When RDS Proxy Eats 70% of Your Total CloudWatch Ingestion Cost

Pulling up a client’s Cost Explorer, I found RDS Proxy responsible for 70% of their total CloudWatch Logs ingestion cost — while their actual “RDS Proxy” line item looked completely normal. The line item said normal. The bill said otherwise. My first reaction, and the first reaction of nearly every client I’ve shown this number to, is always the same: “I’m already paying for RDS Proxy by the vCPU-hour — why is it also eating into my CloudWatch bill? Aren’t those two completely separate things?”