When you create a Bedrock Knowledge Base, AWS silently provisions OpenSearch Serverless at $345/month. The charge appears under a different service name. When you delete the KB, the collection keeps billing. Five real incidents, detection SQL, a fix checklist โ and why AWS's new Bedrock cost attribution doesn't catch it.
Token consumption can spike 18ร above your rolling baseline in 48 hours. Standard FinOps alerts won't catch it. Real incidents from a $15 test to a $500M monthly bill, the FOCUS-native detection SQL, and a three-layer fix for the engineer who built it, the analyst who watches the bill, and the manager who owns the outcome.
SageMaker real-time endpoints can't scale to zero โ they bill $1,014+/month whether they receive 0 requests or 10,000. The charge is invisible in standard billing data until you join it with CloudWatch. Five real incidents, detection SQL, and a fix checklist for the engineer who deployed it, the analyst watching the bill, and the manager who owns the outcome.
A Google Maps key gained Gemini scope without the owner knowing. 48 hours, $82,314. 2,863 live exposed keys in Common Crawl. AWS Bedrock API keys carry identical risk. The FOCUS-native detection query, the three conditions that distinguish attacks from legitimate first-day usage, and a full incident response checklist.
Input token consumption climbs 15%+ month over month as developers add few-shot examples, safety rules, and RAG context across sprints โ invisible to standard dashboards that watch total Bedrock spend. Four real incidents ($800 to $8,400/month), the FOCUS-native two-window detection query, and a fix checklist for engineers, FinOps practitioners, and engineering leaders.
The new wave of AI cost agents forces one of three trades to see your whole org's spend โ lose cross-account visibility, install tooling in your management account, or send billing data to a vendor. There is a fourth path: read the org's own FOCUS export from inside your own account, with no management-account workload and no data egress. Four real incidents, AWS's own management-account guidance, and a decision checklist for builders, FinOps practitioners, and engineering leaders.