Cost Explorer Diagnostics
When to use
Any Cost Explorer or Budgets investigation where the console alone is insufficient — unexpected costs, allocation issues, budget alert failures, anomaly detection, savings plan recommendations, CUR configuration, or organizational billing.
Investigation workflow
Step 1 — Collect and triage
aws ce get-cost-and-usage --time-period Start=<yyyy-mm-dd>,End=<yyyy-mm-dd> --granularity MONTHLY --metrics UnblendedCost --group-by Type=DIMENSION,Key=SERVICE
aws budgets describe-budgets --account-id <account-id>
aws ce get-anomalies --date-interval StartDate=<yyyy-mm-dd>,EndDate=<yyyy-mm-dd>
aws ce get-cost-forecast --time-period Start=<yyyy-mm-dd>,End=<yyyy-mm-dd> --metric UNBLENDED_COST --granularity MONTHLY
Step 2 — Domain deep dive
aws ce get-cost-and-usage --time-period Start=<yyyy-mm-dd>,End=<yyyy-mm-dd> --granularity DAILY --metrics UnblendedCost --group-by Type=DIMENSION,Key=USAGE_TYPE --filter '{"Dimensions":{"Key":"SERVICE","Values":["<service>"]}}'
aws ce get-tags --time-period Start=<yyyy-mm-dd>,End=<yyyy-mm-dd>
aws ce get-reservation-utilization --time-period Start=<yyyy-mm-dd>,End=<yyyy-mm-dd>
aws ce get-savings-plans-utilization --time-period Start=<yyyy-mm-dd>,End=<yyyy-mm-dd>
aws cur describe-report-definitions
Read references/guardrails.md before concluding on any Cost Explorer issue.
Tool quick reference
| Tool / API |
When to use |
ce get-cost-and-usage |
Cost breakdown by service, account, region, tag |
ce get-cost-forecast |
Projected costs for future periods |
ce get-anomalies |
Detected cost anomalies |
ce get-tags |
Available cost allocation tags |
ce get-reservation-utilization |
RI utilization and coverage |
ce get-savings-plans-utilization |
Savings Plans utilization |
budgets describe-budgets |
Budget configuration and status |
budgets describe-notifications-for-budget |
Budget alert configuration |
cur describe-report-definitions |
CUR report setup |
Gotchas: Cost Explorer
- Cost Explorer data has a 24-48 hour delay. Do not expect real-time cost visibility.
- Cost allocation tags must be activated in the Billing console. Creating tags on resources does not automatically make them cost allocation tags.
- Budgets evaluate once per day (or per configured period). Budget alerts are not real-time.
- Anomaly detection uses machine learning and needs 2+ weeks of historical data to establish baselines.
- Savings Plans and Reserved Instances show as separate line items. Amortized cost spreads the upfront payment across the term.
- CUR reports are delivered to S3 with a delay of up to 24 hours. The first report may take up to 24 hours to appear.
- Linked account costs in Organizations require the management account to enable Cost Explorer access for member accounts.
- Unblended cost shows the actual charge. Blended cost averages across the organization. Amortized cost spreads upfront payments.
- Cost categories are custom groupings that take up to 24 hours to apply to new data.
- Budget actions can automatically apply SCPs, IAM policies, or target EC2/RDS instances when thresholds are breached.
Anti-hallucination rules
- Always cite specific cost data, budget configurations, anomaly details, or CUR report status as evidence.
- Cost Explorer data is delayed 24-48 hours. Never claim real-time cost visibility.
- Cost allocation tags must be activated separately. Never assume resource tags are automatically cost allocation tags.
- Budget alerts evaluate periodically, not in real-time. Never claim instant budget notifications.
- Anomaly detection needs historical data. Never expect anomaly detection to work on new accounts.
- Spend no more than 2 minutes on any single hypothesis. Pivot if inconclusive.
20 runbooks
| Category |
IDs |
Covers |
| A — Cost Analysis |
A1–A3 |
Unexpected costs, cost allocation, untagged resources |
| B — Budgets |
B1–B3 |
Budget alerts, forecast accuracy, action failures |
| C — Anomaly |
C1–C2 |
Anomaly detection, false positives |
| D — Savings |
D1–D2 |
RI/SP recommendations, utilization |
| E — Reports |
E1–E2 |
CUR setup, report delivery |
| F — Organization |
F1–F2 |
Linked account costs, consolidated billing |
| Z — Catch-All |
Z1 |
General troubleshooting |
1---2name: costexplorer-diagnostics3description: Use this skill to investigate and troubleshoot AWS Cost Explorer and Budgets problems by analyzing unexpected costs, cost allocation, tagging, budget alerts, forecast accuracy, budget actions, anomaly detection, savings recommendations, CUR reports, and organizational billing following structured runbooks. Activate when: unexpected cost spikes, cost allocation issues, untagged resources, budget alerts not firing, forecast inaccuracy, budget action failures, anomaly detection problems, false positive anomalies, RI/SP recommendation issues, utilization tracking, CUR setup problems, report delivery failures, linked account cost visibility, consolidated billing issues, or the user says something is wrong with Cost Explorer or Budgets without naming specific symptoms.4---56# Cost Explorer Diagnostics78## When to use910Any Cost Explorer or Budgets investigation where the console alone is insufficient — unexpected costs, allocation issues, budget alert failures, anomaly detection, savings plan recommendations, CUR configuration, or organizational billing.1112## Investigation workflow1314### Step 1 — Collect and triage1516```17aws ce get-cost-and-usage --time-period Start=<yyyy-mm-dd>,End=<yyyy-mm-dd> --granularity MONTHLY --metrics UnblendedCost --group-by Type=DIMENSION,Key=SERVICE18aws budgets describe-budgets --account-id <account-id>19aws ce get-anomalies --date-interval StartDate=<yyyy-mm-dd>,EndDate=<yyyy-mm-dd>20aws ce get-cost-forecast --time-period Start=<yyyy-mm-dd>,End=<yyyy-mm-dd> --metric UNBLENDED_COST --granularity MONTHLY21```2223### Step 2 — Domain deep dive2425```26aws ce get-cost-and-usage --time-period Start=<yyyy-mm-dd>,End=<yyyy-mm-dd> --granularity DAILY --metrics UnblendedCost --group-by Type=DIMENSION,Key=USAGE_TYPE --filter '{"Dimensions":{"Key":"SERVICE","Values":["<service>"]}}'27aws ce get-tags --time-period Start=<yyyy-mm-dd>,End=<yyyy-mm-dd>28aws ce get-reservation-utilization --time-period Start=<yyyy-mm-dd>,End=<yyyy-mm-dd>29aws ce get-savings-plans-utilization --time-period Start=<yyyy-mm-dd>,End=<yyyy-mm-dd>30aws cur describe-report-definitions31```3233Read `references/guardrails.md` before concluding on any Cost Explorer issue.3435## Tool quick reference3637| Tool / API | When to use |38|------------|-------------|39| `ce get-cost-and-usage` | Cost breakdown by service, account, region, tag |40| `ce get-cost-forecast` | Projected costs for future periods |41| `ce get-anomalies` | Detected cost anomalies |42| `ce get-tags` | Available cost allocation tags |43| `ce get-reservation-utilization` | RI utilization and coverage |44| `ce get-savings-plans-utilization` | Savings Plans utilization |45| `budgets describe-budgets` | Budget configuration and status |46| `budgets describe-notifications-for-budget` | Budget alert configuration |47| `cur describe-report-definitions` | CUR report setup |4849## Gotchas: Cost Explorer5051- Cost Explorer data has a 24-48 hour delay. Do not expect real-time cost visibility.52- Cost allocation tags must be activated in the Billing console. Creating tags on resources does not automatically make them cost allocation tags.53- Budgets evaluate once per day (or per configured period). Budget alerts are not real-time.54- Anomaly detection uses machine learning and needs 2+ weeks of historical data to establish baselines.55- Savings Plans and Reserved Instances show as separate line items. Amortized cost spreads the upfront payment across the term.56- CUR reports are delivered to S3 with a delay of up to 24 hours. The first report may take up to 24 hours to appear.57- Linked account costs in Organizations require the management account to enable Cost Explorer access for member accounts.58- Unblended cost shows the actual charge. Blended cost averages across the organization. Amortized cost spreads upfront payments.59- Cost categories are custom groupings that take up to 24 hours to apply to new data.60- Budget actions can automatically apply SCPs, IAM policies, or target EC2/RDS instances when thresholds are breached.6162## Anti-hallucination rules63641. Always cite specific cost data, budget configurations, anomaly details, or CUR report status as evidence.652. Cost Explorer data is delayed 24-48 hours. Never claim real-time cost visibility.663. Cost allocation tags must be activated separately. Never assume resource tags are automatically cost allocation tags.674. Budget alerts evaluate periodically, not in real-time. Never claim instant budget notifications.685. Anomaly detection needs historical data. Never expect anomaly detection to work on new accounts.696. Spend no more than 2 minutes on any single hypothesis. Pivot if inconclusive.7071## 20 runbooks7273| Category | IDs | Covers |74|----------|-----|--------|75| A — Cost Analysis | A1–A3 | Unexpected costs, cost allocation, untagged resources |76| B — Budgets | B1–B3 | Budget alerts, forecast accuracy, action failures |77| C — Anomaly | C1–C2 | Anomaly detection, false positives |78| D — Savings | D1–D2 | RI/SP recommendations, utilization |79| E — Reports | E1–E2 | CUR setup, report delivery |80| F — Organization | F1–F2 | Linked account costs, consolidated billing |81| Z — Catch-All | Z1 | General troubleshooting |
aws-samples