Well, first of all, there are default limits on everything that prevents you from racking up too huge bills (25 running EC2 instances, for instance). You have to go out of your way to get them raised.
Second, they pretty much only charge per resource usage: CPU time, network traffic, and storage. Consume neither of those, and it is free. So it is free to set up really complicated virtual networks in the VPC part of the console, but you start paying once traffic flows in that network.
The only insanely expensive part that you'd hate to enable is the "Dedicated IP Custom SSL" option in CloudFront, because that is $600 per month, as per their documentation[0].
> Because of the added cost associated with dedicating IP addresses per SSL certificate, we charge a fixed monthly fee of $600 for each custom SSL certificate you associate with your CloudFront distributions, pro-rated by the hour.