Free Tier & What AWS Actually Charges For
The new Free vs Paid plan model, what “free” really means, how pricing works, and the short list of resources that quietly run up a beginner’s bill.
From your mentor
Almost every “surprise AWS bill” story comes from the same handful of resources. Learn the money model once, here, and you’ll build with confidence instead of fear for the rest of the course.
AWS pricing is just this: you rent things by the second, and a few of them quietly keep charging.
In 10 minutes you’ll know what’s actually free and the ~5 things that bite a beginner’s bill. You do NOT need the pricing calculator yet.
Pick your way in, same idea, 5 doors
AWS is a utility meter. You don’t buy the machines, you rent them by the second. Turn something on and forget it, and the meter keeps spinning while you sleep. The whole skill is knowing which meters are running.
The plan you picked, and its sharp edges
You chose Free or Paid in Lesson 1. Here's exactly what each one does, because the post-2025 model has edges that surprise people.
Every new account (since July 15, 2025) gets $100 in credits at sign-up and can earn up to $100 more, plus 30+ always-free services, on either plan. The difference is what happens at the edges.
Free plan
Learning, this course
- No charges at all while you explore
- Ends after 6 months OR when credits run out, whichever comes first
- Blocks credit-burning services (Reserved Instances, Savings Plans, some Marketplace)
- Not eligible for other promotional credits or discounts
Paid plan
Real apps that outgrow credits
- All services available immediately
- Pay-as-you-go once credits/always-free limits are exceeded
- Account stays open when credits run out
- Adds short-term service trials + eligibility for promo credits
The Free plan can close your account
When the Free plan ends (6 months, or credits depleted), the account closes automatically. AWS keeps your data for 90 days, then deletes it permanently. You can upgrade to Paid within those 90 days to keep everything, so never store anything you can’t lose on a Free-plan account.Silent auto-upgrade triggers
A Free plan auto-converts to Paid if you join AWS Organizations, set up a Control Tower landing zone, join the Partner Network, sign an Enterprise Agreement, or mark the account HIPAA/SEC compliant. Harmless while learning, just know it can happen without a separate prompt.“Free tier” is three different things
People lump these together and then get billed. Knowing which is which stops you assuming something is free when it isn't.
| Kind | What it is | Lasts | Example |
|---|---|---|---|
| Always free | Monthly allowances that never expire | Forever (within limits) | Lambda 1M requests/mo, DynamoDB 25 GB |
| Short-term trials | Free use of a service for a set period after you start it | Days–months | Select services (Paid plan) |
| Credits | $100 + up to $100, spendable on most services | Until used (or 6 months on Free plan) | Offsets any pay-as-you-go charge |
| Legacy 12-month tier | The old model: 750 hrs EC2, 5 GB S3, etc. | 12 months from sign-up | Accounts created before Jul 15, 2025 |
Which applies to you?
If your account predates July 15, 2025, you may still be on the classic 12-month free tier (750 EC2 hours, 5 GB S3, and so on). New accounts use the credit-based Free/Paid model above, there’s no automatic 12-month EC2/S3 grant.What’s actually always free
The always-free tier never expires, it's where most of your hands-on learning can live, bill-free. Limits are monthly and per-account.
| Service | Always-free allowance (monthly) |
|---|---|
| AWS Lambda | 1M requests + 400,000 GB-seconds of compute |
| Amazon DynamoDB | 25 GB storage + 25 read/25 write capacity units |
| Amazon SNS | 1M publishes |
| Amazon SQS | 1M requests |
| Amazon CloudWatch | 10 metrics, 10 alarms, 5 GB logs |
| AWS Step Functions | 4,000 state transitions |
| Amazon Cognito | 10,000+ monthly active users |
Build real things here, but watch the exceptions
These reset every month and never expire, so a small project can run genuinely free. S3 and EC2 are not always-free (they were 12-month perks), so treat compute and storage as billable. Always check the live list, it shifts: aws.amazon.com/free.AWS docs: freetier get-free-tier-usage# see how much of each free-tier limit you've used$ aws freetier get-free-tier-usage
How AWS pricing actually works
Beyond the free tier it's pay-as-you-go. Three ideas cover ~90% of it, internalise them and most bills stop being mysterious.
| Principle | What it means in practice |
|---|---|
| You pay for provisioned, not used | An idle EC2 instance or half-empty EBS volume bills the same as a busy one |
| Billed by time + region | Per-second (60s min) or per-hour; us-east-1 is usually the cheapest region |
| Data transfer is its own line item | Outbound to the internet costs (~$0.09/GB); inbound is free; cross-AZ also costs |
For compute specifically, there are four ways to buy the same EC2 instance, the trade is commitment for discount:
| Purchase model | Commitment | Discount vs On-Demand | Use it for |
|---|---|---|---|
| On-Demand | None | Baseline (0%) | Spiky or unknown workloads, learning |
| Spot | None, can be reclaimed | Up to ~90% | Fault-tolerant batch, CI, stateless |
| Savings Plans | 1 or 3-year spend ($/hr) | Up to ~72% | Steady baseline across instance types |
| Reserved Instances | 1 or 3-year specific config | Up to ~72% | Steady, fixed-shape workloads |
While you’re learning
On the Free plan, Savings Plans and Reserved Instances are blocked (they’d burn credits). On-Demand is your default; Spot is a cheap option for throwaway experiments that can tolerate interruption.The bill that bites beginners
Most surprise bills come from a short list of resources that are never free and bill by the hour whether you use them or not. Learn them once.
Never free, in any tier
NAT Gateway, public IPv4 addresses, the EKS control plane, and Multi-AZ RDS are never covered by any free tier. A single forgotten one is the classic “my free account charged me” story.| Trap | What it costs | Why it bites | Avoid it by |
|---|---|---|---|
| Public IPv4 address | $0.005/hr (~$3.60/mo) each, since Feb 2024 | Charged per address, even an idle, unattached Elastic IP | Release unused Elastic IPs; avoid needless public IPs |
| NAT Gateway | $0.045/hr (~$32/mo) + $0.045/GB processed (+ egress) | Runs 24/7; a forgotten one = ~$60 in month one | Delete when idle; use (free) Gateway VPC endpoints for S3/DynamoDB |
| Data transfer out | ~$0.09/GB to internet; cross-AZ also bills | Scales silently with traffic; inbound is free so it’s easy to forget | Keep traffic in-region; CloudFront; VPC endpoints |
| Idle EBS volumes | ~$0.08/GB-mo (gp3), billed on provisioned size | Detached volumes and old snapshots keep billing | Delete unattached volumes and stale snapshots |
| EKS control plane | $0.10/hr (~$73/mo) per cluster | Charged regardless of how many nodes run | Don’t leave clusters running while learning |
And here’s how your relationship with the bill should mature, the same climb, applied to cost:
- Rung 0 · Naive
Spin up and hope
Launch resources, never open the billing console, find out at the end of the month.
This is exactly how the $300 surprise bill happens, a forgotten NAT or EIP runs for weeks. - Better
Budgets + alerts
Set an AWS Budget and turn on Free Tier usage alerts the day you open the account.
You find out at $5, not $500, early warning turns a disaster into a shrug. - Best practice today
Design for cost + observe
Tag resources, watch Cost Explorer, enable Cost Anomaly Detection, and avoid the traps architecturally (gateway endpoints, no idle public IPs).
Cost becomes a design input you control, not a surprise you react to.
Stay ahead of the bill
Four tools, all free. Set them on day one and the bill stops being a mystery.
| Tool | What it does |
|---|---|
| AWS Budgets | Cost/usage budgets with forecasts + email/SNS alerts, set one now |
| Free Tier usage alerts | Warn you as you approach a free-tier limit |
| Cost Explorer | Visualise and break down spend by service, tag, or time |
| Cost Anomaly Detection | Machine-learning alerts on unusual spend |
AWS docs: ce get-cost-and-usage# pull your month-to-date spend from Cost Explorer$ aws ce get-cost-and-usage --time-period Start=2026-06-01,End=2026-06-30 --granularity MONTHLY --metrics UnblendedCost
Set a budget right now
Create an AWS Budget for a few dollars today. On the Free plan you won’t be charged, the point is to prove the alert fires before you ever run a billable resource.How this shows up in interviews
“A junior spun up a dev environment and got a $300 bill. What likely happened, and how do you prevent it?”
How to answer it
Name the usual culprits first, then the guardrails. Specifics (NAT, public IPv4, EKS) signal you’ve actually seen real bills.
- 1Likely culprits: a forgotten NAT Gateway running 24/7, idle/unattached Elastic IPs, an oversized always-on EC2 + EBS, an EKS cluster, or heavy internet/cross-AZ data transfer.
- 2Immediate guardrails: AWS Budgets + Cost Anomaly Detection, and Free Tier usage alerts so warnings come early.
- 3Architectural fixes: Gateway VPC endpoints for S3/DynamoDB instead of NAT, release unused EIPs, keep traffic in-region, schedule/auto-stop dev resources.
- 4Organisational fix: least-privilege IAM so not everyone can launch expensive resources, plus tagging to attribute spend.
Green flags
- Names specific never-free resources (NAT, IPv4, EKS)
- Reaches for budgets + anomaly detection + tagging
- Knows gateway endpoints replace NAT for S3/DynamoDB
Red flags
- “AWS is just expensive”
- No mention of budgets or alerts
- Thinks the free tier covers everything
Q.What is never covered by the AWS free tier?
A.A handful of always-billed resources, they charge from hour one regardless of usage.
- NAT Gateway (hourly + per-GB).
- Public IPv4 addresses (even idle ones).
- The EKS control plane (~$73/mo).
- Multi-AZ RDS.
They’re checking: That you can name the usual suspects behind a “free account” bill.
Q.Free plan vs Paid plan, the real difference?
A.Both get the credits and always-free services. Free won’t charge you but auto-closes and blocks credit-burners; Paid stays open and unlocks everything.
They’re checking: That you know Free auto-closes and is gated, not just “the cheap one”.
Q.How would you cut a high NAT Gateway bill?
A.Stop routing through NAT what doesn’t need it, starting with free Gateway VPC endpoints for S3 and DynamoDB.
- Keep chatty traffic in-region; consolidate to fewer NAT gateways; delete idle ones.
- Remember NAT bills an hourly rate plus per-GB processing, on top of egress.
They’re checking: That you reach for Gateway endpoints first, not just “use less”.
Q.Why get charged for an Elastic IP you weren’t using?
A.Since Feb 2024 every public IPv4 bills ~$0.005/hr whether attached or not, an idle EIP is ~$3.60/month. Release it.
- Applies to all public IPv4, including allocated-but-unused EIPs.
- Fix: release EIPs you’re not using; prefer IPv6 or a NAT-free design where you can.
They’re checking: That you know public IPv4 is now a line item, and the fix is to release.
Your turn, audit your own account
Everything here is free to do and takes ~15 minutes. It turns the money model from theory into muscle memory.
Now do it in your own account
Sign in as your IAM user from Lesson 1, then work through these in the Billing console and the CLI. Every step is free, they’re the guardrails themselves.
Before you start
3 to have readyYour IAM admin user from Lesson 1 (don’t use root).
Access to the Billing console (root enables IAM access to Billing once, if needed).
AWS CLI v2 installed and signed in.
aws sts get-caller-identity- 1
Confirm your plan and remaining credit balance.
Free tierConsole → Billing & Cost Management
You should see: your plan (Free or Paid) and a credit balance.
- 2
Turn on Free Tier usage alerts so you’re warned near a limit.
Free tierConsole → Billing → Free Tier
You should see: usage alerts enabled.
- 3
Set an AWS Budget for a few dollars, with an email alert.
Free tierYour terminal
aws cli
AWS docs: budgets create-budget$ aws budgets create-budget --account-id <acct> --budget file://budget.jsonYou should see: the budget under Billing → Budgets.
- 4
List Elastic IPs and spot any idle ones.
Free tierYour terminal
You should see: any address with an AllocationId but no AssociationId is idle, and billing.
An idle EIP costs ~$3.60/mo. Release it (in the teardown).
- 5
Check how much of your free-tier limits you’ve used this month.
Free tierYour terminal
You should see: your month-to-date free-tier usage per service.
- 6
Optional: enable Cost Anomaly Detection for an ML safety net on unusual spend.
Free tierConsole → Billing → Cost Anomaly Detection
You should see: a monitor is active.
Last step: tear it down
Once you’ve seen it work, remove everything so nothing keeps billing.
These steps don’t cost money, they’re the guardrails themselves.
Spun up a NAT Gateway, Elastic IP, or EKS cluster while exploring? Delete them, they bill 24/7.
Release an idle Elastic IP.
aws ec2 release-address --allocation-id <id>Re-check Billing after a day to confirm $0.00 and that your budget alert is active.
Next up
Next, IAM, in depth
Users, groups, policies, roles and AssumeRole, and least privilege: how AWS actually decides who can do what, and the model interviewers hammer hardest.