I have a workflow I run on every AWS account I audit. It looks like this:
- Cost Explorer, last 30 days, daily granularity, grouped by usage type, not service.
- Spot the top three line items.
- Check whether the customer's mental model of their bill matches what is actually spending money.
Step three is where most of the work is. The customer almost always knows their bill total. They almost never know which usage types are driving it. "We are an RDS shop" turns into "actually CloudFront is your second-biggest line and you did not know."
This is not a Cost Explorer trick. It is a discipline. The bill at the service level hides too much.
An example
Service-level says EC2 is $80,000 a month. Usage-type level says $30,000 of that is BoxUsage:m5.large (your fleet), $25,000 is DataTransfer-Regional-Bytes (your cross-AZ traffic), $15,000 is CW-LogIngestion (your verbose logging), and $10,000 is everything else.
Three of those four numbers are leverage points. One of them is just the workload. The customer cannot see this from the service-level bill.
What I do
- Cost Explorer grouped by usage type, sorted descending, top 20.
- Anything that surprises me, I dig into the underlying CUR row.
- Anything that does not surprise me, I leave alone for now.
The Kulshan cost pack does most of this automatically. But for the larger accounts I work with, I always run the manual pass alongside. The tool catches patterns. The manual pass catches the things I have not taught the tool to catch yet.
If you are reading the bill and not Cost Explorer, you are reading a summary of a summary. Drop a layer.
Back to all posts