Expired AWS login hid a running EC2 outside the CloudFormation stacks

aws sts get-caller-identity failed with session expired, so a cost check could not start until aws login --region us-east-1 completed in the local shell. After login, CloudFormation showed idle CDK stacks (Lambda, Step Functions, DynamoDB) and no NAT, RDS, ECS, or EKS. The only running compute was one t3.medium EC2 whose only tag was Name, so it was not a stack resource. stop-instances took it to stopped. The 8 GiB gp3 volume stayed attached, and the stacks were left deployed because they were not a running service.