AWS employs a whole lot of brilliant people, and they're an insanely profitable business unit.
I'm sure those people, given the appropriate motivation and opportunity, could provide a solution (or several) that avoids foot-gun data loss at every turn.
There's all sort of solutions they could go with.
As an idea, perhaps some kind of functionality within the billing side of things:
They could, perhaps, decide to just apply a basic cap functionality - when you reach that cap, it stops/disables all chargeable resources above the free-tier and gives you 72 hours to go raise the cap or they'll delete everything except things in their AWS Backup.
AWS can eat the storage cost for the stopped things without a noticable impact on revenue.
Perhaps a more advanced workflow-type setup:
When monthly spend reaches $x across all regions:
- stop all running instances that are not below the free-tier limit
- apply deny policies for per-request charged services
- send an email alert to the billing, tech and admin contacts.
When monthly spend reaches $y across all regions:
- Delete all chargable resources not tagged with 'Foo: bar'
- send an email alert to the billing, tech and admin contacts.
One of the other things that would be great, is to be able to apply limits to AWS Accounts.
For instance, the AWS Account that we give to developers to experiment on, it would be great to forbid them from starting baremetal instances, or GPU instances, etc.
Some of it can be controlled through deny rules, but not enough.
Billing alerts are also currently nowhere near responsive enough - it can be hours or days before you get told that some resource is running up your bill.
A comprehensive dashboard of 'here is every chargeable resource running in this account, in all regions, right now' wouldn't go astray, either.