Study guide
Technical reference and lesson notes
Purpose of This Lesson
AWS provides several cost management tools for understanding spend, detecting unexpected charges, setting financial controls, and exporting detailed billing data for analysis. The key exam skill is choosing the right tool for the required level of visibility and automation.
Key Concepts
AWS Cost Explorer
AWS Cost Explorer is an interactive console tool for analyzing historical and current AWS costs and usage. It is usually the best starting point when investigating an unexpected bill.
You can analyze costs using filters and dimensions such as:
- Time range: Compare monthly or custom periods.
- Granularity: View data at a monthly or more detailed interval when available.
- Service: Identify charges from Amazon EC2, Amazon S3, AWS Lambda, and other services.
- Linked account: Break down spending across accounts in AWS Organizations.
- AWS Region: Determine where charges are being generated.
- Instance type and usage type: Investigate more specific usage patterns.
- Cost allocation tags: Attribute spending to applications, departments, teams, or owners after the tags have been activated for billing.
Cost Explorer supports aggregation and chart-based analysis, and its data can be exported as CSV for additional review.
Use Cost Explorer for interactive investigation and reporting—not as the primary source for highly granular raw billing data.
AWS Budgets
AWS Budgets lets an organization define planned cost or usage thresholds and receive notifications when actual or forecasted values approach or exceed those thresholds.
Budgets are useful for:
- Alerting a team when spending exceeds a defined amount.
- Monitoring usage against a planned limit.
- Tracking costs for an account, service, tag, or other supported scope.
- Providing early warning before a financial target is exceeded.
A budget is a control and alerting mechanism. It is different from Cost Explorer, which is primarily an analysis tool.
Depending on the configuration, budget notifications can be sent through Amazon SNS and can support automated responses. However, a budget does not automatically make an application cost-efficient merely because an alert exists.
AWS Cost and Usage Reports
The AWS Cost and Usage Report (CUR) provides highly detailed billing and usage records. Reports are delivered to an Amazon S3 bucket and can be processed by analytics systems.
A CUR can include information such as:
- Account and resource identifiers.
- Product and service codes.
- Usage types and quantities.
- Timestamps and billing periods.
- Unblended, blended, or other billing-related cost fields, depending on configuration.
- Discounts, credits, taxes, and line-item details.
CUR is appropriate when an organization needs a durable, granular billing dataset for custom analytics, chargeback, showback, or financial operations. The output is not optimized for manually browsing in the console. It commonly requires downstream processing with services or tools such as Amazon Athena, AWS Glue, Amazon QuickSight, or third-party FinOps platforms.
Reports are delivered asynchronously, so they should not be treated as an immediate real-time billing feed.
AWS Cost Anomaly Detection
AWS Cost Anomaly Detection uses machine learning and historical spending patterns to identify unusual cost behavior. It is useful when the organization wants AWS to detect spending that deviates from expected patterns rather than relying only on fixed thresholds.
This complements AWS Budgets:
- Budgets: Alert on defined thresholds or forecasts.
- Cost Anomaly Detection: Identify statistically unusual spending patterns.
- Cost Explorer: Investigate the services, accounts, Regions, or usage categories behind the spending.
Rightsizing Recommendations
AWS provides rightsizing recommendations, particularly for Amazon EC2, to help identify resources that may be oversized relative to observed utilization. These recommendations can support cost reduction, but they must be evaluated against performance, availability, scaling, and workload variability requirements.
A recommendation is not automatically safe to implement. Production workloads should be validated before changing instance types or capacity.
Savings Plans and Reservations
AWS offers commitment-based pricing options, including Savings Plans and Reserved Instances. These can reduce costs when usage is sufficiently stable and predictable.
The decision should account for:
- Expected usage stability.
- Commitment term and payment option.
- Flexibility requirements.
- Scope and eligibility of the commitment.
- Risk of paying for unused commitment.
Commitments reduce unit cost but can reduce financial flexibility. They are not a substitute for understanding actual usage first.
Cost Allocation Tags
Cost allocation tags help associate AWS charges with business or technical ownership, such as a department, project, environment, or application. Tags must be applied consistently and activated for cost allocation before they can be used for billing analysis.
Tags are particularly useful for:
- Showback and chargeback.
- Department-level reporting.
- Environment cost comparisons.
- Identifying owners of unexpected usage.
Tagging does not retroactively fix poor cost attribution in every situation, and not all charges map neatly to a resource-level tag. Organizations should combine tagging with account and service boundaries where stronger isolation is required.
Exam-Relevant Takeaways
- Start an unexpected-bill investigation in Cost Explorer for interactive breakdowns by service, account, Region, usage type, instance type, or activated cost allocation tag.
- Use AWS Budgets to define spending or usage targets and generate threshold or forecast notifications.
- Use Cost Anomaly Detection to identify unusual spending patterns using machine learning.
- Use AWS Cost and Usage Reports when detailed line-item billing data must be delivered to Amazon S3 for custom analysis.
- Cost Explorer is optimized for human investigation; CUR is optimized as a detailed data source for analytics pipelines.
- AWS Organizations linked-account filtering helps identify which account generated a charge.
- Rightsizing recommendations can reduce waste, but recommendations must be checked against workload requirements.
- Savings Plans and Reserved Instances are appropriate for predictable usage, but commitments create a risk of underutilization.
- Cost allocation tags require consistent tagging and activation for billing use.
Architecture Decision Guide
| Requirement | Best-fit AWS capability | Reason |
|---|---|---|
| Investigate an unexpected monthly bill interactively | Cost Explorer | Provides filters, dimensions, aggregation, charts, and CSV export |
| Alert when spending approaches a planned threshold | AWS Budgets | Supports cost or usage thresholds and notifications |
| Detect spending that deviates from normal behavior | Cost Anomaly Detection | Uses machine learning and analytics to identify unusual cost patterns |
| Export granular billing line items to a data platform | Cost and Usage Report | Delivers detailed billing data to Amazon S3 |
| Attribute spend to teams or applications | Cost allocation tags | Enables cost analysis by activated billing tags |
| Find potentially oversized EC2 resources | Rightsizing recommendations | Highlights possible reductions based on observed utilization |
| Reduce unit price for stable, known usage | Savings Plans or Reserved Instances | Uses a commitment in exchange for discounted pricing |
Common Exam Traps
- Confusing Budgets with Cost Explorer: Budgets alerts on configured targets; Cost Explorer helps investigate and visualize spending.
- Choosing CUR for a quick console investigation: CUR is more detailed but is delivered to S3 and is better suited to programmatic or analytics workflows.
- Assuming anomaly detection replaces budgets: Anomaly detection looks for unusual behavior; it does not represent a specific financial limit.
- Assuming tags work automatically for billing: Tags must be consistently applied and activated as cost allocation tags.
- Assuming a budget automatically stops all spending: A budget primarily provides notifications. Any automated enforcement requires additional configuration and must be designed carefully.
- Buying commitments before analyzing usage: Savings Plans and Reserved Instances can become wasteful if demand changes or the organization overcommits.
- Treating rightsizing recommendations as mandatory actions: A lower-utilization resource may still require capacity for bursts, failover, licensing, memory, network, or performance constraints.
- Expecting CUR data to be real time: Billing reports are generated and delivered asynchronously.
Real-World Engineer Notes
- Establish a cost investigation workflow: use anomaly alerts or budget notifications to trigger an investigation, then use Cost Explorer to locate the responsible service, account, Region, or usage type.
- Use separate AWS accounts for strong ownership and governance boundaries, and use tags for finer-grained attribution within those accounts.
- Store CUR data in a controlled S3 bucket with appropriate encryption, access policies, retention, and lifecycle management.
- Build reporting around business dimensions such as application, environment, owner, and department rather than relying only on AWS service totals.
- Review commitment utilization regularly. A discounted rate is not economical if the committed baseline is consistently unused.
- Treat cost as an operational signal. Sudden increases may indicate a deployment error, runaway workload, missing lifecycle policy, abuse, or a legitimate business event.
Quick Reference Summary
- Cost Explorer: Explore and filter costs interactively.
- AWS Budgets: Alert on planned cost or usage thresholds.
- Cost Anomaly Detection: Detect unusual spending patterns.
- Cost and Usage Report: Export detailed billing data to S3.
- Cost allocation tags: Attribute costs to owners, teams, and workloads.
- Rightsizing recommendations: Identify potentially oversized resources.
- Savings Plans and Reserved Instances: Reduce costs through usage commitments.
Flashcards
- Q: What is the best first tool for investigating an unexpected AWS bill?
A: Cost Explorer, because it provides interactive breakdowns by service, account, Region, usage type, and other dimensions.
- Q: What is the primary purpose of AWS Budgets?
A: To track cost or usage against configured thresholds and send notifications when actual or forecasted values approach or exceed them.
- Q: What distinguishes Cost Anomaly Detection from AWS Budgets?
A: Budgets use defined targets, while Cost Anomaly Detection identifies unusual deviations from expected spending patterns.
- Q: Where are AWS Cost and Usage Reports delivered?
A: To an Amazon S3 bucket.
- Q: When should an organization use CUR instead of Cost Explorer?
A: When it needs detailed line-item billing data for custom analytics, chargeback, showback, or downstream processing.
- Q: Which Cost Explorer dimensions can help identify account ownership?
A: Linked accounts in an AWS Organizations structure.
- Q: What must be done before tags can be used for billing analysis?
A: Tags must be consistently applied and activated as cost allocation tags.
- Q: What is the main financial risk of Savings Plans or Reserved Instances?
A: Committing to more usage than the organization actually consumes.
- Q: Are rightsizing recommendations guaranteed to be safe changes?
A: No. They must be validated against performance, availability, scaling, and workload requirements.
- Q: Is a Cost and Usage Report designed primarily for manual browsing?
A: No. It is a detailed dataset better suited to analytics tools and automated processing.
Practice Questions
Question 1
A company receives an alert that its AWS spending has increased unexpectedly. The finance team wants to identify the responsible service and AWS account using an interactive console experience. Which solution best meets the requirement?
A. Create a Cost and Usage Report and wait for the next report delivery
B. Use Cost Explorer and filter by service and linked account
C. Purchase a Savings Plan for the account with the highest spend
D. Use rightsizing recommendations to identify the source of the charge
Correct answer: B
Explanation: Cost Explorer is designed for interactive investigation and supports filters such as service and linked account. CUR is more detailed but is delivered to S3 and is better suited to downstream analysis.
Question 2
A financial controller wants an alert whenever monthly spending is forecast to exceed a department’s approved budget. Which AWS capability should the architect recommend?
A. AWS Budgets
B. Cost Anomaly Detection
C. Cost Explorer CSV export
D. EC2 rightsizing recommendations
Correct answer: A
Explanation: AWS Budgets supports planned cost thresholds and can notify stakeholders based on actual or forecasted spending. Cost Anomaly Detection is intended to identify unusual spending behavior, not enforce a specific approved budget.
Question 3
An enterprise wants to load detailed AWS billing line items into its analytics platform for chargeback reporting across hundreds of accounts. Which solution is most appropriate?
A. Use Cost Explorer dashboards manually each month
B. Configure a Cost and Usage Report to deliver data to Amazon S3
C. Configure only a monthly AWS Budget
D. Enable EC2 rightsizing recommendations
Correct answer: B
Explanation: CUR provides granular billing and usage records in S3, making it appropriate for automated processing and enterprise chargeback analytics.
Question 4
A company wants to detect an unusual increase in spending even if the increase has not crossed a predefined monthly budget threshold. Which capability should it use?
A. AWS Budgets only
B. Cost Anomaly Detection
C. Reserved Instances
D. Cost allocation tags only
Correct answer: B
Explanation: Cost Anomaly Detection uses machine learning and historical patterns to identify spending that is unusual relative to expected behavior. Budgets are based on configured thresholds or forecasts.
Question 5
A team wants to analyze costs by application and department in Cost Explorer. Engineers have applied tags to resources, but the tags do not appear as billing dimensions. What should the team do?
A. Replace Cost Explorer with Cost Anomaly Detection
B. Activate the tags as cost allocation tags and ensure resources are tagged consistently
C. Purchase Reserved Instances for each application
D. Export only monthly invoices from the Billing console
Correct answer: B
Explanation: Resource tags must be activated for cost allocation before they can be used for billing analysis. Consistent tagging is also required for meaningful attribution.