Billing data has a delay

AWS says budget information updates up to three times daily, typically 8–12 hours apart. It also warns that usage can exceed a notification threshold before the alert arrives. A threshold is therefore not a promise that your bill stops there.

Sources[1] AWS

An action is an extra configuration

Budget actions can apply IAM or service control policies, or target particular EC2 and RDS instances. You choose automatic execution or manual approval. The available controls act on configured targets; they are not an account-wide instant stop button.

Sources[2] AWS

Test the guardrails before the workload

Use early alerts, confirm recipients and review action permissions. Test what an action actually stops in a small environment, then inspect resources that continue billing. Our takeaway: treat alerts as one layer of cost control.