As you can see below, through a cross-account role a third-party vendor started to make WAY more requests than usual, which kickstarted my billing nightmare.
This function is part of an abandoned open-source project that I contributed to in the past. It is triggered on every CloudTrail event, except on aws.kms and aws.logs events, as per the screenshot.
All right, I think I finished my investigation 馃攳.
聽
Right away I noticed that a Lambda Function was being constantly triggered based on the fact it was executing CreateLogStream multiple times per second. The CloudWatch Logs corroborated that.