A Budget Alert Is Not a Limit: What Happens at Two in the Morning, and What Could Have

A Budget Alert Is Not a Limit: What Happens at Two in the Morning, and What Could Have

An agent’s role is a list of things it may do, and every one of them costs money. That makes the role a company card. Ask what the limit on the card is and the answer, on every cloud, is that there is not one: accounts have an invoice, not a ceiling. This post is the prose version of our ninety-second film on the subject, for readers who would rather scroll than watch.

The loop that works

A downstream service starts returning errors at 02:10. The agent does exactly what it was told: try again. Each try starts a model call, a function, a message on a queue, and each of those is billed. Nothing is broken. Every part is working as designed, and that is the problem. A loop that works is a loop that bills, and it will keep billing until something outside the loop stops it.

What the alert does

You set a budget, which is more than most accounts have. At 80% it sends an email, at 02:14. The email is read at 07:12. Every minute in between is billed at the same rate as the minutes before it. The vendors say this plainly once you go looking. Azure’s budget tutorial: “Resources aren’t affected, and your consumption isn’t stopped” (Microsoft Learn). Google’s: “Setting an alerts-only budget doesn’t automatically cap Google Cloud or Google Maps Platform usage or spending” (Google Cloud). A budget alert is a receipt that arrives early.

What the budget could have done

The same budget can be wired to act when the line is crossed, and this is the part that is off by default on all three clouds.

  • On AWS, a budget action can “run either automatically or after your manual approval”, and “your available actions include applying an IAM policy or a service control policy” (AWS Cost Management). Attach a deny-everything policy to the agent’s role at 100% and the loop dies at 02:14, while you sleep, at $200 rather than whatever the morning would have shown.
  • On Google Cloud, a budget can publish to Pub/Sub and a small function can disable billing on the project, which Google documents as “an efficient method to stop incurring costs in that project” (Google Cloud).
  • On Azure, a budget “can perform various actions when your budget threshold is met” through an action group, which is where a runbook that stops the resources would go (Microsoft Learn).

None of these is exotic. Each has existed for years. Each has to be switched on, and a budget without one is an email.

What it does not cover

A stop at the line catches a loop. It does not catch a leak: storage that grows a little every day never crosses a monthly line, it just moves the line a little each month. And the AWS form stops the role, not a person; someone with a different role can keep going. On Google Cloud the form is blunter, disabling billing for the whole project, which stops everything in it including what you wanted kept. Name what a control does not cover, or what you have is a feature list.

Five minutes

Whether your AWS account has a budget at all, whether it acts or only emails, whether an agent’s role reaches further than it should, and whether you could prove afterwards what it did: one read-only Python file answers all four in about five minutes, and nothing leaves your machine. That is the Agent Readiness Check. The budget action above is one of the published templates beside its finding, with the cost and the reversal stated inside it.