I once made a shim that would revoke a core permission of our system and halt some 80% of AWS usage if the spend went above a threshold.