All cheat sheets
Cost Governancecheat sheet

AWS Cost Explorer

If Budgets is the alarm clock, Cost Explorer is the magnifying glass — the free console for slicing 12 months of spend by service, tag, and account. Enable it day one, start broad and drill down; it turns a multi-hour mystery into a 5-minute investigation.

Last reviewed: July 14, 2026

Prefer step by step? Take the guided AWS Cost Explorer walkthrough — free, anonymous, interactive.Have an AI assistant? Jump to the copy-paste audit prompt at the bottom of this sheet.

TL;DR: When the bill spikes, Cost Explorer is where you find what drove it, when it started, and whether it's still happening — every other AWS cost tool is built on the same data. It's free but not enabled by default: one click, ~24 hours to populate, and it only accumulates data forward. Enable it on day one of every account even before anything is running. The core skill is the drill-down rhythm: start broad, zoom in — never the reverse.

The numbers

  • Granularity: monthly and daily are free (daily is the right default for investigation); hourly + resource-level is paid ($0.01/1,000 records + ingest) and must be enabled preemptively since it only retains forward.
  • Forecasting: projects up to 12 months but needs ~5 weeks of history to converge and assumes current patterns continue (it won't price in a planned launch — use the Pricing Calculator for that).
  • API: GetCostAndUsage etc. cost $0.01 per paginated request — cheap but real; for high-volume dashboards use CUR exports instead.
  • Field examples: a $4,000 data-transfer spike traced in ~5 minutes (daily → service → usage type → region revealed a cross-region S3 pull); tag-based grouping surfaced one team's forgotten $20k/mo staging cluster.

Do this

  1. Enable Cost Explorer immediately — the data accumulation is the gift; you want 12 months of context waiting when you eventually need it.
  2. Run the drill-down for any surprise: monthly by service (6 mo) → daily by service (60 days) → filter suspect service, group by usage type → filter further, group by account/tag → (optional) hourly + resource. Each step roughly halves the search space.
  3. Activate cost allocation tags now — tagging resources is step one, activating the tag keys in Billing is the step people miss; only activated tags become groupable, and only forward.
  4. Save 3–5 canonical Reports (monthly by service, daily EC2, top tagged projects, RI/SP coverage, untagged spend) so anyone answers "how are we doing?" in 30 seconds.
  5. Glance at Rightsizing Recommendations once, then rely on Compute Optimizer for ongoing rightsizing (broader and better; both free).

Gotchas

  • "No data" = you didn't enable it (or it's within the ~24h populate window).
  • Tags don't appear in grouping until activated as cost allocation tags — a separate step from creating them, ~24h to apply, forward-only.
  • Numbers won't exactly match the invoice — Cost Explorer amortizes RIs/SPs by default; toggle Unblended vs Amortized vs NetUnblended as needed.
  • Up to ~24h lag — no real-time data; use Cost Anomaly Detection for proactive alerts and CloudWatch billing alarms for crude real-time.

Skip this if

Run this audit with your AI assistant

Paste this into Claude, ChatGPT, or any agent that can run the AWS CLI with read-only credentials. It audits your account for exactly the waste this sheet describes — and changes nothing.

You are auditing an AWS account/Org's Cost Explorer readiness and using
it to investigate spend. Use the AWS CLI with READ-ONLY credentials. Do
not create, modify, or delete anything — report findings and recommended
(unapplied) fixes only.

1. Enablement: confirm Cost Explorer is enabled (ce get-cost-and-usage
   returns data). Flag if hourly+resource granularity and any cost
   allocation tags are NOT yet activated (they only apply forward — the
   cost of not enabling early is missing history).
2. Month-over-month scan: ce get-cost-and-usage DAILY, 60 days, group by
   SERVICE — identify the service and day where a step-change or spike
   began.
3. Drill down: for the suspect service, group by USAGE_TYPE, then
   LINKED_ACCOUNT / tag, to localize the driver (region-boundary transfer,
   forgotten instance, verbose logs, etc.).
4. Coverage: run the Savings Plans / RI coverage + utilization reports;
   flag large uncovered steady usage and under-utilized commitments.

Report: enablement gaps, the drill-down chain that localizes the top
cost driver, and a list of 3-5 saved reports worth creating (monthly by
service, daily EC2, top tagged projects, RI/SP coverage, untagged spend).
Change nothing.
Works with any assistant that can run shell commands.

Want the guided version?

The AWS Cost Explorer walkthrough covers this topic interactively — it asks about your setup, branches to what’s relevant, and quizzes you on the tricky parts. Free and anonymous.

Start the walkthrough

More Cost Governance cheat sheets

AWS Billing Conductor

Billing Conductor restructures how a bill is allocated and presented internally — pro-forma invoices with custom rates, markups, and line items — without changing what AWS actually charges. It's an accounting tool for MSPs and complex chargeback, not a savings tool.

AWS Budget Actions

A regular budget emails you; a Budget Action does the thing for you — attach a deny-IAM policy, apply an SCP, or stop tagged EC2/RDS when a threshold breaks. The difference between an alarm and a circuit breaker, and it costs nothing extra.

AWS Budgets

The one cost-governance feature to set up first: a threshold plus a notification that pings you before the bill lands. Forecasted-80% is the single most effective alert AWS offers; first two budgets are free.

AWS Cost and Usage Reports

Cost Explorer is a dashboard; CUR is the database. Every billing line item — one resource × one hour × one usage type, hundreds of columns — dumped to S3 for Athena/QuickSight when the question doesn't fit Cost Explorer's dropdowns. Use CUR 2.0 via Data Exports.