A four person genomics startup in Tartu received a bill for 4,180 euros for a month in which they ran no experiments. The compute they had deliberately switched off had cost 90 euros. The rest was storage they had forgotten, addresses reserved and idle, and 2,600 euros of moving their own data between two regions they had put it in for redundancy. Nothing was faulty and nothing was hacked. They had bought a thing whose price is a function of behaviour rather than of equipment.
That is the change worth understanding before any console is opened. Owning hardware converts money into a fixed asset. Renting it converts every architectural decision into a recurring charge, and decisions made casually in week one arrive as a line item every month afterwards.
Three charges that are not the one people watch
The compute bill is the one everybody watches, and it is the one most easily controlled, because a machine that is off costs nothing. The three that catch people are quieter.
Egress is charged and ingress is usually free, which means data is cheap to put in and expensive to take out or move sideways. The Tartu team's 2,600 euros was almost entirely this: a nightly copy between two regions, running on a schedule nobody had revisited, charged per gigabyte in one direction. Redundancy is a real requirement and this was a real design decision, but nobody had costed it, and the same protection was available for a fraction by copying less often and only the things that could not be regenerated.
Storage is charged while it exists, not while it is used. A disk detached from a deleted machine keeps billing at the full rate, and snapshots taken automatically accumulate quietly. Roughly 700 euros of the bill was disks belonging to machines that had been destroyed months earlier.
A reserved address costs money when nothing is attached to it, which is the deliberate design of a scarce resource and reads as a billing error the first time it is seen. The remaining 790 euros was reserved addresses, automatic snapshots and the handful of small services that arrive switched on with a new account, none of them individually worth an argument and all of them recurring. This is the whole content of where cloud bills go wrong, and controlling them, and it is the cluster that most repays being read before the first month rather than after it. It is also the clearest example in the machines, the networks between them, and keeping both standing of a bill that is a design document.
The setting that prevents most of the damage
Two mechanisms exist and both are free. A budget alert fires when the projected month exceeds a figure you set, and it should be set on the day the account is opened rather than after a surprise. Cost allocation tags attach a label to every resource so the bill can be read by project rather than by service type, and a bill that cannot be read by project cannot be argued about.
The other setting is the one that turns a bad day into an incident. Least privilege in a cloud account decides what a leaked key can reach, and cloud credentials are leaked constantly, most often by being committed to a repository. A key that can only read one bucket is a nuisance. A key with account wide rights is somebody else's compute bill and your data, which is why who can do what, and least privilege is not an advanced topic here but a first week one.
What actually changes, and what does not
The concepts do not change. A virtual machine in a cloud is the same operating system with the same permissions and the same logs, and the skills from the rest of this pillar transfer directly, which is the honest version of what actually changes when it is not your hardware. What changes is that the network is now a configuration file rather than a cupboard of cables, and that everything is billed.
The genuinely new skill is knowing which of the several ways to run code is right, because they differ enormously in price and in what they demand. A machine you rent by the hour is familiar and never scales to zero. A container platform is the middle. A function that runs on demand costs nothing when idle and imposes real constraints on how the code is written. Choosing badly is expensive rather than broken, and the comparison is the subject of where your code actually runs.
Where people stall
The stall is the console. Each provider has hundreds of services with invented names, and the naming is not descriptive, so a newcomer cannot tell what any of them do and concludes the subject is enormous. It is not. Four things account for almost everything a small team needs: somewhere to run code, somewhere to keep data, a network definition and an identity system. Everything else is a specialisation, and the three, and the differences that matter is deliberately narrow for that reason.
The second stall is Kubernetes, adopted by teams who do not have the problem it solves. It is an excellent answer to running many services across many machines with a team to operate it. For four people and one application it is a second full time system to administer, and the honest advice is to arrive at it from a problem rather than from a job advertisement.
What to open, in 2026
Start on a free tier, and treat it as the classroom rather than the destination. All three major providers have one, all three are genuinely usable for learning, and all three will begin charging silently when a limit is crossed, which is the reason the budget alert is the first thing configured rather than the last.
For anything that is going to exist for more than a week, Terraform or OpenTofu describes the infrastructure as files that can be reviewed and destroyed cleanly. They replaced clicking through a console, which is fine for learning and produces a state that nobody can reproduce, audit or fully delete. OpenTofu is the open source fork and is free; the ability to run one command and be certain that everything created has been removed is worth the afternoon it takes to learn.
The storage decisions underneath all of this, in keeping data somewhere durable and the same concepts, defined in software, are where the recurring charges are actually set, and they are set in the first fortnight by people who do not yet know they are setting them. What none of this answers is who is awake when it breaks at three in the morning.