Did you know that over 30% of cloud spending is wasted each year due to idle or mismanaged resources? According to the State of the Cloud Report 2025, cloud waste continues to rank among the top concerns for both enterprises and startups. The irony is clear: while the cloud promises scalability and flexibility, it can also become an uncontrolled drain on your budget if not managed properly.
AWS itself highlights cost optimization as one of the five pillars of its Well-Architected Framework – right alongside security and performance. Yet, too often, teams focus on building and scaling while neglecting financial governance. The result: Unexpected bills, project delays, and frustrated stakeholders.
This is where Budget Controls for AWS comes in: an open-source solution that ensures you stay in control of your spending without slowing down innovation.
What it is and How It Works: Smart Tagging and Automated Actions
The solution applies a special tag called BudgetControlAction, which governs how resources behave once your budget thresholds are reached. It supports three case-sensitive values: Inform, Stop, and Terminate.
- Inform (default): At 80% and 90% of your budget, the system will send alerts but won’t interrupt operations. This is a low-risk way to monitor usage without disrupting services.
- Stop: When triggered, resources with this setting are paused, which stops further compute charges. The resource can be restarted at any time. However, it’s important to note that connected services, like storage volumes, may continue to generate some costs.
- Terminate: This permanently deletes the resource when budget limits are reached. It’s best suited for development or test workloads that can be easily recreated, as the action is irreversible.
For leadership, this means budget compliance is enforced automatically without relying solely on manual oversight. With cloud overspending affecting nearly three out of four organizations, proactive controls like this help avoid “bill shock” while giving your teams the freedom to experiment and scale.
Cost optimization isn’t just about monitoring what you already use, it’s also about testing new services without financial risk. That’s where the AWS Proof of Concept (POC) Program comes in. It lets businesses experiment with AWS services for free (up to $25,000 in funding), helping you validate ideas before committing resources.Learn how to apply (and how we can help you get started) in our article: AWS Proof of Concept: how to try new cloud services for free
Reviewing the Budget Controls for AWS Architecture
At its core, the Budget Controls for AWS solution relies on two key services:
- AWS Budgets: Tracks overall spend against customer-defined thresholds. At 80% of the budget, an alert is sent via email. At 90%, automated workflows are triggered to take the actions defined by the account owner (e.g., Inform, Stop, or Terminate).
- AWS Config: Continuously monitors your resources to ensure they are properly tagged with BudgetControlAction. If tags are missing or invalid, Config flags the resource as NON_COMPLIANT.
There are several other AWS services deployed as part of the solution, as shown in the full architecture diagram below.
In addition to AWS Budgets and AWS Config, several other AWS services integrate to automate enforcement and reporting. The workflow unfolds as follows:
1. Continuous Monitoring & Compliance Validation
- AWS Config serves as the foundation, constantly monitoring every supported resource for configuration changes.
- A custom-built Lambda rule evaluates these resources against the required BudgetControlAction tag.
- Compliant resources are written to Amazon DynamoDB, ensuring there’s a single source of truth for resource status and budget alignment.
Business impact: This ensures that every resource in your environment is accounted for, eliminating hidden cost drivers—a challenge that 73% of organizations face when managing cloud budgets.
Business impact: This ensures that every resource in your environment is accounted for, eliminating hidden cost drivers—a challenge that 73% of organizations face when managing cloud budgets.
2. Automated Remediation. Amazon EventBridge detects non-compliant resources and triggers the Lambda Remediation Function.
This function enforces governance by:
- Adding the missing tag (BudgetControlAction = Inform by default).
- Recording the update in DynamoDB for audit purposes.
- Notifying stakeholders immediately through Amazon SNS.
- All notifications are encrypted with AWS KMS, guaranteeing security and compliance with enterprise-grade standards.
For example, in one of our case studies: our client’s manual remittance workflows were slow, error-prone, and costly. Our AWS and GenAI solution transformed their financial operations with measurable results: 40% cost reduction across financial operations with significantly reduced processing time.
Just like Budget Controls automatically manage cloud resources to prevent overspending, smart automation in financial workflows ensures efficiency, compliance, and predictable costs- letting teams focus on growth, not manual tasks. Read the full story: Automating Remittance Workflows with GenAI and AWS
Business impact: This creates self-healing governance. Instead of waiting for engineers to manually fix issues, the system remediates instantly, saving both time and money.
3. Intelligent Budget Thresholds
- During deployment, customers define a monthly budget cap.
- When spending reaches 80%, AWS Budgets proactively issues an alert via email.
- At 90%, the solution escalates automatically, triggering the SNS Action Topic.
Business impact: This provides a dual safeguard—early warnings for managers to course-correct, and hard enforcement to prevent budget overruns.
4. Automated Decision Execution. A Lambda function, subscribed to the Action Topic, invokes an AWS Step Function workflow. The Step Function cross-references DynamoDB to determine which action applies to each resource:
- Inform – Notify without interruption.
- Stop – Suspend the resource, halting compute charges.
- Terminate – Permanently delete test or dev resources to prevent waste.
Every action is precisely logged back into DynamoDB, building a tamper-proof operational record.
Business impact: This provides financial discipline at scale—resources are automatically adjusted based on business rules, removing human error and ensuring cost predictability.
5. Transparent Reporting & Accountability
- Once actions are completed, the Step Function triggers a reporting Lambda.
- The system aggregates data from DynamoDB and produces a comprehensive report.
- A final summary email is sent via SNS, providing decision makers with clear visibility into what actions were taken, why, and when.
Crunching the Numbers: What This Solution Will Cost You
When evaluating any cloud governance framework, understanding the financial footprint is just as important as the technical setup. Here’s how this solution translates into real-world AWS costs.
Fixed Costs. The only predictable, recurring cost comes from AWS Key Management Service (KMS). A single encryption key used for securing notifications costs $1 per month , essentially the price of a coffee for enterprise-grade encryption.
Variable costs. The bulk of the costs depend on how dynamic your environment is, in other words, how often resources change and how tagging is managed.
AWS Config:
- Every time a supported resource (EC2, Aurora, SageMaker, OpenSearch) changes configuration, AWS Config records the change.
- Cost: $0.003 per change.
- Formula:
Number of resources × Number of configuration changes per month × $0.003
BudgetControlAction Tag Changes:
- Each time the tag value is updated, AWS Config re-evaluates compliance.
- Cost: $0.001 per evaluation.
- Formula:
Number of resources × Number of tag changes per month × $0.001
Other AWS Services
- DynamoDB, Lambda, EventBridge, and SNS generate only negligible costs.
- Combined monthly charges: less than $0.01.
For most organizations, AWS Config will be the primary contributor to costs. The rest is almost invisible on your bill.
Limitations of the Solution
While this solution brings powerful automation and cost control, it’s important to note a few key constraints before rolling it out broadly.
1. Single Account Monitoring. Currently, the solution operates on a per-account basis. Multi-account setups require deploying the stack individually in each account.
2. Single Region Coverage. The solution is designed to function within one AWS region per deployment. If your infrastructure spans multiple regions, deployment must be repeated across them.
3. Supported Resource Types. At the time of writing, the solution supports: EC2, RDS Aurora, SageMaker (instances and domains), OpenSearch clusters
4. Email-Based Notifications. Notifications are delivered through Amazon SNS email alerts. Subscription confirmation is required, and there’s no out-of-the-box integration with collaboration tools like Slack or Microsoft Teams.
Want to dive deeper into the mechanics of Budget Controls for AWS? The official AWS Cloud Financial Management blog breaks down how this solution automatically tracks, tags, and takes action on your cloud resources to prevent overspending. From detailed examples of resource tagging to automated stop and terminate workflows, it’s a must-read for anyone serious about financial governance in the cloud. Explore the full insights here: Introducing Budget Controls for AWS: Automatically Manage Your Cloud Costs.
