Spend limits don't cover existing AWS accounts yet. You can build most of the same protection today: budget actions that apply a deny policy or stop instances at a threshold, service control policies that keep accounts away from the most expensive services, lower quotas, and anomaly alerts. The setup, in order, and the gaps it leaves.
A budget on its own only sends email. Paired with an action, it can change what the account is allowed to do. The aim is not to stop production at a threshold but to stop new spending from starting, and to stop experiments outright.
Budgets at 50%, 80% and 100% of what you expect to spend, alerting a shared mailbox and a chat channel.
A budget action at 100% that attaches a deny policy to the roles people and pipelines use: no launching EC2 instances, no new databases, no new model endpoints. In an organization, apply a service control policy to the account instead, which also covers roles you forgot.
For sandbox accounts only, a second action that stops EC2 and RDS instances at the limit.
Service control policies that deny regions you don't use and expensive instance families nobody needs, so a stolen key can't start them in the first place.
Lower EC2 vCPU quotas in sandbox accounts, so the worst case is bounded.
Cost Anomaly Detection for the spend you didn't predict, and AWS Budgets alerts on specific services such as Bedrock.
No long-lived access keys and MFA on the root user.
Billing data updates a few times a day, so actions fire hours after spend crosses a threshold.
Storage and data transfer keep billing; a deny policy stops new resources, not traffic to existing ones.
Policies take care to write well: a deny that is too broad stops your own deployments at month end.
Unlike a spend limit, nothing here guarantees a hard ceiling. It narrows the worst case, which for most accounts is the goal.
We'll write the budgets, actions and policies as code, test that they fire, and make sure they don't stop production. 30 minutes, free.
Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.
Book a free 30-minute call about it. Bring your setup and your bill; you'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Or keep reading
AWS Spend Limits vs Budgets, Budget Actions and Cost Anomaly Detection: Which Stops a Runaway Bill
AWS now has four cost controls that sound alike and behave very differently. Budgets alert, budget actions apply a policy or stop EC2 and RDS instances, Cost Anomaly Detection flags unusual spend, and spend limits pause an entire project at a hard cap. What each one actually stops, how fast, and where each fits.
Read
AWS Spend Limits: The Limitations, and What to Do About Each
Spend limits only work on projects created through the new AWS signup experience, can't cover an existing account or an organization, can't spare production while stopping the rest, and pause everything at once. Each limitation, what it means in practice, and the workaround until AWS extends the feature.
Read
As of November 9, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.