Exploring Cost Data
Exploring Cost Data
Cost Explorer is the UI and API over your billing data: default reports cover the last 12 months (with longer history available on request), and you can filter and group by service, linked account, tag, region, or usage type to answer "what changed this month." Savings reports quantify the effect of RIs and Savings Plans, and the forecasting view projects spend from historical patterns.
The workflow that matters is drill-down: start at total spend, group by service, spot the delta, then group the culprit by tag or linked account until you find the resource owner. Tag-based grouping only works where tagging is enforced — missing tags show up as an unallocated blob that no dashboard can explain.
API and the Cost and Usage Report
API and the Cost and Usage Report
Programmatic access uses GetCostAndUsage with metrics, granularity (DAILY/MONTHLY), dimensions, and optional GroupBy on TAG or SERVICE — enough to build Slack digests or anomaly checks.
For line-item truth, enable the Cost and Usage Report (CUR): hourly, per-resource records delivered to S3 (Parquet with compression recommended), queryable in Athena and loadable into QuickSight. The CUR is what finance reconciles against — Cost Explorer aggregates, the CUR itemizes. Set it to refresh daily and include resource IDs when you need to trace a single expensive instance back to a line item.
Pitfalls and Interview Focus
Pitfalls and Interview Focus
Both views lag: expect up to roughly a day before new spend appears — last-minute month-end spikes may land after your dashboard review, so schedule reviews accordingly. Metric choice changes the story: unblended shows charges as recorded (an all-upfront RI hits one month), while amortized spreads commitment cost across its term — comparing months without amortization produces phantom volatility.
Other traps: forgetting credits and taxes distort percentages; CUR files arrive on their own cadence and schema changes over time (version your Athena table); cost allocated to shared accounts (network, shared services) needs a split-back model or every team misreads its bill.
Interview: name the lag, distinguish unblended vs amortized, and cite CUR as the source of truth for line-item questions.
Quiz
1. Which report gives per-resource, per-hour billing line items?
2. Why does an all-upfront RI distort monthly cost comparisons?
3. You group by tag and see a large "null" bucket. What is the real problem?
Flashcards
Question
Cost Explorer
Click to reveal answer
Answer
Aggregated cost/usage views with filters, groupings, savings reports, and forecasts; ~daily lag.
Question
CUR
Click to reveal answer
Answer
Hourly per-resource billing line items in S3 — source of truth, Athena-friendly Parquet.
Question
Unblended vs amortized
Click to reveal answer
Answer
Unblended = as-charged; amortized = commitments spread across term for fair comparisons.
Question
GetCostAndUsage
Click to reveal answer
Answer
CE API returning metrics grouped by service/tag/account at daily/monthly granularity.
Question
Allocation prerequisite
Click to reveal answer
Answer
Enforced resource tagging — otherwise cost cannot be attributed to teams.
Revision Notes
Key Takeaways
- 1. Drill down: total → service → tag/account until you find the owner
- 2. CUR for line-item truth, Cost Explorer for exploration, amortized for honest trends
- 3. Everything billing-related lags — plan reviews around it
Interview Tips
- • Explain your investigation path for a cost spike using CE groupings concretely
- • Be ready with unblended vs amortized — a favorite screening question for FinOps awareness
Cheat Sheet
CE: filter/group by service+tag, ~daily lag; drill total→service→tag. CUR in S3 = line-item truth (Parquet→Athena). Amortized for commitments vs unblended; enforce tags for allocation.