# AWS cost updates, October 2026: audit kit

Companion files for the blog post
[AWS Cost Updates, October 2026](/blog/aws-cost-updates-week-of-october-23-2026/).

| File | What it is |
| --- | --- |
| `cost-audit.sh` | Read-only AWS CLI script. Lists ALBs that front a single ECS service, Lambda functions with recursive loop detection turned off, DynamoDB global table replicas, ECS task definitions that reserve whole GPUs, EMR on EKS virtual clusters, and Aurora Serverless PostgreSQL clusters capped at 256 ACUs. |
| `ecs-gateway-consolidation.drawio` | Editable draw.io source for the ALB consolidation diagram in the post. |

## Run the audit

Needs AWS CLI v2, `jq`, and bash 4 or later (macOS ships bash 3.2; `brew install bash`).

```bash
curl -O https://www.joinhorizon.co/examples/architecture-blog-2026/aws-cost-updates-week-of-october-23-2026/cost-audit.sh
chmod +x cost-audit.sh
REGION=us-east-1 ./cost-audit.sh
```

The IAM principal needs these read permissions: `ecs:ListClusters`, `ecs:ListServices`,
`ecs:DescribeServices`, `elasticloadbalancing:DescribeTargetGroups`, `lambda:ListFunctions`,
`lambda:GetFunctionRecursionConfig`, `dynamodb:ListTables`, `dynamodb:DescribeTable`,
`ecs:ListTaskDefinitionFamilies`, `ecs:DescribeTaskDefinition`, `emr-containers:ListVirtualClusters`,
`rds:DescribeDBClusters`.

## Expected output shape (illustrative numbers)

```text
Region: us-east-1

== 1. ALBs fronting ECS services ==
  orders-alb                                    ecs_target_groups=1
  ...
  ALBs serving exactly one ECS target group: 12
  Hourly charge on those ALBs: ~$197.10/month (LCUs excluded)
...
```

The dollar line multiplies the ALB count by `ALB_HOURLY` (default `0.0225`, the us-east-1
list price in October 2026) and 730 hours. Set `ALB_HOURLY` for other Regions. It excludes
LCU charges, which move with traffic rather than with ALB count.

## Diagram flow

1. Before: each ECS service has its own Application Load Balancer, so 25 services carry 25 hourly ALB charges.
2. After: Amazon ECS Gateway places up to 25 `awsvpc` services behind one shared ALB with host-based listener rules and a generated `*.ecs.<region>.on.aws` hostname per service.
3. The gateway itself has no charge. The ALB, ACM certificates, CloudWatch, and data transfer bill as usual.