How can I retroactively identify the application or traffic causing RDS spike

To retroactively identify the cause of an RDS billing spike, you can take several steps:

1. Use AWS Cost Explorer: This tool can help you break down your RDS costs by usage type, region, and time period. Compare the costs between March and the previous months to identify specific areas of increased usage.

2. Check RDS Performance Insights: If enabled, this feature can provide historical data on database load, helping you identify any unusual activity or queries that might have caused the spike.

3. Review CloudWatch Metrics: Look at metrics such as CPU utilization, database connections, and I/O operations for the period in question. This can help you identify any unusual patterns or spikes in usage.

4. Examine RDS logs: If you have logging enabled, review the logs for the period when the spike occurred. Look for unusual query patterns or a high number of connections.

5. Check for snapshots and backups: Ensure that there are no unexpected snapshots or backups being created and stored, as these can contribute to increased costs.

6. Verify instance modifications: Check if there were any changes to the instance type or storage that might explain the cost increase.

7. Look for potential security breaches: Given that your webapp doesn't exist anymore, but costs have increased, it's possible that someone unauthorized is accessing your database. Review your security groups, network access control lists, and IAM permissions.

8. Audit IAM users and roles: As you mentioned possible retained access tokens, review and revoke any unnecessary IAM permissions related to your RDS instances.

If you're unable to identify the cause through these methods, you may want to contact AWS Support for further assistance in investigating the billing spike. They can provide more detailed information about the usage causing the increased costs.

Remember to take immediate action to stop any unnecessary resource usage, such as stopping or deleting the RDS instances if they're no longer needed, to prevent further unexpected costs.
Sources
RDS cost jump starting in April, but there doesn't appear to be a database | AWS re:Post
To stop RDS from billing | AWS re:Post
Abnormal Billing from RDS | AWS re:Post

Well, if RDS billing is spiked, few things might have happened.

• Instance type got updated
• Higher IOPS
• Added read replica
• Company wide backup policy that's not taking snapshots of the RDS
• Maybe there is a lambda that stops the RDS database at a time interval since the RDS is not active and that Lambda failed.

You should also

• Remove the unnecessary IAM access keys
• Possible take a final snapshot of RDS and terminate since it's not used.

Hello there,

I certainly understand the need to get this resolved. You also have the option of opening a support case. Please do so via the following: https://console.aws.amazon.com/support/home.

I'm also including a case creation example for you to review: go.aws/create-support-case-example.

- Dino C.