[nybble41]

For data out I have some alerts set similar to yours to shut down the instance if NetworkOut becomes unusually high—over three different time scales. Since the alerts are delayed, though, I also set up traffic shaping rules in the VM to throttle the NetworkOut to something reasonable so that it doesn't incur a huge bill before the first alert triggers. Officially the VMs have 5 Gbps network links; at that rate you can accumulate quite a large bill in a very short time if the VM starts saturating the link.