Budget alert: this month's AWS bill has already tripled, with no increase in storage

The Agence Mourafaqa Numérique (a fictional public body) digitizes the paper archives of several administrations. OCR servers (Auto Scaling group asg-ocr, 6 instances) read the scans in the S3 bucket mourafaqa-scans-bruts, produce indexed PDFs and write them to mourafaqa-archives-pdf, in the same region.

On 30 September, to satisfy an audit, the OCR servers were moved from public subnets to private subnets; they now go out through a NAT gateway.

This morning, AWS Budgets sent an alert: USD 2,400 spent against a monthly budget of USD 900. The finance department is asking for an explanation and a fix before the end of the week.

You are on your workstation with the AWS CLI v2 (region eu-west-3, read access to billing).