Cost Management

AWS Cost Explorer is the primary tool for visualizing and analyzing AWS costs. It provides a graphical interface showing spending trends over time with filtering and grouping capabilities.

Filtering enables granular cost analysis. Filter by service (EC2 vs S3 vs RDS), account (production vs staging), region (us-east-1 vs eu-west-1), usage type (BoxUsage vs DataTransfer), and tag (Environment=production). A common analysis: filter to EC2 costs in production us-east-1, group by instance type, to identify which instance families drive the most spend.

Grouping reveals cost distribution. Group by linked account to see which team spends the most. Group by usage type to distinguish between instance hours, data transfer, and storage. Group by tag to allocate costs by project, department, or environment. The stacked bar chart shows how each group contributes to total cost over time.

Forecasting uses historical data to predict future spending. Cost Explorer's forecast shows projected monthly cost based on the current trajectory. If you've spent $5,000 in the first 15 days of the month and the forecast shows $12,000, you know you're trending 20% over budget. This early warning enables corrective action before the month ends.

Reserved Instance recommendations analyze your On-Demand usage and suggest RI purchases. If you consistently run 10 t3.large instances 24/7, Cost Explorer recommends a 1-year or 3-year RI, showing projected savings. The recommendations include break-even analysis—when the RI investment pays for itself compared to On-Demand.

Cost Explorer is free for all AWS customers. It provides 12 months of historical data by default. Enable Cost Explorer in each account and region. Data updates approximately every 24 hours, so today's costs appear tomorrow. For real-time cost visibility, use Cost Explorer with Cost and Usage Reports.

AWS Budgets creates custom cost and usage thresholds with automated notifications. Unlike Cost Explorer (passive visualization), Budgets is active monitoring—when spending exceeds a threshold, stakeholders receive alerts.

Cost budgets set a monthly spending limit. Create a budget of $10,000/month for the production account. Configure alerts at 80% (warning) and 100% (critical). Notifications go to email, SNS topics (which can trigger Lambda functions), or Amazon Chatbot (Slack/Teams). The 80% alert gives the team a week to investigate before hitting the limit.

Usage budgets track resource consumption. Limit EC2 running instances to 50, or S3 storage to 1TB. When usage approaches the limit, investigate whether capacity planning or cost optimization is needed.

RI/SP utilization budgets monitor how effectively you're using purchased commitments. An RI utilization budget triggers when utilization drops below 80%, indicating you're paying for Reserved Instances you're not fully using. This might trigger a recommendation to change instance families or consolidate workloads.

RI/SP coverage budgets show how much of your eligible usage is covered by commitments. If your coverage is 60%, 40% of your On-Demand usage could be covered by RIs or Savings Plans for additional savings. Coverage budgets help you size your next RI or SP purchase.

Savings Plans budgets track commitment utilization and coverage specifically for Compute Savings Plans, EC2 Instance Savings Plans, and SageMaker Savings Plans. These budgets answer: am I using what I bought, and am I buying what I need?

Budget actions can automatically respond to cost overruns. When a budget exceeds 100%, trigger an SCP that prevents launching new resources, or execute a Lambda that stops non-production instances. Budget actions require proper IAM permissions and should be tested carefully—accidentally stopping production instances is worse than overspending.

Cost and Usage Reports (CUR) are the most granular cost data available. While Cost Explorer provides pre-aggregated views, CUR provides line-item-level detail for every resource, every hour. This enables custom analysis, chargeback, and compliance reporting.

CUR generation: Enable CUR in the billing console. Choose the report granularity (hourly, daily, or monthly), include resource-level data, and specify an S3 bucket for delivery. CUR files are delivered in compressed CSV or Parquet format. Enable CUR2 for enhanced data including cost allocation, resource allocation, and data quality summary.

Athena integration enables SQL queries against CUR data. CUR is delivered to S3 as partitioned Parquet files. Create an Athena table using the AWS-provided crawler or Glue table definition. Then query: SELECT line_item_product_code, SUM(line_item_unblended_cost) AS total_cost FROM cur_table WHERE line_item_usage_start_date >= DATE '2024-01-01' GROUP BY line_item_product_code ORDER BY total_cost DESC. This reveals cost distribution across services.

Common CUR queries include: cost by service per month (chargeback), cost by tag per project (showback), RI/SP utilization analysis (optimization), data transfer costs by region (network optimization), and unused resource identification (idle cost detection).

Cost allocation tags enhance CUR analysis. Activate tags in the Billing console and CUR includes them as columns. Tags like CostCenter, Project, and Environment enable chargeback to teams and departments. Note: tags take 24-48 hours to activate and apply retroactively to CUR data.

Example scenario: A company with 20 AWS accounts generates CUR data. An Athena query joins CUR with a cost allocation tag to produce a monthly report showing each team's spending by service. The finance team uses this for budget allocation, while engineering uses it to identify optimization opportunities (e.g., a team spending $5,000/month on unused Elastic IPs).