full hours. The only public IPv4 addresses that AWS does not charge for are those you bring yourself through Bring Your Own IP (BYOIP) or Customer-owned IP addresses (COIP) at an AWS Outpost.

NAT Gateways and inter-AZ network routing

An Amazon VPC NAT gateway charges for every single hour it exists, whether it routes traffic or sits idle. In US East (Ohio), you pay $0.045 per NAT Gateway-hour, with partial hours billed as full hours. On top of that hourly fee, you pay $0.045 per GB of data processed through the gateway. If you set up a Regional NAT Gateway across three Availability Zones, you pay $0.045 per hour per AZ, which comes out to $0.135 per hour just for availability.

Traffic moving through that gateway adds more charges. Standard EC2 Data Transfer Out to the internet in US East (Ohio) costs $0.09 per GB. If your EC2 instance and NAT gateway sit in different Availability Zones, moving data between them incurs inter-AZ data transfer fees. Traffic within the same Availability Zone using private IP addresses has no data transfer charge. For a deeper breakdown on handling these network costs, see our guide on why your AWS NAT Gateway bill is so high and how to cut it.

To bypass NAT gateway data processing fees when connecting to Amazon S3 in the same region, configure a Gateway Type VPC endpoint. Gateway Type VPC endpoints carry no hourly fees and no data processing charges.

Traffic Mirroring sessions left running

Amazon VPC Traffic Mirroring costs $0.015 per session-hour in US East (Ohio). A frequent billing surprise happens when an engineer stops or terminates the source EC2 instance, or detaches its network interface, assuming billing stops. AWS continues billing for Traffic Mirroring until you explicitly delete the traffic mirroring session itself.

VPC peering across zones

Data sent over VPC peering or ODB peering connections that crosses an Availability Zone within the same AWS Region costs $0.01 per GB in both directions (in and out).

Tracking your Free Tier usage in the console

AWS provides built-in tools to check your usage, though their location depends on your account plan.

If you are on the Free account plan, you can check your plan expiration date, credit balance, and days remaining through the AWS Cost and Usage Report widget, the AWS Management Console home, or programmatically via the AWS SDK and CLI at no cost.

If you are on the Paid account plan:

1. Track your credit balance and expiration date on the credits page inside the AWS Billing and Cost Management console.
2. Monitor actual service usage against short-term trial and Always Free limits using the Free Tier page in the billing console, or query it programmatically with the free tier API.
3. Check the Recommended actions widget on the Billing and Cost Management home page, which displays alerts when your usage crosses 85% of a service's limit.

Keep in mind that AWS Free Tier data will not appear if your Free Tier has expired, if you use a service that does not offer a Free Tier, if you are looking from an AWS Organizations member account, or if your resources run in the AWS GovCloud (US-West) or AWS GovCloud (US-East) Regions.

Configuring alerts before you get billed

Individual AWS accounts automatically have AWS Budgets 85 percent Free Tier usage alerts turned on by default. When your account crosses 85 percent of the free limit for a service, AWS sends an email to the root user address. These alerts monitor active offerings in the current month, like the first 25 GB of Amazon DynamoDB storage or your first 10 custom Amazon CloudWatch metrics.

If you manage accounts inside an AWS Organization, management accounts do not get these alerts turned on automatically; you have to opt in manually.

To verify or change your alert email settings:

1. Open the Billing console and select Billing preferences under Preferences.
2. Find Alert preferences and click Edit.
3. Check Receive AWS Free Tier alerts and save your preferences.

To catch spend before it turns into an invoice, configure a zero spend budget template inside AWS Budgets. This tracks your usage up to 100% of the Free Tier limit rather than cutting off notifications at 85%. For step-by-step alert configs, read our guide on how to set up AWS billing alerts.

To track down public IPv4 addresses quietly costing you money, use Public IP Insights. It is a feature inside Amazon VPC IP Address Manager (IPAM) available in the IPAM Free Tier. It lets you inspect, track, and identify idle public IPv4 addresses across your accounts so you can release them back to AWS.

Catching runaway costs with Costbrake

Native AWS alerts let you know after you have crossed an 85% threshold, but they do not actively stop resources from racking up charges on a Paid plan account. To read more about what AWS can and cannot halt automatically, check our guide on setting a hard spending limit on AWS.

Costbrake connects to AWS and 22 other providers (including Cloudflare, GitHub, OpenAI, and Anthropic) to watch spending and flag spikes before month-end invoices hit. On the Free plan, Costbrake checks your accounts hourly with up to 3 budgets. On Pro ($12/month) and Team ($39/month), its CloudWatch estimates for Lambda, Bedrock, NAT gateway and GPU instance spend run every 5 minutes, dropping to every minute during an active spending spike; the rest of the bill comes from Cost Explorer, re-read every 4 hours.

A spike alert triggers whenever an hour costs more than 3x your 7-day baseline and adds at least $5 of spend. It also flags when a new service appears on your bill above $1, alerts at 50%, 80%, and 100% of budgets, and forecasts if recent 72-hour usage will blow past your monthly target.

For AWS, Costbrake reads Cost Explorer and monitors live CloudWatch metrics (requests, Bedrock tokens, NAT gateway throughput, and running instance vCPUs). On Pro and Team plans, Costbrake includes optional, human-confirmed brakes. If a resource runs away, an admin can click to stop an EC2 instance, throttle a Lambda function to zero concurrency, deactivate an IAM access key, or block Bedrock access. Costbrake never executes brakes automatically; they require explicit admin confirmation, record prior states, and never delete resources.

You can connect read-only credentials manually or hand the setup off to your coding agent via agent setup.

If setting up by hand via the AWS CLI, create a dedicated read-only IAM user with this policy:

aws iam create-policy --policy-name CostbrakeReadOnly --policy-document '{
  "Version":"2012-10-17",
  "Statement":[
    {"Sid":"CostbrakeReadCosts","Effect":"Allow","Action":["ce:GetCostAndUsage"],"Resource":"*"},
    {"Sid":"CostbrakeLiveEstimates","Effect":"Allow","Action":["cloudwatch:GetMetricData","cloudwatch:ListMetrics"],"Resource":"*"}
  ]
}'

Cost Explorer calls cost $0.01 per request, so Costbrake spaces requests at most every 4 hours (roughly $2 a month in AWS API fees) to keep visibility high without inflating your bill. Every workspace starts with a 14-day Pro trial with no credit card required.