How to find elusive but expensive snapshots?

Hello.

Specifically, in which region are the charges occurring?
Is it possible that I'm checking the wrong region?
I created a shell script to check if there are any remaining snapshots in the AWS account region.
Please run the shell script below to check if it remains in your AWS account.

#!/bin/bash

regions=$(aws ec2 describe-regions --query 'Regions[].RegionName' --output text)

for region in $regions
do
        echo "Checking snapshots in region: $region"
        snapshots=$(aws ec2 describe-snapshots --owner-ids self --region $region --query 'Snapshots[*].[SnapshotId,VolumeSize]' --output text)
        if [ -z "$snapshots" ]
        then
                echo "No snapshots found in $region"
        else
                echo "$snapshots"
        fi
done

Hii...Nathan

i just wanted to share a suggestion from what I know. I hope it helps you in some way

Use AWS Config and CloudTrail logs to identify the source of the snapshots

1. Enable AWS Config and CloudTrail in your account, if not already enabled.
2. Go to the AWS Config dashboard and search for EBS snapshot creation events.
3. Filter the events by date and time to match the increasing charges.
4. Identify the snapshot IDs and the resources EC2 instances, volumes associated with them.
5. Use the CloudTrail logs to track the API calls made to create these snapshots.
6. Analyze the logs to determine the source of the snapshots automated scripts, user actions.
7. Once you identify the source, take corrective action to stop the unnecessary snapshot creation.

This approach will help you detect and prevent the creation of unwanted snapshots, reducing your EBS charges.