finops aws cost claude-curated
In an AWS Organization with many accounts the bill arrives consolidated, but the questions are always granular: which team, service, or environment drove this month’s spend, and why did it jump? Cost attribution is the discipline of answering that in minutes instead of days.
Where the numbers live
- Cost Explorer — interactive UI for “which service/account grew?” Fast for ad-hoc triage, ~24–48h latency, coarse historical granularity.
- Cost and Usage Report (CUR) — the raw ledger: every line item, hourly, delivered to S3. Query with Athena or load into Redshift / a lake for real analysis. This is the source of truth when Cost Explorer isn’t granular enough.
- Budgets + Cost Anomaly Detection — the alerting layer on top.
The two attribution levers
1. Account boundaries
Consolidated billing rolls every member account into one invoice while preserving a per-account breakdown. If accounts map cleanly to teams/environments, the account is the cost centre and attribution is nearly free. Splitting workloads across accounts for isolation pays a second dividend in cost clarity.
2. Cost allocation tags
Below the account level, tags are the only attribution mechanism. Discipline points that bite people:
- Tags must be activated in the billing console before they appear in CUR/Cost Explorer — and only from activation forward, never retroactively. Activate your standard tags on day one.
- Enforce tagging at creation (Terraform defaults, tag policies, SCP guardrails). Untagged resources become an un-attributable grey blob that grows silently.
- A small mandatory set (
team,environment,service) beats a large optional one nobody fills in.
Commitment discounts
| Reserved Instances | Savings Plans | Spot | |
|---|---|---|---|
| Flexibility | Instance family/region bound (Standard) | Compute SP: any region/family/OS | Any, but interruptible |
| Discount | Up to ~72% | Up to ~66% (Compute) / ~72% (EC2 SP) | Up to ~90% |
| Commitment | 1 or 3 yr, capacity or $ | 1 or 3 yr, $/hour | None |
| Best for | Stable, known-shape workloads | Stable spend, changing shape | Fault-tolerant / batch |
Rule of thumb: cover the stable baseline with Savings Plans, leave the spiky top on-demand, and push interruption-tolerant batch to Spot. Track coverage and utilisation — an over-committed SP you don’t use is just a discount you paid for and threw away.
Finding the spike
- Cost Anomaly Detection gives ML-based per-service/per-account alerts — cheaper signal than eyeballing Cost Explorer weekly.
- CUR + Athena for the forensic answer: group by
line_item_usage_account_id,product_servicecode, and yourresource_tags_user_*columns, diff month-over-month.
Pitfalls
- Data transfer & NAT Gateway costs hide across account boundaries and rarely carry good tags — often the mystery line item.
- Shared services (a central logging or networking account) accrue cost that logically belongs to consumers; use split-cost allocation or showback rules.
- Untagged = unattributable: measure your tag coverage as a first-class metric.
See also Organization SCP for enforcing tag guardrails and Athena for querying the CUR.