```meta
title: August infra bill — where the +40% went
subtitle: July $84.2k to August $118.0k. Three line items explain 82% of the growth.
tag: FINOPS
```

```callout
tone: note
title: Assumptions
body: "Figures are the AWS and Datadog invoices for July and August 2026, in thousands of USD, before credits. The 40% compares August to July, not to a 12-month average. No new customers of note landed in August, so the growth is spend behaviour, not demand."
```

## The headline

```bignumber
value: "$118.0k"
label: August infrastructure bill
context: "July was $84.2k. The +$33.8k is the largest month-on-month step since the platform launched."
delta: "+40.1%"
trend: up
accent: red
```

## What makes up the +$33.8k

Compute, data transfer, and observability account for $27.7k of the growth. The other six line items moved less than $2.5k each. Each bar is one line item's August increase over July; the bars stack against the total growth.

```chart
title: August increase over July, by line item
kind: waterfall
unit: k$
budget: 33.8
items:
  - { label: Compute, value: 13.5, accent: red, desc: "New g5 GPU node group for the recommendations inference service, plus the EKS autoscaler minimum raised from 6 to 14 nodes" }
  - { label: Data transfer, value: 8.6, accent: red, desc: "Cross-AZ traffic from the new Kafka consumers and a NAT gateway on the private subnets" }
  - { label: Observability, value: 5.6, accent: amber, desc: "Datadog log indexing at 100% sampling and custom metric cardinality from per-user tags" }
  - { label: Databases, value: 2.1, desc: "Aurora reader added for the reporting workload" }
  - { label: Object storage, value: 1.7, desc: "Raw event logs with no lifecycle rule" }
  - { label: CI runners, value: 1.4, desc: "Larger GitHub Actions runners on every pull request" }
  - { label: Kafka, value: 0.5 }
  - { label: CDN, value: 0.4 }
```

## Where the August $118.0k goes

Compute is 38% of the bill and the inference node group alone is now 13%. Observability at $15.4k costs as much as every database we run. The ribbons carry the August amount; the second level splits the three line items that grew.

```sankey
title: August bill by line item and driver
unit: k$
nodes:
  - { id: Bill, label: "August bill" }
  - { id: Compute, accent: red }
  - { id: Transfer, label: "Data transfer", accent: red }
  - { id: Observability, accent: amber }
  - { id: Inference, label: "Inference GPU nodes" }
  - { id: Web, label: "Web and API fleet" }
  - { id: Batch, label: "Batch jobs" }
  - { id: Logs, label: "Log indexing" }
  - { id: Metrics, label: "Custom metrics" }
  - { id: APM, label: "APM traces" }
  - { id: CrossAZ, label: "Cross-AZ traffic" }
  - { id: NAT, label: "NAT gateway" }
  - { id: Egress, label: "Internet egress" }
links:
  - { from: Bill, to: Compute, value: 44.5 }
  - { from: Bill, to: Databases, value: 16.1 }
  - { from: Bill, to: Observability, value: 15.4 }
  - { from: Bill, to: Transfer, value: 14.8 }
  - { from: Bill, to: Storage, value: 9.2 }
  - { from: Bill, to: Kafka, value: 6.0 }
  - { from: Bill, to: CDN, value: 4.6 }
  - { from: Bill, to: CI, value: 3.9 }
  - { from: Bill, to: Other, value: 3.5 }
  - { from: Compute, to: Web, value: 19.8 }
  - { from: Compute, to: Inference, value: 15.2 }
  - { from: Compute, to: Batch, value: 9.5 }
  - { from: Observability, to: Logs, value: 8.1 }
  - { from: Observability, to: Metrics, value: 5.3 }
  - { from: Observability, to: APM, value: 2.0 }
  - { from: Transfer, to: CrossAZ, value: 8.9 }
  - { from: Transfer, to: NAT, value: 3.7 }
  - { from: Transfer, to: Egress, value: 2.2 }
```

## Cause, owner, and what we can claw back

Not every increase is a mistake. The inference node group serves a launched feature and stays. The cross-AZ traffic, the log sampling, and the CI runner size are configuration choices with no product consequence. They are the $16.4k we can recover in September.

```table
title: Line items, July to August
columns:
  - Line item
  - { label: July, align: r }
  - { label: August, align: r }
  - { label: Delta, align: r }
  - Cause
  - Owner
  - Recoverable
rows:
  - [{ v: Compute, lead: true }, 31.0, 44.5, { v: "+13.5", tone: neg }, "g5 GPU node group for recommendations inference; EKS autoscaler minimum raised from 6 to 14 nodes", Platform, { v: "Partial — $4.2k by lowering the minimum back to 8", tone: warn }]
  - [{ v: Data transfer, lead: true }, 6.2, 14.8, { v: "+8.6", tone: neg }, "Kafka consumers in a different AZ than the brokers; NAT gateway routes S3 traffic instead of a VPC endpoint", Platform, { v: "Yes — $7.1k with rack-aware consumers and an S3 gateway endpoint", tone: pos }]
  - [{ v: Observability, lead: true }, 9.8, 15.4, { v: "+5.6", tone: neg }, "Log indexing at 100% sampling since the July incident; per-user tags on request metrics", SRE, { v: "Yes — $4.5k at 20% sampling and tag removal", tone: pos }]
  - [Databases, 14.0, 16.1, { v: "+2.1", tone: neg }, "Aurora reader instance for the reporting workload", Data, { v: "No — reader is required for reporting", tone: muted }]
  - [Object storage, 7.5, 9.2, { v: "+1.7", tone: neg }, "Raw event logs kept in S3 Standard with no lifecycle rule", Data, { v: "Yes — $1.2k with a 30-day transition to Glacier Instant", tone: pos }]
  - [CI runners, 2.5, 3.9, { v: "+1.4", tone: neg }, "8-core runners on every pull request, not only on main", Developer Experience, { v: "Yes — $1.0k by keeping 8-core runners for main only", tone: pos }]
  - [Kafka, 5.5, 6.0, "+0.5", "Broker storage growth", Platform, { v: "No", tone: muted }]
  - [CDN, 4.2, 4.6, "+0.4", "Traffic growth", Platform, { v: "No", tone: muted }]
  - [Other, 3.5, 3.5, "0", "Support plan, Route 53, Secrets Manager", Finance, { v: "No", tone: muted }]
note: "Thousands of USD before credits. Recoverable amounts are monthly estimates from the August usage volumes."
```

## Takeaways

```takeaways
title: What to do in September
items:
  - text: $16.4k of the $33.8k growth is configuration, not product
    detail: "Cross-AZ Kafka traffic, 100% log sampling, the S3 NAT path, the CI runner size, and the storage lifecycle gap. None of them changes what a customer sees."
  - text: The inference node group is the one increase we keep
    detail: "$15.2k a month serves the recommendations feature. Reviewing its size is a product decision, not a cleanup."
  - text: Set a per-line-item budget alert before the next bill
    detail: "Every driver in this document was visible in daily usage two weeks before the invoice. A 15% alert on each line item would have caught all three."
  - text: Target for the September bill is $101.6k
    detail: "August $118.0k less the $16.4k recoverable. That is still +21% on July, which is the cost of the launched feature."
```