Cost-Optimized Architecture Design · Topic 8 of 8
Cost Reporting, Monitoring and Observability
Analyze billing data with Cost Explorer and CUR 2.0, alert with AWS Budgets and Cost Anomaly Detection, and cut CloudWatch log, metric and retention costs.
- 6 min
- Cost Explorer is for interactive analysis and forecasts, and CUR 2.0 is for line item detail in S3.
- Budgets alerts on actual or forecasted spend, and budget actions can apply IAM policies or SCPs or stop EC2 and RDS instances.
- Cost Anomaly Detection uses machine learning and can monitor services, accounts, tags or cost categories.
What it is
Cost control needs detailed billing data, alerts that fire before a bill surprises anyone, and observability that is not a large bill of its own.
The tool choice depends on the question. Interactive analysis points to Cost Explorer, line item detail points to the Cost and Usage Report, a fixed limit points to AWS Budgets, and unexpected spikes point to Cost Anomaly Detection.
How it works
Cost Explorer
Cost Explorer gives interactive charts of cost and usage, filtered and grouped by service, account, Region, tag or cost category. It includes forecasts and reports on Savings Plans and Reserved Instance utilization and coverage, which show whether commitments are used and how much usage they cover.
Daily and monthly views come by default, and hourly granularity can be turned on for an extra charge. Cost Optimization Hub collects rightsizing, idle resource and commitment recommendations across the organization in one place.
Cost and Usage Reports through Data Exports
The Cost and Usage Report is the most detailed billing data AWS provides, with line items by hour, resource, usage type, pricing and tags. It is delivered through Data Exports as CUR 2.0, and Data Exports also offers a FOCUS format export.
Exports land in an S3 bucket, ideally in Parquet format, for querying with Amazon Athena and dashboards in a BI tool. In an organization, create the export in the management account to see every member account's cost.
| Need | Tool |
|---|---|
| Quick trends, filters and forecasts | Cost Explorer |
| Commitment usage and coverage | Cost Explorer utilization and coverage reports |
| Line item, resource level analysis and custom chargeback | CUR 2.0 in S3 with Athena |
| Recommendations across accounts | Cost Optimization Hub |
AWS Budgets
AWS Budgets tracks cost, usage, and Savings Plans or Reserved Instance utilization and coverage against a target. Alerts fire on actual or forecasted values at thresholds you choose, for example 80% actual and 100% forecasted.
Notifications go to email or an Amazon SNS topic, and through SNS to Slack or Microsoft Teams with Amazon Q Developer in chat applications. Budget actions can respond automatically by applying an IAM policy or an SCP, or by stopping specific EC2 or RDS instances. Actions can run automatically or wait for approval.
AWS Cost Anomaly Detection
Cost Anomaly Detection uses machine learning to learn normal spend, including weekly or monthly seasonality and growth, and flags unusual changes. Monitors can watch all AWS services, specific member accounts, cost allocation tags or cost categories.
Alert subscriptions send individual alerts through SNS, or daily or weekly summaries by email, filtered by dollar or percentage impact. Root cause analysis ranks the service, account, Region and usage type behind an anomaly. It runs on Cost Explorer data, so detection can lag usage by up to about 24 hours.
Cost effective observability
CloudWatch charges mainly for log ingestion, log storage, queries, custom metrics, alarms and dashboards. Three levers control most of it.
Log filtering. Set application log levels, use Lambda log level controls, and drop debug output in production. Send high volume sources such as VPC Flow Logs straight to S3, in Parquet format.
Retention optimization. New log groups keep data forever by default. Set a retention period on every log group, export what compliance needs to S3, and apply lifecycle rules there.
Log class. The CloudWatch Logs Infrequent Access class has a lower ingestion price and suits logs used for ad hoc queries and forensics. It lacks metric filters, subscription filters, Live Tail and embedded metric format, and a log group's class cannot be changed after creation.
| Data | Lower cost approach |
|---|---|
| Debug logs | Filter at the source or keep short retention |
| Audit or forensic logs | Infrequent Access class or S3 with lifecycle rules |
| High volume network logs | Flow logs to S3 in Parquet, queried with Athena |
| Real time alarms on logs | Standard class with metric filters |
Metric aggregation
Every unique combination of metric name and dimensions is a separate custom metric, so high cardinality dimensions such as request ID multiply cost. Aggregate before publishing.
The CloudWatch agent can collect only the metrics you list, at a longer interval, and roll them up with aggregation_dimensions instead of sending a metric per instance. The embedded metric format turns structured log lines into metrics without separate API calls. Use high resolution metrics only where sub minute alarms are required.
For traces, AWS X-Ray sampling rules record a share of requests instead of all of them, which keeps tracing cost in line with traffic.
How the exam asks about this
- "Finance needs hourly, resource level cost data queried with SQL across all accounts." -> A CUR 2.0 export from the management account to S3, queried with Athena.
- "Development accounts must stop launching resources once their monthly budget is exceeded." -> An AWS Budgets action that applies a restrictive SCP.
- "CloudWatch Logs cost has grown because old debug logs are never deleted." -> Set retention on log groups and filter debug logs at the source.
What to remember for the exam
- Cost Explorer is for interactive analysis and forecasts, and CUR 2.0 is for line item detail in S3.
- Budgets alerts on actual or forecasted spend, and budget actions can apply IAM policies or SCPs or stop EC2 and RDS instances.
- Cost Anomaly Detection uses machine learning and can monitor services, accounts, tags or cost categories.
- CloudWatch log groups never expire by default, so always set retention.
- The Infrequent Access log class cuts ingestion cost but has no metric filters or subscription filters.
- High cardinality dimensions create many custom metrics, so aggregate before publishing.
Do not put security alerting logs in the Infrequent Access class. It cannot run metric filters or subscription filters, so the real time detection breaks.
Common mistakes
Using a budget to catch unknown spikes. A budget fires only at the threshold you set. Cost Anomaly Detection catches unusual changes that stay below it.
Querying billing data in Cost Explorer for custom chargeback. Cost Explorer is great for trends, but custom allocation logic needs the line items in CUR 2.0.
Logging everything at debug level forever. Ingestion and storage costs grow with volume and time. Filter at the source and set retention.
Check yourself
Which tool flags an unusual spend increase that stays below every budget threshold?
AWS Cost Anomaly Detection, which learns normal spend patterns with machine learning.
What is the default retention for a new CloudWatch Logs log group?
Logs never expire by default, so you must set a retention period to control storage cost.
Where should finance get resource level billing line items for SQL analysis?
A CUR 2.0 export through Data Exports to S3, queried with Amazon Athena.
Topic 8 of 8 in Cost-Optimized Architecture Design
Test yourself on Cost-Optimized Architecture Design
The full AWS SAP-C03 question bank has 850 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.